This manual runs quality and information security as one system, with Section 8 covering access, assets, incidents, suppliers, cloud services and information security risk.

Effective IMS Manuals

The IMS1 manual is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:

• Manual reference and title
• Information-classification
• Version
• Page number / total pages

alphaZ documents - beautifully designed, tried and tested management system documents. No junk, jargon or unnecessary content. Simple and usable documents developed over 25 years through practical use in the real world.

Further Reading

Further guidance on information security management:

• Managing Information Security Risks
• ISO 27001 Annex A Controls
• Integrated Management Systems
• Information Security knowledge base

How to Download

This manual is supplied within the ISO 9001 and ISO 27001 Toolkit - click through to the toolkit for details. Every alphaZ ISO toolkit includes the IMS1 manual written for the standards it covers.

Need Help Implementing?

If you'd like hands-on help tailoring the integrated manual to your IT and information security arrangements, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

ISO 9001 / 27001 Integrated Management System Manual

This version of the IMS1 Integrated Management System Manual covers ISO 9001:2026 and ISO 27001:2022. Sections 1 to 5 hold the shared framework and the quality processes, Section 8 Information Security Management covers the ISMS in full, and Appendix iv gives an overview of the IT network.

Quality and information security connect through the common sections. The scope in 1.2 points to F-IMS26 Statement of Applicability for Annex A controls that do not apply, 1.5 sets out information classification and data backup, an Information Security Lead is named in 2.2, and 5.2 deals with information security events alongside problems and complaints.

What the Manual Covers

• Sections 1 to 5 - quality management and the shared clauses: scope and context, document control with information classification, policies including P-20 Information Security Policy, objectives informed by information security risk treatment, responsibilities, management review, resources, operational processes, and monitoring and improvement
• 8.1 Commitment to Information Security Management - the ISMS and what it protects, F-IMS26 Statement of Applicability, the information security policy and awareness
• 8.2 Information Security Arrangements - arrangements for workers, data and information assets, incidents and evidence, third parties and suppliers, software and systems, and cloud computing services on F-IMS39
• 8.3 IT Equipment and Physical Security - network management, equipment and systems monitoring, malware protection, endpoint devices, storage media, cryptography, physical security, passwords, technical vulnerabilities and remote working
• 8.4 Information Security Risk Management - a risk assessment process with set criteria and threat intelligence, risk assessment on the information security risks register, risk treatment, review and monitoring
• 8.5 Information Security Procedures and Policies - the topic-specific policies in PP-8-100 Information Security Policy Procedure, with a summary of what each covers

The Appendices

• Appendix i - External File References - folders and a registers key naming the information security risks register and the IT equipment register
• Appendix ii - IMS Folder Filing System - the suggested IMS folder structure for documents and evidence
• Appendix iii - Terms and Definitions - general terms plus information security terms such as access control, asset, CIA, non-repudiation and Statement of Applicability
• Appendix iv - IT Systems - Network Overview - a diagram of the company network to redraw for your own systems

Who Needs an ISO 9001 / 27001 Integrated Manual?

Organisations that hold customer data or provide IT and digital services, and want ISO 9001 and ISO 27001 certification together, use this manual to run quality and information security as one system. It suits SMEs where the same team handles service delivery and IT, so one set of policies, one problem process and one management review cover both standards.

Included in the ISO 9001 and ISO 27001 Toolkit

This manual is part of the ISO 9001 and ISO 27001 Toolkit, where it is supplied with the IMS1 Manual Guidance and the registers, forms, policies and procedures it refers to.

Using the Manual

The policy list in 8.5 matches the section headings in PP-8-100, and other parts of the manual refer to that list, so a new or renamed policy only needs changing in one place. Work through 8.2 and 8.3 arrangement by arrangement against what is actually in place, record logins and devices on the IT equipment register, and remember that F-IMS26 refers to much of Section 8, so any content removed there needs a matching change to it.

Related Documents

PP-8-100 Information Security Policy Procedure holds the topic-specific policies listed in 8.5, and IMS1 Guidance explains each section with the Annex A references behind Section 8. The clause-by-clause ISO 9001:2026 Correlation maps ISO 9001:2026 to the manual, and F-IMS23 Opportunities and Risks Register holds the key risks and opportunities.