ISO MSS Lifecycle Matrix

Which top-level ISO management-system standards matter for IT projects, how do they relate in authority, and what must happen in each lifecycle phase (initiation → decommissioning)?

edition Topic-TK/v01 companion MD Topic-WB/v01 author Droplet 2026-09-25 not on carousel yet

Topic-TK/v01 Human topic site · Companion AI workbook Topic-WB/v01 Topic_IsoMssMatrix_v01_Droplet.md · Same fact graph · Seed: 6 Gemini/Docs PDFs · Not a substitute for purchased ISO texts

Start here · essence

Only Type A requirements standards (“shall”) are certifiable; ISO/IEC 27001 is the InfoSec certifiable core. Roughly ~45 Type A MSS share the Harmonized Structure (Clauses 4–10). For IT PM, eight standards are in scope (T1: 27001, 20000-1, 42001 · T2: 9001, 22301, 37001, 28000, 55001). Centrepiece: the Master Operational Integration Matrix — those eight × five lifecycle phases, with phase-gate artifacts and an effort heatmap.

✓ Type A = certifiable audit benchmark [SRC-003] [SRC-004] · ✓ Eight IT-relevant standards [SRC-005] · ✓ Matrix + 4 gates + heatmap [SRC-006] · ~ Page counts / editions from seed chat — not store-reverified [SRC-005]

Formative synthesis from a Gemini/Docs chat seed (6 PDFs). Curated map — not a substitute for purchased ISO texts; not legal advice.

Field	Value
Seed question	Which top-level ISO MSS matter for IT projects, how they relate in authority, and what must happen each lifecycle phase?
Job	Curate Type A MSS landscape for IT PMs: eight standards, HS, phase×standard matrix with gates.
Host (planned)	`iso-mss-matrix.tiesa.tech` · private · not on carousel yet
Nodes	N1–N8 standards · N9 Hierarchy · N10 Harmonized Structure · N11 Phase gates
Official 27001	iso.org/standard/27001 · 27001:2022 store [SRC-002]

How to read

Map / Sessions — pick a standard or structure node (landscape strip or portrait cards).
Deep dive — full node content (also the Corkboard flip-side).
Diagrams — hierarchy · phase gates · IMS · 27000 family.
Workbench — filter the operational matrix by Tier / Phase.
Sources / Trail / Limitations — provenance bank.

N1 ISO/IEC 27001 · ISMS T1

Certifiable Information Security Management System — CIA triad, Clauses 4–10, Annex A 93 controls, Statement of Applicability.

Related: N9, N10, N11, N2 · [SRC-001] [SRC-005] [SRC-006]

N2 ISO/IEC 20000-1 · SMS/ITSM T1

IT Service Management requirements — SLAs, CAB, release, incident/problem; project-to-ops transition.

Related: N1, N10, N11 · [SRC-004] [SRC-005] [SRC-006]

N3 ISO/IEC 42001 · AIMS T1

AI Management System — AIIA, provenance, bias, transparency, drift monitoring.

Related: N1, N10, N11 · [SRC-004] [SRC-005] [SRC-006]

N4 ISO 9001 · QMS T2

Quality Management — process consistency, QA/QC, RTM, UAT, CAPA.

Related: N10, N11 · [SRC-004] [SRC-005] [SRC-006]

N5 ISO 22301 · BCMS T2

Business Continuity — BIA, RTO/RPO, HA/DR architecture, failover drills.

Related: N1, N10, N11 · [SRC-004] [SRC-005] [SRC-006]

N6 ISO 37001 · ABMS T2

Anti-bribery — vendor due diligence, bidding integrity, gifts, conflict of interest.

Related: N7, N11 · [SRC-004] [SRC-005] [SRC-006]

N7 ISO 28000 · Supply chain security T2

Supply-chain / TPRM — SBOM, MSP risk, hardware chain-of-custody, CVE tracking.

Related: N6, N1, N11 · [SRC-004] [SRC-005] [SRC-006]

N8 ISO 55001 · Asset management T2

ITAM lifecycle — capitalization, licensing, CMDB, decommissioning / e-waste.

