Which ISO Standard Do You Actually Need? A Plain-English Guide

Most businesses arrive at this question the same way: a tender document, a client questionnaire or a framework application lands on the desk asking for “ISO certification”, with no indication of which one. This guide sets out what each of the main ISO standards actually covers, which ones can be certified and which are guidance only, and which your sector is most likely to be asked for.

The short answer

If someone has asked you for “ISO” without specifying, they almost always mean ISO 9001 (quality management). It is the most widely held management system standard in the world and the most common tender requirement in the UK.

After that, the three that come up most often in UK tendering are ISO 14001 (environmental), ISO 45001 (health and safety) and ISO 27001 (information security). Which of those you need depends on what you sell and who you sell it to.

Certifiable standards vs guidance standards

This trips people up more than anything else, and it is worth getting straight before you spend money.

Certifiable standards contain auditable requirements. A certification body audits you against them and issues a certificate you can put in a tender. ISO 9001, 14001, 45001, 27001 and 22301 all work this way.

Guidance standards contain recommendations rather than requirements. You cannot be certified to them. ISO 31000 (risk management), ISO 45003 (psychological health and safety), ISO 10015 (training) and ISO 19011 (auditing management systems) are all guidance. They are genuinely useful — they just will not produce a certificate, and anyone offering to certify you against one is worth a second look.

Which ISO standard does what?

Standard	What it covers	Typically needed by	Certifiable?
ISO 9001	Quality management	Almost any business bidding for work	Yes
ISO 14001	Environmental management	Construction, manufacturing, public sector supply chains	Yes
ISO 45001	Occupational health and safety	Construction, security, cleaning, manufacturing	Yes
ISO 27001	Information security management	Anyone handling client or personal data at scale	Yes
ISO 27701	Privacy information management	Organisations proving UK GDPR control (extends ISO 27001)	Yes, as an extension
ISO 22301	Business continuity	Critical service providers, finance, utilities, security	Yes
ISO 42001	AI management systems	Organisations building or deploying AI	Yes
ISO 37301	Compliance management	Regulated sectors, organisations with broad legal exposure	Yes
ISO 50001	Energy management	Energy-intensive operations, ESOS-affected businesses	Yes
ISO 22000	Food safety management	Food producers, processors, caterers, distributors	Yes
ISO 20000	IT service management	Managed service providers, internal IT functions	Yes
ISO 13485	Medical device quality management	Device manufacturers, distributors, servicers	Yes
ISO 18788	Security operations management	Guarding, mobile patrol, key holding, event security	Yes
ISO 21001	Educational organisation management	Training providers, colleges, education businesses	Yes
ISO 17021	Requirements for certification bodies	Certification bodies themselves, not their clients	Accreditation, not certification
ISO 31000	Risk management	Any organisation wanting a structured risk approach	No — guidance
ISO 45003	Psychological health and safety	Employers managing stress, workload and burnout risk	No — guidance
ISO 10015	Competence and training management	Organisations whose training never changes behaviour	No — guidance

Which standards does your sector get asked for?

Security. ISO 9001 and ISO 45001 as the baseline, ISO 18788 where clients want proof that security operations specifically are controlled, and ISO 27001 if you handle client data or run a control room. Alongside these, most security tenders also want SIA ACS and BS 7858 screening records.

Construction. The classic tri-standard set: ISO 9001, ISO 14001 and ISO 45001. Usually requested alongside CHAS, Constructionline or SafeContractor, which cover different ground and are not substitutes for each other.

Cleaning and facilities. ISO 9001 and ISO 45001 as standard, with ISO 14001 increasingly requested on public sector and large corporate contracts.

IT and software. ISO 27001 first, ISO 20000 if you deliver managed services, ISO 22301 where clients depend on your uptime, and ISO 42001 if AI forms part of what you sell.

Healthcare and care. ISO 9001 as a framework, ISO 27001 for patient data, and CQC registration as the regulatory requirement that sits above all of it. See navigating CQC compliance.

Can you combine them?

Yes, and you should. Modern ISO management system standards share a common structure — the same clause numbering for context, leadership, planning, support, operation, performance evaluation and improvement. That means one document set, one internal audit programme, one management review and one risk register can serve several standards at once.

This is what an integrated management system means in practice, and it is the difference between certification being a manageable overhead and a full-time job. Businesses that run three separate systems for three standards are usually doing roughly three times the work for no additional benefit.

Two things make the difference: a risk assessment process that people actually use, and a management review that makes decisions rather than records attendance.

What is changing

Several of the major standards are moving. If you already hold certification, the transition matters more than the original certification did, because you have a fixed window to migrate before your certificate stops being valid.

• ISO 9001 transition — what changes for certified organisations
• ISO 14001 transition — preparing your EMS
• ISO 45001 revision — mental health, climate risk and supply chain

Common questions

How many ISO standards are there?

ISO has published tens of thousands of standards, but only a small number are management system standards that organisations get certified against. The table above covers the ones UK businesses are realistically asked for.

Is ISO certification a legal requirement?

No. No ISO standard is a legal requirement in the UK. It becomes effectively mandatory when a buyer makes it a condition of bidding, which is a commercial requirement rather than a legal one — but the practical effect on your pipeline is the same.

Do I need an accredited certificate?

Usually yes. Many tenders specify certification from a body accredited by UKAS or an equivalent national accreditation body. Unaccredited certificates are cheaper and are routinely rejected. Check the tender wording before you buy.

Can a small business get certified?

Yes. The standards scale to the size and complexity of the organisation — a sole trader’s quality management system is not expected to look like a multinational’s. Audit duration and cost scale down with headcount and scope accordingly.

What usually goes wrong?

Rarely the standard itself. It is almost always the same handful of basics — see the top 10 nonconformities we see in SMEs.

Still not sure which one you need?

Send me the tender document or the client questionnaire and I will tell you which standards it actually requires — and, just as usefully, which ones it does not. Email Craig@cawconsultancy.co.uk or use the enquiry page.

Need help with this?

CAW Consultancy has helped UK businesses achieve ISO certification and industry accreditation for over 20 years, with a 100% pass rate. See what we do, or send us an enquiry — we’ll tell you what you need, what you don’t, and what it will cost.

Still deciding? Read our newer guide on which ISO standard is right for your business, and see how much ISO certification costs in the UK before you budget.