I work for a small aerospace/defence manufacturing company tha has an established AS9100 QMS. I lead the IT department, and am in charge of developing our ISMS, based off of ISO 27001. With that we’re also trying to build up a lightweight ITSM framework, using ISO 20000 as inspiration. We need structured, accountable IT operations, the previous IT manager was more ad-hoc/cowboy style of getting things done.

Our ISMS/ITSM is under development, and we havent persued 27001 certifictaion yet.

I am firm in my beliefs that the ISMS/ITSM, and QSM need to have clearly defined roles/responsiblities/authority, not having one management system be subordinate to another. I am getting serious pushback from the existing QMS manager, who thinks that the existing QMS is the overarching management system and that every thing falls under it.

I feel that the ISMS should be a peer of QMS, not subservient to it.

I do know that the QMS and ISMS/ITSM will need to interact to some degree, I would like to use the ITSM service catalog, SLOs and their associated assurance evidence to act as the “bridge” between ISMS and QMS

Specifically I’ve had pushback over document control. The QMS manager believes that all policies/procedures/work instructions fall under the QMS doc control authority ( numbering, formats, approvals & revisions) I’ve proposed ISMS specific doc control using git for versioning and LaTex for authoring. Even the choice of using LaTex has been challenged as being “incompatible with the company”

The QMS Manager has made statements that they expect the existing QMS representative ( He’s now been calling himself the Integrated Management System representative) should serve as the final authority over other management systems, regardless of scope or domain.

I do see that there are some ( limited )areas that could share responsibilities like user training. A lot of the existing tools/programs skew heavily to the QMS. For example Corrective Actions are tied to customer satisfaction. That may be okay for QMS, but not so much for the ISMS.

My main concern is that allowing the QMS manager to have such a wide swath of authority in the ISMS, I’ll be run roughshod over and the ISMS will be subordinate to QMS.

Please tell me Im not crazy or stupid for thinking that the ISMS and QMS should be equals and that there should be a clear deliniation between the two ( with shared information where appropriate)