Related: N1, N11 · [SRC-004] [SRC-005] [SRC-006]

N9 Document hierarchy · Type A / B

Requirements (Type A, certifiable) above Guidelines (Type B), TS, competence standards, and drafts.

Related: N1, N10 · [SRC-003] [SRC-004]

N10 Harmonized Structure (Annex SL)

Shared Clauses 4–10 DNA across Type A MSS — enables Integrated Management System audits.

Related: N1–N8, N9 · [SRC-001] [SRC-004]

N11 Phase gates & matrix

Five phases · four mandatory gates · relative effort heatmap — the operational centrepiece.

Related: N1–N8 · [SRC-006] · Open Workbench for the full matrix.

N1 27001 ISMS · T1

Certifiable ISMS core · CIA · Annex A 93 controls

N2 20000-1 SMS · T1

ITSM / SLA / CAB / project-to-ops

N3 42001 AIMS · T1

AI governance · AIIA · bias · drift

N4 9001 QMS · T2

Quality · RTM · UAT · CAPA

N5 22301 BCMS · T2

BIA · RTO/RPO · DR drills

N6 37001 ABMS · T2

Anti-bribery · procurement integrity

N7 28000 Supply · T2

TPRM · SBOM · chain-of-custody

N8 55001 Assets · T2

ITAM · licence · decommission

N9 Type A/B hierarchy

Certifiable vs guidance vs drafts

N10 Harmonized Structure

Clauses 4–10 shared DNA

N11 Phase gates

5 phases · 4 gates · heatmap

Selected node · also the Corkboard flip-side.

N1 · ISO/IEC 27001 · Information Security Management System

Tier 1 ✓ Type A · certifiable Seed editions: 2022 (+Amd 1:2024) · first 2005 · ~19 core pages ~

Globally recognised requirements standard for establishing, implementing, maintaining and continually improving an ISMS. Preserves Confidentiality, Integrity and Availability of information assets. Governed by ISO/IEC JTC 1/SC 27. Core architecture = Harmonized Structure Clauses 4–10 + Annex A reference controls. Primary output = Statement of Applicability (SoA).

✓ Primary certifiable management requirement in the SC 27 catalogue [SRC-003]
✓ Annex A (2022): 93 controls — Organizational 37 · People 8 · Physical 14 · Technological 34 [SRC-001]
✓ Certification cycle: Stage 1 readiness → Stage 2 implementation → surveillance Y1/Y2 → recertification Y3 [SRC-001]
~ Concise core page count because Annex A is elaborated in companion ISO/IEC 27002 (seed ~156 pp) [SRC-005]

Matrix activities [SRC-006]

P1 Define ISMS scope & boundaries; classify information assets; security requirements in RFP/vendor vetting
P2 Threat modelling (e.g. STRIDE); SoA control mapping; encryption & key architecture
P3 Secure coding (A.8.28); least-privilege RBAC; SAST
P4 Penetration testing & DAST; security acceptance sign-off; pre-release vulnerability remediation
P5 Continuous SIEM/SOC telemetry (A.8.16); patch & vuln management; cryptographic wiping at retirement (A.8.10)

Official: Homepage · 27001:2022 store [SRC-002]

N10 · Harmonized Structure (formerly Annex SL)

All top-level Type A MSS share identical clause titles, text definitions, and high-level requirements across Clauses 4–10. This shared skeleton enables an Integrated Management System (IMS) — one enterprise audited simultaneously for Quality, Environment, InfoSec, etc.

Clause	Harmonized core	27001 flavour [SRC-001][SRC-004]
4	Context & scope	Information asset boundaries; legal & regulatory footprint
5	Leadership & commitment	InfoSec policy; CISO/board governance
6	Risk planning & objectives	CIA risk assessment & SoA
7	Support & resources	Awareness, competence, documentation
8	Operational planning & control	Risk Treatment Plan & technical controls
9	Performance evaluation	Internal audits, metrics, management review
10	Continual improvement	Incident root-cause & corrective actions

ICS code 03.100.70 tags management-system documents. [SRC-003]

N11 · Phase gates & Master Operational Integration Matrix

Five lifecycle phases with four mandatory verification gates. A gate cannot clear without the corresponding verified artifacts. Full cell text lives in the Workbench tab.

