Guides
How to buy certification without folklore
Original briefings for mid-market operations, quality, IT, and compliance leads. No copied CB marketing. No invented price lists. No fabricated accreditation databases. Use these pages to design the programme, then compare real bodies in the directory and send one scope pack through Get quotes.
Read them in order if you are new to the buy: first-certificate readiness, then how long ISO certification takes, choose a registrar. If the certificate this cycle is ISO/IEC 27001, use how to choose an ISO/IEC 27001 certification body in the US before you treat a familiar logo as a scope. If the certificate this cycle is ISO/IEC 42001, use how to choose an ISO/IEC 42001 certification body in the US before you copy a 27001 shortlist. Then tell a consultant from a certification body, write the RFQ / scope pack, shortlist and score 3–5, verify accreditation, read the quote. If two replies for the same ISO cannot sit on one page, start at what drives certification cost before you score a bottom line. If you have more than one plant, office, or warehouse, scope the multi-site audit before anyone counts days. If the operations stack is the question — 9001 + 14001 + 45001 on one programme — start at integrated ISO management systems. If the argument is how much of Stage 1, Stage 2, or surveillance can be remote, start at remote vs on-site ISO audits. If a report just named a nonconformity — Stage 1, Stage 2, surveillance, or recertification — read closing ISO nonconformities before you promise a new certificate date. If you already hold a certificate, the next chapter is surveillance and recertification; if the fit is wrong, start at transferring a certificate. If you are torn between ISO 9001 and ISO/IEC 27001 for this cycle, use the 9001 vs 27001 comparison. If you are torn between ISO 9001 and ISO 14001 for this cycle, use the 9001 vs 14001 comparison. If you are torn between ISO 9001 and ISO 45001 for this cycle, use the 9001 vs 45001 comparison. If you are torn between ISO 14001 and ISO 45001 for this cycle, use the 14001 vs 45001 comparison. If you are torn between ISO 14001 and ISO 50001 for this cycle, use the 14001 vs 50001 comparison. If you are torn between ISO/IEC 27001 and ISO/IEC 42001 for this cycle, use the 27001 vs 42001 comparison. If you are torn between an ISO/IEC 27001 certificate and a SOC 2 report for this cycle, use the 27001 vs SOC 2 comparison. If you are torn between NIST CSF 2.0 and an ISO/IEC 27001 certificate for this cycle, use the 27001 vs NIST CSF comparison. If you are torn between an ISO/IEC 27001 certificate and ISO/IEC 27701 privacy certification for this cycle, use the 27001 vs 27701 comparison. If you are torn between ISO 22301 and ISO/IEC 27001 for this cycle, use the 22301 vs 27001 comparison. If you are torn between ISO 9001 and ISO/IEC 42001 for this cycle, use the 9001 vs 42001 comparison. If you are torn between an ISO/IEC 42001 certificate and a NIST AI Risk Management Framework profile for this cycle, use the 42001 vs NIST AI RMF comparison. If you are torn between ISO 9001 and ISO 13485 for this cycle, use the 9001 vs 13485 comparison. If you are torn between ISO 9001 and AS9100 for this cycle, use the 9001 vs AS9100 comparison. If you are torn between ISO 9001 and IATF 16949 for this cycle, use the 9001 vs IATF 16949 comparison. If you are torn between ISO 9001 and ISO 22000 for this cycle, use the 9001 vs 22000 comparison. If you are torn between FSSC 22000, SQF, and BRCGS for this cycle, use the FSSC 22000 vs SQF vs BRCGS comparison. If the question is sequence rather than a vendor, use the 9001 → 27001 → 42001 path and the standards desk.
