ISO 9001 vs ISO 27001: which certificate goes on this RFQ

This page is a buying comparison. It is for operations, quality, IT, and compliance leads at mid-market manufacturers and professional-services firms who are about to send a registrar RFQ and cannot agree whether ISO 9001 or ISO/IEC 27001 belongs on it.

Those standards are not interchangeable logos. 9001 is a quality management system. 27001 is an information security management system. Customers ask for both. Salespeople will offer to quote both. The useful question is a procurement question: which certificate does this cycle have to produce, and can you staff the system behind it.

The multi-year sequence is the 9001 → 27001 → 42001 path. Whether the system is real enough to book Stage 1 is first ISO certification. After you pick the standard, you still write one outbound pack, choose a registrar, read the quote, and verify accreditation for the legal entity and the edition you will claim. This page does not invent prices, day-rate totals, or accreditation identifiers.

The decision here is narrower: 9001 on this RFQ, 27001 on this RFQ, or neither until the system exists — then one pack.

1. What each standard is for, in plain terms

Skip the clause lists. Buyers do not award a certificate because they memorized a table of contents.

ISO 9001 asks whether you can deliver a consistent product or service and correct the work when it fails. A certification body samples that quality system. The certificate is not a promise that every part is defect-free.

On a plant that system is receiving, production, inspection, nonconforming product, and the people who run them. In a professional-services firm it is how you take work, staff it, deliver it, and handle a complaint. The owner is whoever already runs those processes and can speak without a script.

ISO/IEC 27001 asks whether you can protect information in a defined scope and prove it. A certification body samples that information security system: what is in scope, how you treat risk, and whether the controls you claim actually run. Buyers meet this as a Statement of Applicability — which controls apply here, and why the others do not. A policy folder, a penetration test, or a SOC 2 report is not that system.

For a software-enabled manufacturer it often lives at headquarters, a development office, and a cloud estate the factory certificate never named. For an IT-led firm it is client data, access, suppliers, and incidents. The owner is whoever can walk those facts. A quality lead holding a copied control list is not that person.

You can hold both eventually. This page is about which one this RFQ is for.

2. When 9001 is the rational first certificate

Start with 9001 when the pressure in front of you is quality, and an ISMS mark will not lose a bid this quarter.

That is the usual manufacturer case. Customers, primes, and supplier portals still treat 9001 as table stakes in many categories. The plant already half-runs the processes an auditor will sample, so the first certificate teaches scope, owners, internal audit, and management review on work you can staff. It is also the rational first certificate for a professional-services firm whose clients buy delivery discipline and have not made 27001 a gate. Security questionnaires can wait for a later add when they are not blocking revenue.

Put 9001 on this RFQ when most of these are true:

• The customer, portal, or bid in front of you names 9001, or names "an ISO certificate" and means quality.
• You can name the legal entity, the sites that do the certified work, and a quality or operations owner who will be in the room.
• Documented processes roughly match Tuesday. Internal audit and management review can touch this system before you invite a body. That test is first-certificate readiness.
• 27001 pressure is a forecast — a questionnaire you expect, a customer roadmap, a board slide — rather than a date that kills a contract this cycle.
• You are not offering a quality certificate as a stand-in for an information-security promise already in the contract. If the exhibit says information security, 9001 will not clear it.

A later 27001 add is a normal plan. One line on the pack is enough. Leave 27001 off this RFQ while the Statement of Applicability is still a wish. Whether 14001 and 45001 belong beside 9001 on a plant RFQ is the IMS buying guide, a different argument. If the fork is quality versus environment, and ISO 45001 is not part of this cycle, the buying comparison is ISO 9001 vs ISO 14001.

3. When 27001 is the forced gate this cycle

Start with 27001 when a customer, insurer, or bid will not let you through without an information-security certificate this cycle, and you can show an ISMS. That is the usual professional-services and IT-led case, and a growing case for manufacturers selling into enterprises that score security before they score a quality manual. A portal that rejects the file without 27001 does not pause for a better teaching order.