Four gates [SRC-006]

Gate 1 — Charter & Procurement Clearance (P1→P2): Vendor Due Diligence (37001); Scope & Criticality (27001/22301); Initial AIIA (42001). Also supply-chain integrity (28000).
Gate 2 — Architectural Baseline Sign-Off (P2→P3): Threat Model (27001); Service Design Package (20000-1); BIA & RTO/RPO (22301); SoA alignment.
Gate 3 — Verification & Build Quality (P3→P4): SAST/Code Review (27001/9001); SBOM (28000); Bias Audit Metrics (42001).
Gate 4 — CAB & Operations Handover (P4→P5): CAB Approval (20000-1); Pentest Report (27001); UAT Sign-off (9001); Asset Register (55001); DR simulation (22301).

Effort heatmap summary [SRC-006]

Legend: Critical mandatory gate focus · Moderate ongoing · Low background compliance

Standard	Initiation	Planning	Execution	Transition	Operations
27001	Mod	Crit	Crit	Crit	Crit
20000-1	Mod	Crit	Mod	Crit	Crit
42001	Crit	Crit	Crit	Crit	Mod
9001	Crit	Crit	Crit	Crit	Mod
22301	Mod	Crit	Mod	Crit	Mod
37001	Crit	Mod	Low	Mod	Low
28000	Crit	Mod	Crit	Mod	Low
55001	Mod	Mod	Mod	Crit	Crit

D1 · Hierarchy flowchart — Authority tiers. Reads as: only Type A is certifiable. Nodes N9, N1. [SRC-003] [SRC-004]

flowchart TD
  ROOT["ISO repository · ~25,000+ standards"]
  ROOT --> MSS["Management System Standards · ~80+"]
  ROOT --> TECH["Technical specs / crypto / formats / tests"]
  MSS --> TA["Type A Requirements · ~40–45 · SHALL · Certifiable"]
  MSS --> TB["Type B Guidelines · ~35–40 · SHOULD · Advisory"]
  TA --> BIG["Big-league surveyed · 9001, 14001, 27001, 45001, 42001…"]
  TA --> IT8["IT PM scope · 8 standards T1+T2"]
  TB --> G27002["e.g. ISO/IEC 27002, 27003, 31000"]
  TECH --> TS["TS / TR / WD / CD / DIS"]

D2 · Phase-gate flowchart — Four mandatory IMS gates. Reads as: no phase advance without artifacts. Node N11. [SRC-006]

flowchart TD
  P1["Phase 1 · Initiation & Procurement"]
  G1["GATE 1 · Charter & Procurement Clearance"]
  P2["Phase 2 · Architecture & Planning"]
  G2["GATE 2 · Architectural Baseline Sign-Off"]
  P3["Phase 3 · Build & Execution / SDLC"]
  G3["GATE 3 · Verification & Build Quality"]
  P4["Phase 4 · Transition & Go-Live"]
  G4["GATE 4 · CAB & Operations Handover"]
  P5["Phase 5 · Operations & Decommissioning"]
  P1 --> G1 --> P2 --> G2 --> P3 --> G3 --> P4 --> G4 --> P5

D3 · IMS integration — Harmonized Structure spine with eight IT overlays. Nodes N10, N1–N8. [SRC-004] [SRC-005]

flowchart LR
  HS["Harmonized Structure\nClauses 4–10"]
  HS --> IMS["Integrated Management System"]
  IMS --> T1["Tier 1"]
  IMS --> T2["Tier 2"]
  T1 --> S27001["27001 ISMS"]
  T1 --> S20000["20000-1 SMS"]
  T1 --> S42001["42001 AIMS"]
  T2 --> S9001["9001 QMS"]
  T2 --> S22301["22301 BCMS"]
  T2 --> S37001["37001 ABMS"]
  T2 --> S28000["28000 Supply"]
  T2 --> S55001["55001 Assets"]

