If you already hold ISO 9001, a large part of ISO 27001 is built. Here is the honest split between what transfers and what does not.
ISO 9001:2026, the sixth edition, publishes on 16 September 2026, and a three-year transition is expected. That puts a great many organisations into a management system review they did not plan. It is also the cheapest moment they will get to add ISO 27001, because the two standards share a structure and most people underestimate how much of the work is already done. This is the honest accounting: what transfers, what needs rewriting, and the one part that has no equivalent at all.
Since 2012 ISO has built its management system standards on a common skeleton, originally the High-Level Structure and, since a 2021 update, formally called the Harmonized Structure. Most people still call it Annex SL. Whatever the name, it fixes the clause numbering, the core text and the shared vocabulary across ISO 9001, ISO 27001, ISO 22301, ISO 14001, ISO 45001, ISO 27701 and ISO 42001.
That is why clause 7.5 means documented information in every one of them, and why clause 9.2 is internal audit whichever standard you open. The intent was to make running several management systems cheaper than running them separately. It works, but only if you know which parts genuinely transfer.
Documented information, clause 7.5, is the clearest win. Your document control process, version control, approval routing and retention rules apply unchanged. The documents themselves are different; the machinery that governs them is not.
The internal audit programme, clause 9.2, transfers as a programme. Your auditor competence criteria, scheduling, independence rules, reporting format and findings process all carry over. What changes is the audit criteria, because you are now auditing against an ISMS rather than a QMS, and most organisations need to develop or buy in information security audit competence.
Management review, clause 9.3, keeps its cadence, its governance and its minuting discipline. The standing agenda changes: you are adding risk assessment results, security incidents and control performance in place of quality objectives and customer satisfaction data. Many organisations simply extend the existing meeting rather than creating a second one, which auditors accept readily.
Nonconformity and corrective action, clause 10.2, is the same process applied to a different subject. Root cause analysis, corrective action tracking and effectiveness review need no redesign at all.
Competence and awareness, clauses 7.2 and 7.3, reuse the training records framework, the competence matrix and the induction process. The content is new; the evidence structure is not.
Context of the organisation, clause 4, looks identical and is not. The clause structure matches, but the analysis is done through a different lens. ISO 9001 asks what affects your ability to deliver conforming products and services. ISO 27001 asks what affects the confidentiality, integrity and availability of information. Your interested parties list will overlap heavily and their requirements will not.
Scope, clause 4.3, is the decision that drives cost more than any other in ISO 27001, and a QMS scope is rarely a sensible ISMS scope. Quality scopes tend to follow product lines. Information security scopes follow information flows, systems and locations. Copying one into the other is a common and expensive mistake.
Leadership and policy, clause 5, keeps its shape. The policy itself has to be written fresh, and top management needs to be able to speak to information security risk specifically when an auditor asks, which is a different conversation from the one they have rehearsed for quality.
Risk is where the two standards genuinely diverge, and it is the single largest piece of new work.
ISO 9001 clause 6.1 asks you to determine risks and opportunities and plan actions to address them. It deliberately does not mandate a formal risk assessment methodology, and many certified organisations satisfy it with a risk register and a review cycle.
ISO 27001 clause 6.1.2 and 6.1.3 require a defined information security risk assessment process that produces consistent, valid and comparable results, applied to identify risks to confidentiality, integrity and availability, with risk owners named. That feeds a risk treatment plan, and that in turn produces the Statement of Applicability: all 93 Annex A controls listed, each one included or excluded, each decision justified.
There is no ISO 9001 equivalent of Annex A, and no equivalent of the Statement of Applicability. Auditors read the SoA first. If you are budgeting a transition, this is the work to budget for.
ISO announced on 7 August 2026 that the final draft had been approved, with publication of the sixth edition confirmed for 16 September 2026. Accreditation bodies are expected to set a three-year transition, which would put the deadline for moving ISO 9001:2015 certificates at roughly September 2029. Formal transition rules come from IAF and the accreditation bodies after publication, so treat any specific date you see before then as an estimate.
The practical point is about sequencing rather than deadlines. You are going to reopen your management system documentation anyway. Doing an ISO 27001 implementation in the same pass means one set of document revisions, one internal audit programme redesign and one management review restructure, rather than two of each eighteen months apart.
Certification bodies will audit multiple standards in a single visit, and the shared clauses are genuinely audited once. That reduces audit days, though not by half: the Annex A controls, the risk assessment and the SoA all need their own time, and those are ISO 27001 only.
Ask for the combined audit day calculation before you commit to a certification body. Bodies quote this differently, and the difference between a well-constructed integrated audit and two audits held in the same week is real money every year for the life of the certificate.
Transfers intact. Document control, version control, approval and retention all apply unchanged.
Programme transfers. Criteria change, and you will need information security audit competence.
Cadence and governance transfer. The standing agenda gains risk, incidents and control performance.
Transfers intact. Same process, different subject matter.
Framework transfers. Training content is new, evidence structure is not.
Same clause, different lens. Redo the analysis for confidentiality, integrity and availability.
Rewrite. A quality scope follows product lines; an ISMS scope follows information flows and systems.
Substantially new. ISO 27001 mandates a formal, repeatable method that ISO 9001 does not.
No equivalent exists in ISO 9001. All 93 Annex A controls, each included or excluded with justification.
We assess your existing QMS against the ISO 27001 clauses and establish exactly what is reusable, rather than assuming the shared structure means shared content.
We define the ISMS scope from information flows and systems, deliberately not inherited from the quality scope.
The largest piece of genuinely new work. We build a repeatable method that produces consistent, comparable results and name risk owners.
All 93 Annex A controls assessed, included or excluded, each decision justified. This is the document the auditor opens first.
We extend your existing internal audit programme and management review rather than building parallel ones, which is what makes the combined audit worth having.
We manage the certification body through stage one and stage two, and put the combined audit day calculation in front of you before you commit.
Netru methodology