Which ISO Is Right for My Business?

“Which ISO is right for my business?” is one of the first questions I hear on a new enquiry, and it’s a fair one. There are a lot of certifiable management system standards, and most business owners only discover they need one when a tender form or a new customer asks for it.

I’m Craig Willetts, founder of CAW Consultancy and a lead auditor across ISO standards for over 20 years. This guide doesn’t explain every standard in detail. It gives you a way to decide: start from what’s driving the question, work through a short checklist, then look at the combinations businesses in your sector usually start with.

Start with the driver, not the standard

Most people pick a standard first, then try to work out whether it helps. It’s quicker to start with the reason you’re asking.

A tender or customer has asked for it

This is the most common driver I see, and the easiest to answer, because the buyer has already told you. Read the wording carefully:

• Which standard, exactly? “ISO accredited” on a form usually means a specific certificate. If it doesn’t say which, ask the buyer.
• Does it need to be UKAS-accredited certification? Many buyers specify this, and it affects your costs.
• What scope do they expect? Your certificate needs to cover the services you’re bidding for.
• When do they need it? Some buyers want it at bid stage; others will accept evidence that you’re working towards it.

Your sector expects it

Some sectors have settled expectations. Construction buyers commonly look for quality, environmental and health and safety certification alongside a pre-qualification scheme. Security buyers commonly look for ISO 9001 plus sector schemes. If your competitors all hold a certificate, not having one becomes the reason you’re screened out.

You want to control a real risk

Sometimes nobody has asked. You just know where the business is exposed. Match the standard to the risk:

• Repeat complaints, rework or missed customer requirements: ISO 9001 (quality)
• Accidents, near misses or high-risk work: ISO 45001 (occupational health and safety)
• Waste, pollution or client questions about your environmental impact: ISO 14001 (environmental)
• Client data, cyber attacks or remote working: ISO/IEC 27001 (information security)
• One outage or supplier failure stopping the whole business: ISO 22301 (business continuity)
• High or rising energy bills: ISO 50001 (energy)

Size, budget and time

A five-person firm and a multi-site business can both certify, because the standards scale. But your budget, and how quickly you need a certificate, will shape whether you start with one standard or several.

Which ISO is right for my business? Five questions to answer first

1. What has the buyer actually written? Copy the exact requirement from your recent tenders and supplier questionnaires. That’s your shortlist.
2. What would hurt the business most? A quality failure, a serious injury, a pollution incident, a data breach or a long outage. The answer points to a standard.
3. Do you also need a non-ISO scheme? Plenty of requirements aren’t ISO at all (more on that below). Don’t buy the wrong thing.
4. Who will run it? Someone needs time to own the system, run internal audits and keep records live. One person can manage several standards if they’re integrated.
5. When do you need the certificate in hand? Work back from the tender deadline. Certification means an external audit by a certification body, and that has to be booked.

The core standards in one line each

These are the current editions as of October 2026, checked against ISO’s own pages:

• ISO 9001:2026 – quality management systems. Published on 16 September 2026, replacing ISO 9001:2015. ISO describes it as the world’s most widely used quality management standard.
• ISO 14001:2026 – environmental management systems. Published on 15 April 2026, replacing ISO 14001:2015.
• ISO 45001:2018 – occupational health and safety management systems. A revised edition is in development, and ISO expects it to replace the 2018 edition in the first half of 2027.
• ISO/IEC 27001:2022 – information security management systems.
• ISO 22301:2019 – business continuity management systems. ISO has marked it for revision.
• ISO 50001:2018 – energy management systems, aimed at improving energy performance.
• ISO 13485:2016 – quality management systems for medical devices, written for regulatory purposes.
• ISO 18788:2015 – a management system for private security operations.
• ISO/IEC 42001:2023 – artificial intelligence management systems.

Not everything buyers ask for is ISO

Plenty of tender requirements aren’t ISO certification at all. These come up constantly:

• SSIP, CHAS, Constructionline and SafeContractor. CHAS, Constructionline and SafeContractor are supply chain pre-qualification and assessment schemes, largely focused on health and safety competence. SSIP (Safety Schemes in Procurement) exists to cut duplicated health and safety assessments: through its “deem to satisfy” arrangement, a current approval from one member scheme is generally recognised by the others.
• Cyber Essentials. The government-recommended minimum standard of cyber security, with a Plus level that adds independent technical testing. For certain central government contracts, such as those handling citizens’ personal information, government procurement policy (PPN 014) points buyers to Cyber Essentials or Cyber Essentials Plus. Certificates are issued by certification bodies licensed by IASME, the NCSC’s delivery partner.
• SIA Approved Contractor Scheme (ACS). A voluntary quality assurance scheme for private security businesses, run by the Security Industry Authority.
• BS 7858:2019. The British Standard code of practice for screening individuals working in a secure environment. Security buyers often want to see screening built to it.
• CQC registration. If you provide regulated care in England, such as a domiciliary care agency, you need to register with the Care Quality Commission. An ISO certificate doesn’t replace that.

Typical combinations by sector

These are common starting points I see across our client base, not rules. Your tenders and your risks always come first.