D4 · 27000 family PBS — Certifiable 27001 core plus companion guidance. Node N1. [SRC-002]

flowchart TD
  F27000["ISO/IEC 27000 family"]
  F27000 --> C27001["27001 Requirements · CERTIFIABLE"]
  F27000 --> C27000["27000 Overview & vocabulary"]
  F27000 --> C27002["27002 Controls guidance"]
  F27000 --> C27003["27003 ISMS implementation"]
  F27000 --> C27004["27004 Monitoring & metrics"]
  F27000 --> C27005["27005 Risk guidance"]
  F27000 --> C27017["27017 Cloud controls"]
  F27000 --> C27018["27018 Public-cloud PII"]
  F27000 --> C27701["27701 Privacy / PIMS extension"]

Workbench · Master Operational Integration Matrix

Filter by Tier and/or Phase. Cell text from seed matrix [SRC-006]. Heatmap levels: Critical / Moderate / Low.

Tier

Phase

ISO/IEC 27001 · ISMS T1

P1 Initiation & Procurement Define project ISMS scope & boundaries · Classify project information assets · Security requirements in RFP/vendor vetting

P2 Architecture & Planning Threat modelling (e.g. STRIDE) · Statement of Applicability (SoA) control mapping · Encryption & cryptographic key architecture

P3 Build & Execution (SDLC) Enforce secure coding (A.8.28) · Least-privilege access control (RBAC) · Static Application Security Testing (SAST)

P4 Transition & Go-Live Penetration testing & DAST · Security acceptance sign-off · Pre-release vulnerability remediation verification

P5 Operations & Decommissioning Continuous SIEM/SOC telemetry (A.8.16) · Patch & vulnerability management · Cryptographic data wiping / sanitisation at retirement (A.8.10)

ISO/IEC 20000-1 · SMS/ITSM T1

P1 Initiation & Procurement Map project output to IT Service Catalogue · Draft preliminary SLA, OLA, and KPI targets · Operational stakeholder / Service Owner onboarding

P2 Architecture & Planning Produce Service Design Package (SDP) · Capacity, availability, and continuity modelling · Define change classification workflows

P3 Build & Execution (SDLC) Baseline assets in Configuration Management System (CMS) · Build operational runbooks & SOPs · Define Incident & Problem routing logic

P4 Transition & Go-Live Change Advisory Board (CAB) deployment approval · Release & Deployment management sign-off · Service Desk training & knowledge base handover

P5 Operations & Decommissioning Incident, Problem, and Request fulfilment cycles · SLA/OLA performance reporting · Continual Service Improvement (CSI) reviews

ISO/IEC 42001 · AIMS T1

P1 Initiation & Procurement Define AI system intended purpose & boundaries · Initial AI Impact Assessment (AIIA) on individuals/society · Algorithmic ethics & regulatory compliance check

P2 Architecture & Planning Data governance, provenance, and lineage planning · Design explainability & interpretability measures · AI risk assessment & bias mitigation architecture

P3 Build & Execution (SDLC) Clean, tokenise, and validate training/testing data · Model development with bias auditing · Establish baseline metrics for model drift & fairness

P4 Transition & Go-Live Verification & Validation (V&V) against AI acceptance gates · Transparency & user disclosure documentation · Human-in-the-loop (HITL) workflow testing

P5 Operations & Decommissioning Real-time model drift & hallucination monitoring · Periodic AI re-evaluation & recalibration · Model retirement, weight archiving, and data disposal

ISO 9001 · QMS T2

P1 Initiation & Procurement Formal Project Charter & stakeholder identification · Customer requirement definition · Quality Assurance / Quality Control (QA/QC) plan

P2 Architecture & Planning Work Breakdown Structure (WBS) & milestone baselining · Establish Requirements Traceability Matrix (RTM) · Define “Definition of Ready” (DoR) & “Done” (DoD)

P3 Build & Execution (SDLC) Continuous Integration & automated unit testing · Non-conformance logging & defect triage · QA peer code reviews & audit trail maintenance