Buying
Start here if this is the first certificate: decide whether you are actually ready to send an RFQ and book Stage 1. If the system is real enough to quote, set the calendar — Stage 1, Stage 2, certificate issue, first surveillance — before anyone writes a deadline on the pack. If the argument is which certificate this cycle — ISO 9001 or ISO/IEC 27001 — that comparison is a buying decision, separate from the quality-to-AI sequence. If the argument is ISO 9001 or ISO 14001 this cycle, that comparison is the operations buying decision, separate from the three-standard plant stack. If the argument is ISO 9001 or ISO 45001 this cycle, that comparison is the quality-versus-safety buying decision, separate from stacking all three with 14001. If the argument is ISO 14001 or ISO 45001 this cycle, that comparison is the EHS buying decision, separate from stacking all three with 9001. If the argument is ISO 14001 or ISO 50001 this cycle, that comparison is the environment-versus-energy buying decision for a plant that may already hold 9001 or 14001, separate from stacking 9001, 14001, and 45001. If the argument is ISO/IEC 27001 or ISO/IEC 42001 this cycle, that comparison is the next buying decision once an ISMS is in the room. If the argument is an ISO/IEC 27001 certificate or a SOC 2 report this cycle, that comparison is the information-security buying decision for professional services and SaaS, separate from choosing ISO/IEC 42001. If the argument is NIST CSF 2.0 alignment or an ISO/IEC 27001 certificate this cycle, that comparison is the framework-versus-certificate buying decision, separate from a SOC 2 report and from ISO/IEC 42001. If the argument is whether to add ISO/IEC 27701 privacy certification to an ISO/IEC 27001 certificate this cycle, that comparison is the privacy buying decision for professional services and SaaS firms that process personal data for customers, separate from a SOC 2 report, a NIST CSF profile, and ISO/IEC 42001. If the argument is ISO 22301 or ISO/IEC 27001 this cycle, that comparison is the business-continuity versus information-security buying decision for mid-market manufacturing and professional services firms, separate from a SOC 2 report, a NIST CSF profile, and the plant stack. If the argument is ISO 9001 or ISO/IEC 42001 this cycle, that comparison is the quality-versus-AI buying decision, separate from the security step in the middle and from stacking both in one afternoon. If the argument is an ISO/IEC 42001 certificate or a NIST AI Risk Management Framework profile this cycle, that comparison is the AI certificate-versus-framework buying decision, separate from choosing 27001 or 9001 and separate from a NIST CSF profile. If the certificate is ISO/IEC 27001 and the question is which certification body in this directory records that standard on a cited ANAB, IAS, or UKAS scope, that is the US buying guide for an ISMS registrar. If the certificate is ISO/IEC 42001 and the question is which certification body in this directory states that standard on a published accreditation scope, that is the US buying guide for an AIMS registrar. If the argument is ISO 9001 or ISO 13485 this cycle, that comparison is the general-quality versus medical-device buying decision, separate from market clearance and from the plant stack. If the argument is ISO 9001 or AS9100 this cycle, that comparison is the general-quality versus aviation, space, and defense buying decision, separate from a maintenance or distributor scheme and from the plant stack. If the argument is ISO 9001 or IATF 16949 this cycle, that comparison is the general-quality versus automotive buying decision, separate from an aviation, space, and defense scheme and from the plant stack. If the argument is ISO 9001 or ISO 22000 this cycle, that comparison is the general-quality versus food-safety buying decision for food, beverage, ingredient, and food-contact packaging manufacturers, separate from a GFSI-benchmarked scheme and from the plant stack. If the argument is FSSC 22000, SQF, or BRCGS this cycle, that comparison is the GFSI-scheme buying decision for those same plants, and it starts from the scheme the customer accepts. Then choose the method, tell a consultant from an accredited certification body, write one outbound pack so every body quotes the same programme, and score three to five replies. Check the legal entity, then read the proposal. If two quotes for the same ISO cannot sit on one page, the gap is usually a cost driver you did not freeze: audit days, sites, headcount bands, stacked standards, travel, remote versus on-site, integration, and the three-year cycle. That chapter is comparability. It is not a price list. If you have more than one site, write that map before anyone counts days. If the question is stacking 9001, 14001, and 45001 on one CB programme, that is a buying decision — not the quality-to-AI sequence page. Transfer is the later chapter when the current certificate no longer fits — not a shortcut around competence.