Put 27001 on this RFQ when most of these are true:

• A named customer, questionnaire, insurer, or bid requires 27001, or an accredited ISMS certificate, on a date you can point at.
• You can describe the information in scope: what you hold, where it lives, which legal entity operates it.
• Someone other than a hopeful quality manager owns risk treatment, access, incidents, and suppliers, and can be interviewed.
• The Statement of Applicability matches the system you operate. Applicable controls have evidence. Exclusions have a reason you will defend at Stage 1.
• The gate is real. A competitor's homepage, or a salesperson calling 27001 the current certificate, is not a gate.

If the portal requires 27001 and the ISMS does not exist, build the system, then send the pack. An RFQ sent so the quote creates a deadline is how Stage 1 writes findings you already knew. Readiness still has the first-certificate shape: sane scope, documented information that matches reality, internal audit and management review on this system, named owners. The content is the ISMS, not the quality manual.

Leave 9001 off this cycle when it is not the gate and you cannot staff both. Many software and services firms need the ISMS sooner than a quality certificate. The path guide treats quality-then-security as the default because evidence habits transfer. A forced 27001 gate is the exception you write down on purpose.

If the customer asked for a SOC 2 report, a penetration test, or a questionnaire with no certificate, confirm they will accept an accredited 27001 certificate before you substitute it. The certificate-versus-report decision is ISO 27001 vs SOC 2.

4. What buyers get wrong

Three patterns show up in mid-market rooms. Each one produces unlike quotes, or a Stage 1 whose job is to discover fiction.

Shopping both at once with a hollow Statement of Applicability. "Quote 9001 and 27001, we're integrated" is a sentence, not a programme. Integration is real when shared processes — document control, internal audit, management review, corrective action — already run, and the ISMS work exists: information boundaries, risk treatment, a SoA someone uses. A SoA that copies a control catalogue, marks everything applicable, and cannot show an access review is hollow. Pairing it with the plant's quality system asks for days on two systems, one of which is a PDF. If you want both certificates eventually, name which one is this cycle. "Both" is a claim about systems you run.

Treating 27001 as a security badge with no ISMS. The certificate is the output of an independent audit, not a logo rented to clear a portal. The certification body samples. It does not write the risk assessment. Who implements versus who certifies is consultant vs certification body. Last year's penetration test and a downloaded policy are a project. Finish it, or hire implementation help that will not also be the certifier, then send the RFQ.

Skipping 9001 when customers still gate on it. A plant or a services firm drops quality because 27001 sounds more current, then fails the supplier approval that still names 9001. If the customer who pays you will not onboard a supplier without 9001, a 27001 certificate does not retire that form. Read the portal field, the contract exhibit, and the insurer letter before you treat quality as old news.

Two related misses belong in the same meeting. "Quote whichever is easier" means the bodies are not quoting the same object. Adding ISO/IEC 42001 because someone mentioned AI belongs on the path guide, and only when an AI management system exists. A strong 9001 registrar is not automatically competent for 27001, or the reverse. Confirm that when you choose a registrar and verify accreditation for the edition on the pack.

5. How the RFQ, the scope, the sites, and the people differ

A quote is a designed audit programme. It starts from your facts. 9001 facts and 27001 facts are not the same list with a different title.

Scope. For 9001, name the legal entity, the products or services, the processes, and the exclusions you will defend. For 27001, name the information, the activities that handle it, and what sits outside the boundary. "The whole company" is how a warehouse disappears from a quality certificate, or a sister company gets swept into an ISMS it should not share. More than one location is multi-site certification scope. Write that map before anyone counts days.

Sites. 9001 follows the work: plants, warehouses, labs, client-delivery offices, including the second shift. 27001 follows the information and the people who control it: headquarters, a development office, remote staff, a cloud estate the factory tour never enters. This cycle names one standard's sites. The other map stays off the pack, with one line that it is a later add.