Security

ISO 9001 and ISO 45001 are the usual foundation. ISO 18788 adds a management system written specifically for private security operations. Many security firms also hold the SIA ACS and screen staff to BS 7858, and ISO/IEC 27001 is worth considering if you run monitoring or control rooms that handle sensitive data.

Construction

The tri-standard set (ISO 9001, ISO 14001 and ISO 45001) alongside health and safety pre-qualification such as CHAS or Constructionline.

Cleaning and facilities management

ISO 9001 and ISO 45001 first, with ISO 14001 often following because of chemicals, waste and client sustainability questions. SafeContractor or CHAS are common on the pre-qualification side, and BS 7858 screening may come up if your staff work on secure sites.

IT and data-heavy businesses

Cyber Essentials is often the first step, then ISO/IEC 27001. ISO 22301 suits businesses whose clients depend on their uptime, and ISO/IEC 42001 is worth a look if you build or use AI in the services you sell.

Manufacturing

ISO 9001 is the baseline, with ISO 14001 and ISO 45001 commonly added. Energy-intensive sites should look at ISO 50001.

Healthcare-adjacent businesses

If you design or make medical devices, or supply into that chain, ISO 13485 is the quality standard built for it. Support service providers usually start with ISO 9001, and ISO/IEC 27001 matters if you handle patient data. CQC registration remains a separate requirement for regulated care.

One standard or several?

Start with one if a single buyer requirement is driving you, your team is small, or the deadline is tight. In my experience, ISO 9001 is the most common first certificate, because so many buyers ask for it.

Combine standards if your tenders already ask for more than one, if you’d face separate audits anyway, or if health and safety and environmental risks matter as much as quality.

Combining is easier than it sounds. ISO management system standards share a common “harmonized structure”, with the same main clauses for context, leadership, planning, support, operation, performance evaluation and improvement. One integrated system can run a single document control process, one internal audit programme and one management review for all of them.

A note on timing. ISO 9001 and ISO 14001 both have new 2026 editions. Under transition rules from Global Accreditation Cooperation Incorporated (Global ACI), which took over the International Accreditation Forum’s work in January 2026, organisations certified to the 2015 editions have until 30 April 2029 (ISO 14001) and 30 September 2029 (ISO 9001) to transition. If you’re starting from scratch, build to the 2026 editions.

What it costs

At CAW, our consultancy packages start from £999 for a single standard, £1,399 for two standards and £1,799 for three, all ex VAT. Other accreditations start from £300, and CHAS, SafeContractor or Constructionline support is £399.

Those fees are for consultancy only. The certification audit is paid separately to the certification body: from £595 with a non-UKAS-accredited certification body, and from £1,500 with a UKAS-accredited one.

What to do next

1. Gather your recent tenders and supplier questionnaires and list every certification and scheme they ask for.
2. Get a gap analysis to see how far your current practices already go.
3. Decide on one standard or an integrated set, based on the checklist above.
4. Build and implement the system, then run an internal audit and a management review.
5. Book your certification audit with a certification body that meets your buyers’ requirements.

At CAW we build systems within 48 hours and typically deliver within 72 hours, and we’ve kept a 100% audit pass rate over more than 20 years, including UKAS-accredited audits.

Frequently asked questions

What is the most common ISO standard for small businesses?

ISO 9001. ISO describes it as the world’s most widely used quality management standard, and in my experience it’s the certificate buyers ask for most often. It works for businesses of any size because it focuses on how you meet customer requirements and fix problems, not on how big you are. Many small firms start with ISO 9001 and add other standards later.

Do I need UKAS-accredited ISO certification?

Only if your buyers require it, but many do. UKAS is the UK’s national accreditation body, and it assesses the certification bodies that issue accredited certificates, which is why buyers trust them. Check the tender wording before you book. A non-accredited certificate costs less, but it’s wasted money if your main customers won’t accept it.

Is Cyber Essentials the same as ISO 27001?

No. Cyber Essentials is a UK government-backed scheme covering a set of basic technical security controls, with a Plus level that adds independent technical testing. ISO/IEC 27001 is an international standard for a complete information security management system, built on a risk management process and covering people, policies and processes as well as technology. Many businesses do Cyber Essentials first.

Should I build my system to ISO 9001:2015 or ISO 9001:2026?

If you’re starting now, build to ISO 9001:2026, published on 16 September 2026. Organisations already certified to the 2015 edition have until 30 September 2029 to transition, and from 31 March 2028 new accredited certifications can only be issued to the 2026 edition. Ask your certification body which edition it can currently certify you to.

Can I get ISO 9001, 14001 and 45001 at the same time?

Yes. Because they share the same harmonized structure, the three standards can run as one integrated management system and be audited together. It’s the most common combination in construction and manufacturing. You run one set of shared processes, with the specific controls for quality, environment and health and safety built on top.

Talk to CAW Consultancy

Still asking yourself which ISO is right for your business? Send me your recent tender requirements and I’ll tell you plainly what you need, and what you don’t. CAW Consultancy has been preparing organisations for certification since 2011, across more than 20 ISO standards and the main UK accreditation schemes.

Call us on 01257 824481 or visit www.cawconsultancy.co.uk.