Last Updated: 14 October
Choosing the right ISO standard depends on what your organisation needs to prove.
If your priority is quality, ISO 9001 may be the best starting point. For information security, look at ISO 27001. For AI governance, ISO 42001. Other standards address environmental performance, privacy, business continuity and workplace health and safety.
With World Standards Day taking place on 14 October, now is a good time to review whether ISO certification could help your organisation strengthen governance, demonstrate compliance and meet tender or customer assurance requirements.
Which ISO standard does your business need?
Here is a simple guide to seven of the most relevant standards for organisations in construction, professional services, manufacturing and technology.
ISO 9001: Quality Management
Best for: organisations that want to demonstrate consistent quality and improve how they deliver products or services.
ISO 9001 provides a framework for a Quality Management System and focuses on areas including customer requirements, leadership, processes and continual improvement.
The current edition, ISO 9001:2026, was published in September 2026 and replaces ISO 9001:2015.
Consider ISO 9001 if: customers or tenders expect evidence of structured quality management.
ISO 14001: Environmental Management
Best for: organisations looking to manage their environmental responsibilities more systematically.
ISO 14001 provides a framework for an Environmental Management System, helping organisations manage environmental impacts, compliance obligations and improvement objectives.
The current edition is ISO 14001:2026.
Consider ISO 14001 if: sustainability, environmental performance or supply-chain requirements are important to your customers.
ISO 22301: Business Continuity
Best for: organisations that need to demonstrate they can continue operating during disruption.
ISO 22301 covers Business Continuity Management Systems and helps organisations prepare for, respond to and recover from disruptive incidents. The current published edition is ISO 22301:2019, although a replacement edition is under development.
Consider ISO 22301 if: service availability and resilience are important to customers or contracts.
ISO 27001: Information Security
Best for: organisations that handle sensitive, confidential or commercially important information.
ISO/IEC 27001:2022 sets requirements for an Information Security Management System, helping organisations manage information security risks systematically.
Consider ISO 27001 if: customers regularly ask how you protect their information, or security assurance forms part of tenders and supplier assessments.
ISO 27701: Privacy Management
Best for: organisations responsible for processing significant amounts of personal information.
ISO/IEC 27701:2025 provides requirements and guidance for a Privacy Information Management System and is designed for organisations acting as controllers or processors of personally identifiable information.
Consider ISO 27701 if: demonstrating structured privacy governance is commercially important to your organisation.
ISO 42001: AI Management
Best for: organisations developing, providing or using AI systems.
ISO/IEC 42001:2023 is the international management system standard for AI. It helps organisations establish controls around responsible AI use, including governance, risk, transparency and continual improvement.
Consider ISO 42001 if: AI is becoming part of your products, services or internal operations and customers are starting to ask how it is governed.
ISO 45001: Health and Safety
Best for: organisations where employee and workplace safety is a major operational consideration.
ISO 45001:2018 provides a framework for an Occupational Health and Safety Management System. ISO confirms that the 2018 edition remains current, although a new edition is under development.
Consider ISO 45001 if: you operate in construction, manufacturing or another environment where health and safety assurance is important.
Can ISO certification help you win more contracts?
It can strengthen your position. ISO certification does not guarantee that you will win a tender, but it can provide independent, recognised evidence that your organisation has structured management systems and controls in place.
That can be particularly useful when prospective customers ask for evidence around:
- quality management
- cyber security
- privacy
- sustainability
- business continuity
- AI governance
- health and safety
Rather than simply telling a customer that your processes are robust, certification can help you demonstrate how those processes are managed.
Do you need more than one ISO standard?
Possibly. A technology business, for example, may benefit from ISO 27001 for information security and ISO 42001 for AI governance.
A manufacturer might combine ISO 9001, ISO 14001 and ISO 45001 to address quality, environmental management and workplace safety.
The right combination depends on your industry, customer expectations, contractual requirements and business risks. You do not need to pursue every standard at once. The better approach is to identify the standards that support your immediate commercial and compliance priorities and build from there.
Which ISO standard should you start with?
Start with the business requirement, not the standard number.
Ask:
- What are customers or tenders asking us to demonstrate?
- Which risks do we most need to control?
- Which certification would give customers greater confidence?
- Are there several standards we could manage through an integrated approach?
At Impact IT Solutions, we help organisations understand which ISO standards are relevant, assess their current position and create a practical route towards certification.