2026-09-21 · 15 min · Buying · Readiness · RFQ
First ISO certification for mid-market teams: what “ready” means
What “ready for Stage 1” actually means before a mid-market manufacturer or professional-services firm sends its first registrar RFQ — docs, people, sites, and what not to fake.
2026-09-29 · 16 min · Buying · Timeline
How long ISO certification takes for mid-market teams
A buying timeline from a real system through the RFQ, Stage 1, Stage 2, certificate issue, and first surveillance — drivers and ranges, not one calendar for every programme.
2026-09-22 · 13 min · Buying · Standards · Comparison
ISO 9001 vs ISO 27001: which certificate goes on this RFQ
A mid-market buying comparison for teams torn between ISO 9001 and ISO/IEC 27001 — when quality is the rational first certificate, when security is the forced gate this cycle, and how to put one standard on the scope pack.
2026-09-24 · 15 min · Buying · Standards · Comparison
ISO 9001 vs ISO 14001: which certificate goes on this RFQ
A mid-market buying comparison for teams torn between ISO 9001 and ISO 14001. When quality is the rational first certificate, when an environmental certificate is the forced gate this cycle, and how to put one standard on the scope pack.
2026-09-28 · 20 min · Buying · Standards · Comparison
ISO 9001 vs ISO 45001: which certificate goes on this RFQ
A mid-market buying comparison for teams torn between ISO 9001 and ISO 45001. When quality is the forced gate this cycle, when occupational health and safety is, and how to put one standard on the scope pack.
2026-09-25 · 18 min · Buying · Standards · Comparison
ISO 14001 vs ISO 45001: which certificate goes on this RFQ
A mid-market buying comparison for teams torn between ISO 14001 and ISO 45001. When an environmental certificate is the forced gate this cycle, when occupational health and safety is, and how to put one standard on the scope pack.
2026-10-19 · 16 min · Buying · Standards · Comparison
ISO 14001 vs ISO 50001: environmental vs energy management for mid-market manufacturers
A mid-market buying comparison for plant, operations, and EHS leads. When an environmental certificate is the gate this cycle, when an energy management certificate is, and why a 14001 accreditation line does not cover ISO 50001.
2026-09-23 · 15 min · Buying · Standards · Comparison
ISO 27001 vs ISO 42001: which certificate goes on this RFQ
A mid-market buying comparison for teams torn between ISO/IEC 27001 and ISO/IEC 42001. When information security belongs on this RFQ, when an AI management certificate is the forced gate, and how that choice changes scope, owners, sites, and the registrar pack.
2026-10-09 · 16 min · Buying · Standards · Comparison
ISO 27001 vs SOC 2: what mid-market service and SaaS firms should buy first
A mid-market buying comparison for professional services and SaaS firms deciding whether this cycle needs an ISO/IEC 27001 certificate, a SOC 2 report, or both. Who asks for which, how the RFQ differs, and how ISO/IEC 42001 fits later.
2026-10-13 · 16 min · Buying · Standards · Comparison
ISO 27001 vs NIST CSF: when a mid-market firm needs a certificate, not just a framework
A mid-market buying comparison for operations, IT, and compliance leads whose customers or insurers mention NIST CSF 2.0 while others ask for an ISO/IEC 27001 certificate. When a profile is enough, when a certificate wins the deal, and how to scope the RFQ.
2026-10-15 · 16 min · Buying · Standards · Comparison
ISO 27001 vs ISO 27701: when mid-market firms should add privacy certification
A mid-market buying comparison for professional services and SaaS firms that process personal data for customers. When ISO/IEC 27701 belongs on the RFQ, how the 2019 extension differs from the 2025 edition, and why accreditation scope still has to be checked live.
2026-10-30 · 16 min · Buying · Standards · Comparison
ISO 22301 vs ISO 27001: which certificate mid-market firms should buy first
A mid-market buying comparison for manufacturing and professional services firms deciding whether ISO 22301 business continuity, ISO/IEC 27001 information security, or both belong on this cycle. What each standard covers, where they overlap, and how to confirm a registrar can issue the one you will claim.
