What is a management system?
A management system bundles the rules with which management steers a subject: objectives, roles, processes, evidence and a mechanism that detects deviations and triggers improvement. BSI Standard 200-1 comes from Germany's Federal Office for Information Security. In chapter 3.1 it describes a management system as all the rules that steer and direct an organisation towards its objectives.
The ISMS is the part of it that deals with information security. Without the mechanism for deviations and improvement, what remains is a set of documents with no control loop.
What is the harmonised structure?
The harmonised structure is the common outline with template text that ISO prescribes for management system standards. It is also called Annex SL or the High Level Structure.
The template text speaks of the "XXX management system"; each standard inserts its subject. Taking ISO/IEC 27001 as the example, the clauses look like this (BSI mapping table):
| Clause | What it covers |
|---|---|
| 4 | frame and scope: what the system covers and who expects what |
| 5 | top-management responsibility and roles |
| 6 | setting objectives, planning for risks and opportunities |
| 7 | providing means, knowledge and documentation |
| 8 | running the planned activities day to day |
| 9 | measuring effect, auditing internally and reviewing at management level |
| 10 | fixing deviations and improving the system |
Clauses 1 to 3 are introductory; the requirements sit in clauses 4 to 10. Since its alignment with Annex SL, ISO/IEC 27001 no longer names the PDCA cycle explicitly. According to BSI Standard 200-1, ISMS activities can still be organised along it.
How tightly the standards are coupled showed in the 2024 climate amendment. ISO added sentences on climate change to clauses 4.1 and 4.2 of the template text. The same change appeared as an amendment to ISO/IEC 27001:2022, ISO 22301:2019, ISO 37301:2021, ISO 9001:2015 and other standards.
What differs between ISO 27001, ISO 22301 and ISO 37301?
The mechanics stay the same; the subject changes:
| Standard | Management system for | Subject-specific part |
|---|---|---|
| ISO/IEC 27001:2022 | information security | risk assessment and treatment (clauses 6.1.2, 6.1.3, 8.2, 8.3); Annex A with 93 controls |
| ISO 22301:2019 | business continuity | requirements for business continuity; BSI Standard 200-4 contains a mapping to this standard |
| ISO 37301:2021 | compliance | requirements for compliance management |
| ISO 9001 | quality | requirements for quality management; the current edition is ISO 9001:2026 |
Anyone running ISO/IEC 27001, ISO 22301 or ISO 37301 already has clauses 4 to 10 in place for the next one. Only the subject-specific part is added. How information security and business continuity differ in detail is covered in the comparison ISO 27001 vs ISO 22301.
Six building blocks can be shared between management systems
An integrated management system runs several standards on shared building blocks. Six of them can be shared, while the content attached to each stays subject-specific:
| Can be shared | Subject-specific |
|---|---|
| environment and stakeholders | risk methodology per subject |
| policy framework and document management | substantive requirements |
| role model and training process | specialist competence requirements |
| audit programme and pool of auditors | depth of examination per standard |
| management review | inputs and metrics |
| nonconformity and action procedure | assessment criteria |
The benefit is one audit programme instead of three, one management review instead of several, and one action register for all subjects.
DORA, the BSIG and the GDPR require building blocks, not a certificate
Three provisions require building blocks of a management system without prescribing a certificate:
| Provision | Building block |
|---|---|
| Article 6(1) of Regulation (EU) 2022/2554 (DORA) | ICT risk management framework as part of the overall risk management system |
| § 30(2) sentence 2 nos. 1 and 6 of the BSI Act (BSIG) | concepts for risk analysis; procedures for assessing effectiveness |
| Art. 32(1)(d) GDPR | a process for regularly testing the effectiveness of the measures |
An existing management system carries such requirements, because it already organises risk assessment, evidence and effectiveness reviews. Whether a specific provision is met, though, depends on matching its scope against the scope of the system.
How Rizzqo runs ISO/IEC 27001 alongside other frameworks on one asset register
Rizzqo carries the requirements of ISO/IEC 27001 and other frameworks on a shared asset register. ISO/IEC 27001 and ISO/IEC 27002 are held as requirement catalogues. Their requirements appear on the same assets as those from DORA or the Cyber Resilience Act. For the management review under clause 9.3, daily snapshots freeze the coverage that Rizzqo computes from finalised answers, so a trend over months is available.
Corrective actions under clause 10 run as tasks in one register for all frameworks and sync with Jira in both directions.