This manual links quality, information security and business continuity, so data backup, ICT continuity, incident handling and continuity planning are set out in one connected document.

Effective IMS Manuals

The IMS1 manual is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:

• Manual reference and title
• Information-classification
• Version
• Page number / total pages

alphaZ documents - beautifully designed, tried and tested management system documents. No junk, jargon or unnecessary content. Simple and usable documents developed over 25 years through practical use in the real world.

Further Reading

Further guidance on information security and business continuity:

• Backup, Business Continuity and ICT Recovery
• Business Continuity Risk and Impact Analysis
• ISO 27001 Annex A Controls
• Information Security knowledge base

How to Download

This manual is supplied within the ISO 9001, 27001 and 22301 Toolkit - click through to the toolkit for details. Every alphaZ ISO toolkit includes the IMS1 manual written for the standards it covers.

Need Help Implementing?

If you'd like hands-on help setting up your information security and business continuity manual, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

ISO 9001 / 27001 / 22301 Integrated Management System Manual

This version of the IMS1 Integrated Management System Manual covers ISO 9001:2026, ISO 27001:2022 and ISO 22301:2019. Sections 1 to 5 hold the shared framework and quality processes, Section 8 covers information security management with an IT network overview in Appendix iv, and business continuity is built into the scope, policies, responsibilities and 2.5.6.

Information security and continuity overlap at several points, and the manual joins them up. Data backup and continuity arrangements, including ICT systems, are summarised on F-IMS21 Business Continuity Register and referred to from both 1.5.4 and 8.2.2, ICT systems are restored as promptly as possible after a disruption while keeping security in place, and the policy list in 8.5 includes an ICT Continuity Policy.

What the Manual Covers

• Sections 1 and 2 - scope with the BCMS statement and the Statement of Applicability reference, context, information classification and data backup, legal compliance, policies including P-20 Information Security Policy and P-34 Business Continuity Policy Statement, objectives, the Information Security Lead and Business Continuity Lead, management review, and risks and opportunities with business continuity in 2.5.6
• Sections 3 to 5 - people, equipment and IT systems, communication including contingency arrangements with customers, operational processes, and problems, information security events, audits and improvement
• 8.1 Commitment to Information Security Management - the ISMS, the Statement of Applicability, policy and awareness
• 8.2 Information Security Arrangements - arrangements for workers, data backup and continuity, information deletion, incidents and evidence, suppliers, software and cloud services
• 8.3 IT Equipment and Physical Security - network management, equipment and systems monitoring, physical security and other arrangements, including what to do about cyber attacks
• 8.4 Information Security Risk Management - information security risk assessment, treatment, review and monitoring
• 8.5 Information Security Procedures and Policies - the topic-specific information security policies, from access control to ICT continuity

Built for ISO 9001, 27001 and 22301

• Business Continuity Lead and Information Security Lead roles, including subscribing to threat advisory services and keeping contact with specialist security forums
• Cloud services reviewed for security and suitability, with an exit strategy completed for any rated as high risk
• The information security risks register and business continuity risk register both named in the Appendix i registers key
• Business continuity and information security terms in Appendix iii, from business impact analysis and recovery time objective to CIA and vulnerability

Who Needs an ISO 9001 / 27001 / 22301 Integrated Manual?

Technology, data and service businesses that need to show customers their information is secure and their service will continue through a disruption use this manual to run ISO 9001, ISO 27001 and ISO 22301 as one system. It suits SMEs such as IT service providers, software companies and outsourced service providers who want security, continuity and quality managed through one set of documents.

Included in the ISO 9001, 27001 and 22301 Toolkit

This manual is part of the ISO 9001, 27001 and 22301 Toolkit, where it is supplied with the IMS1 Manual Guidance and the registers, forms, policies and procedures it refers to.

Using the Manual

Start with the roles in 2.2 and the BCMS statement in 1.2, then complete F-IMS21, the business continuity risk register and the information security risks register, as Sections 2 and 8 refer to them. Redraw the network diagram in Appendix iv, and check that the backup and ICT continuity arrangements described in 8.2.2 match the business continuity plans.

Related Documents

PP-8-100 Information Security Policy Procedure holds the topic-specific information security policies listed in 8.5, including ICT continuity, and PP-1-05 Business Continuity Policy Procedure is the business continuity procedure that 2.5.6 refers to. F-IMS21 Business Continuity Register summarises continuity and backup arrangements, and IMS1 Guidance explains each section of the manual.