People. 9001 interviews a quality or operations owner, process owners, and someone who does the work. 27001 interviews a security owner who can show the SoA, plus the people who grant access and run incidents and suppliers. "We'll bring IT in at Stage 2" means the pack is early. "The quality manager will cover security" means the SoA has no owner.

One page, the same pack to every body. The full checklist is how to build a registrar RFQ / scope pack. For this decision, these rows have to be explicit:

Fact	If 9001 is this cycle	If 27001 is this cycle
Standard and edition	The 9001 edition you will claim	The 27001 edition you will claim
What is in scope	Products, services, processes, exclusions you will defend	Information, activities, and the boundary
Sites	Where that work happens, with headcount bands and shifts	Where that information is handled, including remote work and cloud if that is true
Owner	Named quality or operations owner	Named ISMS or security owner who can show the SoA
The other standard	Later add, or not this cycle	Later add, or not this cycle
Who implemented	Internal, named consultant, or none	The same disclosure. The implementer is not the certifier

Headcount is a band per site, not the about-page total. Shifts and follow-the-sun delivery belong on the pack because they change who must be available. A thinner story for one logo ends the comparison. What comes back — programme structure, travel, exclusions — is what CB quotes include.

6. One CB programme this cycle, or a sequential add

Sometimes one certification body should quote 9001 and 27001 together. Often that request is the plant IMS habit applied to the wrong pair.

One programme this cycle is honest when both systems already run under one legal entity, shared processes are real, both owners can sit the audit, and each standard has its own site story. You may still receive two certificates. The product is one designed programme with the right competence for quality and for information security. Say which processes are shared and which work is standard-specific. Let the CB restate the method. Do not ask them to invent integration you do not operate.

A sequential add is the better buy when only one system is real. Certify the gate this cycle. Add the other standard when its owner, its sites, and its documented information exist. A later add is still an RFQ, and the new scheme still gets Stage 1. Tell the shortlist which standard comes later. If the CB you award now cannot cover it, the honest options are wait, add a second CB, or plan a transfer.

Keep this separate from the plant IMS. Stacking ISO 9001, ISO 14001, and ISO 45001 is an operations decision on producing sites. 27001 is a different competence, a used Statement of Applicability, and often a different map. A strong plant IMS registrar is not automatically the 27001 body. A security-specialist CB is not automatically the multi-shift factory body. One CB for the operations stack and another for the ISMS is a legitimate design when you write it on purpose.

ISO/IEC 42001 stays off this argument unless AI governance is itself the customer gate. That is rare in a room choosing between 9001 and 27001. When the gate is AI management and information security is still the other side, the buying comparison is ISO 27001 vs ISO 42001. When the argument is quality versus AI management, and information security is not this cycle, use ISO 9001 vs ISO 42001. The sequence, and why a 42001 project is often a missing ISMS, lives on the path guide. When the live fork is business continuity versus information security, use ISO 22301 vs ISO 27001. That pair is a different argument from quality versus the ISMS.

7. Choose what goes on this RFQ, then send one pack

Make the call in one sitting. The output is a sentence at the top of the scope pack.

1. Write the actual requirement. Portal, contract, insurer, bid — use their words. If two customers want two standards, note which revenue is blocked this cycle.
2. Match it to a system you can show. 9001 needs processes that match the work. 27001 needs an ISMS and a used Statement of Applicability. If that system does not exist, do not send. Build it, or hire an implementer who will not certify you, and disclose them on the pack.
3. Name one primary standard. Mark the other "later add" or "not this cycle," unless both systems and both owners are real enough to defend at Stage 1.
4. Name the owner and the sites for that standard. Quality owner and the locations where the work happens, or security owner and the locations where the information is handled.
5. Write one pack and send it to every body you might award. How to choose them is how to choose a registrar. Confirm the legal entity's accreditation for this edition in how to verify accreditation before you invite a body you cannot award.

If the room is still split after step 3, you have two procurements. Run the one that unblocks revenue and park the other until its system exists.

When that sentence is true, send one registrar RFQ / scope pack. Submit the same page with the Get quotes button below, including to the logo you already like. The standard on the page has to be the standard you can staff.