2026-09-30 · 22 min · Buying · Standards · Comparison
ISO 9001 vs ISO 42001: which certificate goes on this RFQ
A mid-market buying comparison for manufacturers and professional-services firms torn between ISO 9001 and ISO/IEC 42001. When quality is enough this cycle, when an AI management certificate is the real ask, and why both is usually a sequence.
2026-10-26 · 20 min · Buying · Standards · Comparison
ISO 42001 vs NIST AI RMF: when a mid-market firm needs a certificate, not just a framework
A mid-market buying comparison for manufacturers and professional-services firms whose customers mention the NIST AI Risk Management Framework while others ask for an ISO/IEC 42001 certificate. When a profile is enough, when a certification body is the buy, and how to scope the RFQ.
2026-10-05 · 22 min · Buying · Standards · Comparison
ISO 9001 vs ISO 13485: which certificate goes on this RFQ
A mid-market buying comparison for manufacturers and suppliers torn between ISO 9001 and ISO 13485. When general quality is the gate this cycle, when a medical-device quality system is, and how to put one standard on the scope pack.
2026-10-06 · 28 min · Buying · Standards · Comparison
ISO 9001 vs AS9100: which certificate goes on this RFQ
A mid-market buying comparison for manufacturers and machine shops torn between ISO 9001 and AS9100. When general quality is the gate this cycle, when an aviation, space, and defense quality system is, and how to put one standard on the scope pack.
2026-10-07 · 16 min · Buying · Standards · Comparison
ISO 9001 vs IATF 16949: what mid-market automotive suppliers need to know
A mid-market buying comparison for automotive suppliers deciding whether this RFQ is ISO 9001, IATF 16949, or both. When general quality is enough, when a customer will not source you without the automotive certificate, and how to write one scope pack.
2026-10-22 · 18 min · Buying · Standards · Comparison
ISO 9001 vs ISO 22000: quality vs food safety for mid-market food manufacturers
A mid-market buying comparison for food, beverage, ingredient, and food-contact packaging plants. When a quality certificate is the gate this cycle, when a food safety management certificate is, how FSSC 22000 sits on ISO 22000 and GFSI, and how to scope one RFQ.
2026-10-23 · 16 min · Buying · Standards · Comparison
FSSC 22000 vs SQF vs BRCGS: which GFSI scheme goes on this RFQ
A mid-market buying comparison for food, beverage, ingredient, and food-contact packaging manufacturers choosing among FSSC 22000, SQF, and BRCGS. Who owns each scheme, how each is built, what GFSI lists, how grading is published, and how to scope one RFQ.
2026-08-12 · 14 min · Buying · Accreditation · RFQ
How to choose an accredited ISO registrar
A practical shortlist method for mid-market quality, IT, and compliance leads — accreditation first, brand second, and no invented prices.
2026-11-02 · 16 min · Buying · Accreditation · ISO/IEC 27001
How to choose an ISO/IEC 27001 certification body in the US
How mid-market manufacturers and professional-services firms choose a US certification body for ISO/IEC 27001. Why the IAF MLA mark and the 2022 edition matter, and which directory profiles record that standard on a cited ANAB, IAS, or UKAS scope.
2026-10-28 · 17 min · Buying · Accreditation · ISO/IEC 42001
How to choose an ISO/IEC 42001 certification body in the US
How mid-market manufacturers and professional-services firms choose a US certification body for ISO/IEC 42001. Why ISO/IEC 42006 and the accreditation mark matter, how to read a 42001 scope, and which directory profiles state that standard on a published schedule.
2026-09-15 · 16 min · Buying · Independence · RFQ
ISO consultant vs certification body: who does what
A buying guide for mid-market ops, quality, IT, and compliance leads who mix up implementers with accredited registrars — two jobs, two documents, independence red flags, and one RFQ to real CBs.