P4 Transition & Go-Live Formal User Acceptance Testing (UAT) · Customer/Sponsor formal delivery sign-off · Non-conformance resolution prior to acceptance

P5 Operations & Decommissioning Customer Satisfaction (CSAT) scoring · Post-Implementation Review (PIR / Lessons Learned) · Corrective and Preventive Actions (CAPA)

ISO 22301 · BCMS T2

P1 Initiation & Procurement Identify critical business functions impacted · Define target Recovery Time Objectives (RTO) · Define target Recovery Point Objectives (RPO)

P2 Architecture & Planning Conduct project Business Impact Analysis (BIA) · Design high-availability & disaster recovery architecture · Write Disaster Recovery (DR) execution runbooks

P3 Build & Execution (SDLC) Configure automated backup routines & geo-replication · Multi-region failover sandbox validation · Redundant infrastructure orchestration

P4 Transition & Go-Live DR failover simulation / tabletop cutover test · Incident command & operational escalation dry run · BCMS sign-off for operational readiness

P5 Operations & Decommissioning Scheduled live/simulated DR recovery drills · Annual BIA review against infrastructure changes · Failover post-mortem analysis

ISO 37001 · Anti-bribery T2

P1 Initiation & Procurement Anti-bribery due diligence on vendors/consortia · Bidding process integrity clearance · Procurement conflict of interest declarations

P2 Architecture & Planning Contractual anti-bribery covenants & compliance clauses · Establish transparent milestone-linked payment terms · Commercial vetting of tier-2 subcontractors

P3 Build & Execution (SDLC) Audit financial disbursements against milestones · Segregation of duties for invoice approval · Log and audit commercial gifts/hospitality

P4 Transition & Go-Live Final commercial reconciliation audit · Procurement sign-off confirming fair supplier settlement · Delivery verification prior to final balance release

P5 Operations & Decommissioning Post-project financial audit trails · Retain financial records for statutory audit windows · Channel whistleblowing/grievance reports

ISO 28000 · Supply chain security T2

P1 Initiation & Procurement Supplier security profiling & origin verification · Geopolitical & jurisdictional risk screening · Contractual supply chain compliance mandates

P2 Architecture & Planning Define Software Bill of Materials (SBOM) policy · Secure repository and mirror infrastructure design · Hardware chain-of-custody tracking protocol

P3 Build & Execution (SDLC) Dependency vulnerability scanning (SCA) · Cryptographic verification of packages & container registries · Secure logistics for physical hardware deliveries

P4 Transition & Go-Live Final SBOM audit against published vulnerabilities (CVEs) · Tamper-evident hardware verification at data centres · Third-party code provenance validation

P5 Operations & Decommissioning Upstream component vulnerability tracking · Ongoing vendor risk reassessments · Supplier contract termination & access revocation

ISO 55001 · Asset management T2

P1 Initiation & Procurement Asset capitalisation feasibility assessment · Hardware/software procurement budget alignment · Total Cost of Ownership (TCO) calculation

P2 Architecture & Planning Software licence consumption architecture · Cloud compute capacity allocation strategy · Establish IT Asset Management (ITAM) taxonomy

P3 Build & Execution (SDLC) Resource tagging implementation across cloud tenancies · CMDB ingestion of new physical & virtual assets · Licence entitlement tracking and allocation

P4 Transition & Go-Live Formal transfer of project assets to IT operations register · Final capital asset value baselining · Insurance and maintenance contract activation

P5 Operations & Decommissioning Depreciation & lifecycle tracking · Unused licence reclamation & right-sizing · Physical e-waste destruction & certificate verification

Phase-gate artifact checklist

Gate	Transition	Mandatory artifacts
Gate 1	Initiation → Planning	Vendor Due Diligence (37001) · Scope & Criticality (27001/22301) · Initial AIIA (42001) · supply-chain integrity (28000)
Gate 2	Planning → Execution	Threat Model (27001) · Service Design Package (20000-1) · BIA & RTO/RPO Baseline (22301) · SoA alignment
Gate 3	Execution → Transition	SAST/Code Review Reports (27001/9001) · SBOM (28000) · Bias Audit Metrics (42001)
Gate 4	Transition → Operations	CAB Approval (20000-1) · Pentest Report (27001) · UAT Sign-off (9001) · Asset Register (55001) · DR simulation (22301)

