ISO/IEC 27013:2021
ISO/IEC's guidance on running ISO/IEC 27001 and ISO/IEC 20000-1 as one integrated management system, updated by Amendment 1 to ISO/IEC 27001:2022: aligning scopes, choosing the implementation path, keeping traceability to both standards, resolving where the two diverge on controls, assets, risk, incidents and change, and using service reporting, suppliers, capacity, continuity and release management to strengthen security.
ISO/IEC 27013:2021 is a compliance framework from International with 3 domains and 23 controls. The largest domains are Clause 6.1 and 6.2: Integration principles and the areas where the standards pull apart – ISO/IEC 27013:2021 (12 controls), Clause 6.3: Areas where one standard strengthens the other – ISO/IEC 27013:2021 (6 controls), Clause 5: Approaches for integrated implementation (scope, starting state, planning) – ISO/IEC 27013:2021 (5 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (3)
Clause 5: Approaches for integrated implementation (scope, starting state, planning) – ISO/IEC 27013:2021
| Code | Title |
|---|---|
| iso-iec-27013-2021::5.1 | Consider the integration factors before planning the combined system |
| iso-iec-27013-2021::5.2 | Define and align the scopes of the ISMS and the SMS |
| iso-iec-27013-2021::5.3.2 | Starting from neither standard: choose the order and run an integration working group |
| iso-iec-27013-2021::5.3.3 | Starting from one conforming system: integrate the other without loss of service or security |
| iso-iec-27013-2021::5.3.4 | Starting from two separate systems: review scopes, compatibility and the business case |
Clause 6.1 and 6.2: Integration principles and the areas where the standards pull apart – ISO/IEC 27013:2021
| Code | Title |
|---|---|
| iso-iec-27013-2021::6.1 | Use consistent terminology and keep documented traceability to both standards |
| iso-iec-27013-2021::6.2.1 | Distinguish requirements from Annex A controls and the statement of applicability |
| iso-iec-27013-2021::6.2.10 | Set classification and escalation criteria for sensitive incidents and restrict access to their records |
| iso-iec-27013-2021::6.2.11 | Run one change management process that reviews information security risk |
| iso-iec-27013-2021::6.2.2 | Decide how assets and configuration items are classified and keep configuration information secure |
| iso-iec-27013-2021::6.2.3 | Consider information security in the design, transition and removal of every service |
| iso-iec-27013-2021::6.2.4 | Adopt a risk management approach that serves both disciplines |
| iso-iec-27013-2021::6.2.5 | Agree risk levels and security expectations with customers and third parties early |
| iso-iec-27013-2021::6.2.6 | Decide how incidents in both scopes are handled and publish classification criteria |
| iso-iec-27013-2021::6.2.7 | Define the scope of problem management and link it to security analysis |
| iso-iec-27013-2021::6.2.8 | Balance evidence gathering against rapid service restoration |
| iso-iec-27013-2021::6.2.9 | Manage major incidents that are also security incidents with informed top management and skilled investigators |
Clause 6.3: Areas where one standard strengthens the other – ISO/IEC 27013:2021
| Code | Title |
|---|---|
| iso-iec-27013-2021::6.3.1 | Use service reporting to carry information security measures |
| iso-iec-27013-2021::6.3.2 | Secure top management commitment and a single continual improvement discipline |
| iso-iec-27013-2021::6.3.3 | Use capacity and demand management to support information security and availability |
| iso-iec-27013-2021::6.3.4 | Manage third parties and their risk through contracts and risk assessment |
| iso-iec-27013-2021::6.3.5 | Extend continuity and availability management to integrity and confidentiality |
| iso-iec-27013-2021::6.3.6 | Build information security into release and deployment, including emergency releases |
What is ISO/IEC 27013:2021 and who does it apply to?
ISO/IEC 27013:2021 is a compliance framework from International with 3 domains and 23 controls. ISO/IEC's guidance on running ISO/IEC 27001 and ISO/IEC 20000-1 as one integrated management system, updated by Amendment 1 to ISO/IEC 27001:2022: aligning scopes, choosing the implementation path, keeping traceability to both standards, resolving where the two diverge on controls, assets, risk, incidents and change, and using service reporting, suppliers, capacity, continuity and release management to strengthen security. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does ISO/IEC 27013:2021 actually require?
ISO/IEC 27013:2021 has 23 controls organised across 3 domains. The largest domains are Clause 6.1 and 6.2: Integration principles and the areas where the standards pull apart – ISO/IEC 27013:2021 (12 controls), Clause 6.3: Areas where one standard strengthens the other – ISO/IEC 27013:2021 (6 controls), Clause 5: Approaches for integrated implementation (scope, starting state, planning) – ISO/IEC 27013:2021 (5 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of ISO/IEC 27013:2021 do I already cover?
ISO/IEC 27013:2021 does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement ISO/IEC 27013:2021?
Start your ISO/IEC 27013:2021 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about ISO/IEC 27013:2021 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 23 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,248 frameworks.
Get Started Free →Free forever, no credit card required