2026-09-10 · 15 min · Buying · RFQ · Quotes
How to build a registrar RFQ / scope pack
Write one outbound scope pack so every certification body quotes the same programme — checklist, what to leave out, and a paste-ready outline for mid-market ops, quality, IT, and compliance leads.
2026-09-07 · 15 min · Buying · Compare · RFQ
How to shortlist and score 3–5 ISO registrars
A copyable scorecard for mid-market ops, quality, IT, and compliance leads — why three to five certification bodies, how to build the set from constraints, and how to award the work without logo bias.
2026-09-05 · 15 min · Buying · Accreditation · Verification
How to verify an ISO registrar’s accreditation
A practical walkthrough for confirming a certification body’s legal entity, accreditation body, and live scope — before you treat a brochure as a certificate.
2026-08-28 · 13 min · Buying · Quotes · Audit days
What a certification body quote should include
How to read a registrar proposal — audit days, stages, travel, integration, and the line items that are easy to miss — without fabricated prices.
2026-10-02 · 22 min · Buying · Cost · Quotes
What drives ISO certification cost for mid-market teams
Why two quotes for the same ISO diverge — audit days, sites, headcount bands, stacked standards, travel, remote versus on-site, integration, and the three-year cycle — and how to force a like-for-like RFQ without a price list.
2026-09-07 · 15 min · Buying · RFQ · Multi-site
Multi-site ISO certification: how to scope the audit
How mid-market manufacturers and professional-services firms decide when one certificate covers several plants, offices, and warehouses — and what belongs in the RFQ so day counts stay honest.
2026-09-14 · 16 min · Buying · IMS · RFQ
Integrated ISO management systems: when mid-market plants should stack 9001 + 14001 + 45001
A buying and RFQ guide for mid-market ops, quality, and EHS leads — when to put ISO 9001, 14001, and 45001 on one certification-body programme, when not to, and how one scope pack keeps day counts comparable.
2026-09-06 · 15 min · Buying · Transfer · Accreditation
How to transfer an ISO certificate to a new registrar
A mid-market walkthrough of moving an accredited ISO certificate between certification bodies — when transfer is the right job, what documents the new CB will ask for, and how to keep the cycle intact.
Audits
Initial certification is two designed visits, not a dress rehearsal plus a surprise. Remote, hybrid, and on-site are methods for those visits — write the split on the RFQ so day counts and travel stay comparable. A nonconformity is a failed requirement with a grade: majors usually hold the certificate or the next visit, minors usually travel on a plan you can show, and the labels are the body's, not a blog's. After the certificate, surveillance samples whether the system still lives; recertification is a fuller look before expiry. The registrar does not write your procedures or your corrective action.
2026-09-01 · 11 min · Audits · ISO 9001 · Process
Stage 1 vs Stage 2 — what actually happens
A plain-language walkthrough of initial certification audits so operations and compliance leads know what to staff, what “ready” means, and what is out of the CB’s job.
2026-09-18 · 16 min · Buying · Audits · Remote · Stage 1
Remote vs on-site ISO audits: what mid-market buyers should ask for
A buying guide for mid-market ops, quality, IT, and compliance leads deciding how much of Stage 1, Stage 2, and surveillance can be remote, hybrid, or must be on-site — so RFQ constraints keep CB day counts and travel comparable.
2026-10-01 · 20 min · Audits · Process · Buying
Closing ISO nonconformities: majors, minors, and the calendar
A mid-market ops guide for manufacturers and professional-services firms with Stage 1 findings, Stage 2 findings, or a surveillance nonconformity. What usually blocks a certificate, what a certification body can reasonably require, and how to keep the calendar honest.
2026-09-07 · 15 min · Audits · Process · ISO 9001
Surveillance audits and the three-year certification cycle
What happens after the certificate — how surveillance samples the live system, how scope creep and nonconformities actually work, and when recertification is a different job from a transfer.
Path
Quality, then security, then AI governance. Manufacturers usually cannot skip 9001. Professional-services firms often meet 27001 first. 42001 is a later layer, not a modern-looking substitute for an ISMS.