If you have been following Compleye for quite some time now – good on you – ISO 27001 is a term that you won’t be unfamiliar with. Question is whether you know that ISO 27001 has some brothers and sisters in the ISO-family. Well, some… Let’s actually make that a little more than some. We’ll fill you in. What are these ISO standards?
Let’s start by refreshing your memory. The International Organization for Standardization (ISO) is an independent and non-governmental organisation that develops the standards to ensure the efficiency, safety and quality of products, services and systems. So ISO standards. The standards include requirements, specifications, guidelines of characteristics that can be applied consistently within all types of industries. Do you remember?
The number of ISO standards
Great. Now fasten your seatbelt. The ISO currently holds over 24.000 – yes, twenty-four thousand – standards and related documents. Sometimes it can be hard to understand which ones are the most suitable for your business. While most ISO standards are product-specific or process-related, a lot of standards are generic and can be implemented into any organisation. These are also considered the most common, or most popular, ISO certifications.
The most popular ones
As mentioned above, there are some more and some less popular members within the ISO family. Take a look at 10 of the most used and useful ones:
- ISO 9001 (Quality Management)
- ISO 14001 (Environment)
- ISO 27001 (Information Security)
- ISO 22000 (Food Safety)
- ISO 50001 (Energy Management)
- ISO 31001 (Risk Management)
- ISO 26000 (Social Responsibility)
- ISO 20121 (Sustainability)
- ISO 17025 (Testing/FDA)
- ISO 13485 (Medical Devices)
The ones you never thought about
Let’s have a bit more fun, shall we? There are, namely, so many ISO norms that you would never consider to be an ISO norm. From an ISO standard for Alpine Ski Boots (ISO 5355) – no joke – to one about Wine Glasses (ISO 3591) and Shoe Sizes (ISO ISO 9407). And our personal favorite: ISO 3103. It is about how to get a cup of perfect tea. The eight-page standard defines the size, material and shape of the teapot, the proportion of water, the time of infusion, the addition of milk and more.
Well, at least you have a new fun fact to tell on your next date.
To conclude, it’s always helpful for your business to have a go at ISO. There are companies who may only look at these standards as a way to attract ISO-conscious clients, or please ISO-conscious stakeholders, but ISO standards can be exceptional catalysts in showing that your organisation has developed, maintains and continuously improves its business processes. And if you don’t think that ISO could be helpful for you, at least you now know how to properly drink your cup of tea. You’re welcome.
Frequently Asked Questions
Which ISO standards should a SaaS company get certified in first?
Most SaaS companies start with one of two:
- ISO 27001 (information security). This is usually first, because enterprise customers ask for it in security questionnaires and procurement reviews.
- ISO 9001 (quality management). Add this when customers care about consistent delivery and service quality, or when you want one process framework across the company.
Other standards in the family, such as ISO 14001 (environment) or ISO 50001 (energy), only become relevant if a customer or sector requires them. Reservar una demostración to see how Compleye supports ISO 27001 and ISO 9001 for SaaS teams.
How many ISO standards are there, and do I need all of them?
ISO publishes thousands of standards and related documents, but most are product-specific or industry-specific. Only a small group is generic enough to apply to any organization, and only some of those are certifiable. For most companies the realistic list is one to three standards, chosen by what customers and regulators expect.
Can a company be certified in more than one ISO standard?
Yes. Many companies hold several certifications, for example ISO 27001 and ISO 9001 together. The standards share a common structure, so documentation, internal audits and management reviews can be reused across them. Running them in one system is much lighter than managing each separately.
Are all ISO standards certifiable?
No. Some standards are certifiable, such as ISO 27001, ISO 9001 and ISO 14001, meaning an accredited body audits you and issues a certificate. Others are guidance only and cannot be certified against, such as ISO 31001 (risk management) and ISO 26000 (social responsibility). Check this before you budget for an audit.
What is the difference between ISO 27001 and ISO 9001?
ISO 27001 manages information security risk: access control, incident response, business continuity and data protection. ISO 9001 manages quality: consistent processes, customer satisfaction and continual improvement. For a SaaS company, ISO 27001 answers “can we trust you with our data?” and ISO 9001 answers “can we rely on you to deliver consistently?”.
