ISO 9001

What is ISO 9001?

ISO 9001 sets the requirements for a quality management system (QMS): the way an organisation plans, runs, checks and improves its work so that it reliably delivers products and services that meet customers’ needs and the rules that apply to them. It is the world’s most widely used management system standard. ISO reports more than one million certificates in 189 countries.

It isn’t a cybersecurity standard. It appears in the Compliance Academy because many organisations run it alongside ISO/IEC 27001, and because the two share the same structure.

What is new in 2026?

The sixth edition, ISO 9001:2026, was published on 16 September 2026, replacing the 2015 edition after a global consultation in 2023 found it needed updating. ISO describes the new edition as a set of targeted updates rather than a rewrite:

• clearer requirements, so organisations of every size and maturity can understand them more easily;
• more emphasis on quality culture and on leadership;
• risks and opportunities treated separately, so organisations act on beneficial opportunities as well as reducing risks;
• closer alignment with other ISO management system standards, which makes integrated management systems easier.

The 2024 climate amendment to the 2015 edition, which asked organisations to consider whether climate change is relevant to their QMS, has also been withdrawn along with that edition.

What does it require?

ISO 9001 follows the harmonised structure shared by ISO management system standards. In outline, an organisation must:

• understand its context, its interested parties and the scope of its QMS;
• show leadership commitment and set a quality policy and objectives;
• plan, including addressing risks and opportunities;
• provide the support needed: people, competence, infrastructure, awareness, communication and documented information;
• operate its processes for designing and delivering products and services, including control of external providers;
• evaluate performance through monitoring, internal audit and management review;
• improve, by dealing with nonconformities and continually improving the system.

What about certification?

Organisations can be certified by an accredited certification body, usually on a three-year cycle with yearly surveillance audits. Organisations certified to the 2015 edition must transition to the 2026 edition within the period set by the International Accreditation Forum and their accreditation body. ISO advises them to ask their certification body about timing.

How does it relate to ISO/IEC 27001?

Because both use the harmonised structure, the management-system parts (context, leadership, planning, support, internal audit, management review and improvement) can be run once for both. The differences are in operations: ISO 9001 is about delivering consistent quality, and ISO/IEC 27001 is about managing information security risk with its Annex A controls. Many organisations also add ISO/IEC 20000-1 for IT service management or ISO 22301 for business continuity into the same integrated system.