Source: Master Operational Integration Matrix seed. [SRC-006]

Official ISO portal links

URLs from seed verification table. [SRC-002]

Trail · method & decisions

Step	Decision	Why
Scope lock	IT-relevant Type A MSS + lifecycle matrix	Seed question + SRC-005/006
Sources kept	Six Gemini/Docs chat export PDFs (SRC-001…006) + official ISO URLs quoted therein	Must-use seed
Sources excluded	Full ISO store purchase texts; non-IT MSS deep dives (14001, 45001, 22000…)	Out of scope / not a substitute for standards
DEC-01	Limit operational table to 8 IT-relevant standards (T1×3 + T2×5)	SRC-005 user ask
DEC-02	Centrepiece = Master Operational Integration Matrix + gates + heatmap	SRC-006
DEC-03	Corkboard on (11 nodes); MCP off; not for carousel yet	Build brief
DEC-04	Page counts/editions marked ~ — formative, not store-verified	Limitations honesty
DEC-05	Do not invent standards beyond the seed eight + hierarchy/HS/gates pins	Build brief
DEC-06	Prior Gemini HTML artefact reviewed (dark single-page dump); superseded by this Droplet dual-bank + landscape/corkboard build	Parent steering 2026-09-25

Corkboard · ISO MSS pins

Start here · essence

How to read

N1 ISO/IEC 27001 · ISMS T1

N2 ISO/IEC 20000-1 · SMS/ITSM T1

N3 ISO/IEC 42001 · AIMS T1

N4 ISO 9001 · QMS T2

N5 ISO 22301 · BCMS T2

N6 ISO 37001 · ABMS T2

N7 ISO 28000 · Supply chain security T2

N8 ISO 55001 · Asset management T2

N9 Document hierarchy · Type A / B

N10 Harmonized Structure (Annex SL)

N11 Phase gates & matrix

N1 27001 ISMS · T1

N2 20000-1 SMS · T1

N3 42001 AIMS · T1

N4 9001 QMS · T2

N5 22301 BCMS · T2

N6 37001 ABMS · T2

N7 28000 Supply · T2

N8 55001 Assets · T2

N9 Type A/B hierarchy

N10 Harmonized Structure

N11 Phase gates

N1 · ISO/IEC 27001 · Information Security Management System

Matrix activities [SRC-006]

N2 · ISO/IEC 20000-1 · IT Service Management System

Matrix activities [SRC-006]

N3 · ISO/IEC 42001 · Artificial Intelligence Management System

Matrix activities [SRC-006]

N4 · ISO 9001 · Quality Management System

Matrix activities [SRC-006]

N5 · ISO 22301 · Business Continuity Management System

Matrix activities [SRC-006]

N6 · ISO 37001 · Anti-Bribery Management System

Matrix activities [SRC-006]

N7 · ISO 28000 · Supply Chain Security Management

Matrix activities [SRC-006]

N8 · ISO 55001 · Asset Management System

Matrix activities [SRC-006]

N9 · Document hierarchy · Type A vs Type B

N10 · Harmonized Structure (formerly Annex SL)

N11 · Phase gates & Master Operational Integration Matrix

Four gates [SRC-006]

Effort heatmap summary [SRC-006]

Workbench · Master Operational Integration Matrix

ISO/IEC 27001 · ISMS T1

ISO/IEC 20000-1 · SMS/ITSM T1

ISO/IEC 42001 · AIMS T1

ISO 9001 · QMS T2

ISO 22301 · BCMS T2

ISO 37001 · Anti-bribery T2

ISO 28000 · Supply chain security T2

ISO 55001 · Asset management T2

Phase-gate artifact checklist

Official ISO portal links

Sources

Trail · method & decisions

Limitations