How to choose the right ISO certification for your company

You don't need to certify against everything: you need the standard that answers what customers and tenders are asking for. Many SMEs come to ISO certification because a client has put it in a specification, because a funding call awards points to those who hold it, or because a competitor has just obtained it. The risk, at that point, is choosing on impulse: the best-known standard, the one your neighbour has, or three standards at once "to be covered".

This guide offers a different method: four questions in sequence to work out how to choose the ISO certification that is most useful to your company. What the market is asking of you, which risk weighs most heavily on your business, which laws you already have to comply with, where you are starting from and with what resources. You will find a table linking each standard to the problem it solves, three example companies with their reasoning, and the most common mistakes. If you first need the basics on what a standard is and how the audit works, start with our guide on what ISO certifications are.

Why does choosing an ISO certification start from demand, not from the standard?

The right certification is the one someone is asking you for, or the one that protects what matters most. Everything else comes later.

In the vast majority of cases an ISO certification is voluntary. No general law requires an SME to certify to ISO 9001 or ISO 14001. That is exactly why the choice is strategic: you are deciding where to invest people's time, management attention and budget for several years, because a certificate is not obtained just once. It has to be maintained through surveillance audits and renewed when the cycle ends.

Starting from the standard means asking yourself "which certificate is most widespread?". Starting from demand means asking "who wants to see it, and why?". The difference is concrete. A machining workshop supplying the automotive sector may find that its main customer requires ISO 9001 as a prerequisite for staying on its approved supplier list, while ISO 14001 is merely welcome. A software house may find that customers' security questionnaires ask for ISO/IEC 27001 and that ISO 9001 makes no difference in negotiations.

There is a second reason to start from demand: certification has a precise boundary, called the scope. The certificate covers specific activities and sites, not "the company" in the abstract. If the customer asks for certification of your maintenance service and you certify only production, you have spent effort without solving the problem. Understanding what you are being asked for therefore helps you choose both the standard and the boundary.

Which ISO certifications exist and which problem does each one solve?

Each management system standard addresses a different risk: quality, environment, people's safety, information security, continuity, bribery, artificial intelligence. The table does not replace reading the standards, but it helps you connect them to the signals you see in your company.

Two clarifications avoid many misunderstandings. First: ISO 9001 is the most widely used management system standard in the world according to ISO, but widely used does not mean right for you. Second: UNI/PdR 125 is not an ISO standard, it is an Italian reference practice published by UNI, but in practice it is chosen with the same logic.

You will find a dedicated page for each standard in our services section on certifications and regulations.

Question 1: what are customers, tenders and funding calls asking for?

The first question is the most concrete: who, today, is asking you for a certificate, and which one? It is the most immediate source of value, because it links certification to revenue that already exists or that you want to win.

Read specifications, contracts and customer questionnaires

The quickest way to answer is to gather the documents you already have. Take your latest framework contracts, supplier qualification questionnaires, the tender specifications you bid on or passed up, and the requests from your main customers' purchasing departments. In an afternoon's work you have a clear map of what the market is asking.

Always distinguish between a requirement and a preference. If a customer writes that the supplier "must be certified", without a certificate you are out. If it writes that certification "is a preferential element", it earns you points but is not a gate. The boundary matters too: many questionnaires require the certificate to cover the activity being supplied, not another line of business.

A typical example: an IT services SME receives dozens of security questionnaires from customers every year, each with different questions on the same topic. ISO/IEC 27001 does not eliminate questionnaires, but it lets you answer many questions by referring to the certificate and its scope, reducing repetitive work for the technical team.

Public tenders: certifications that count in scoring and guarantees

If you work with the public sector, certifications also carry formal weight. The Italian Public Contracts Code (Legislative Decree 36/2023, art. 106), in the wording in force after the corrective Legislative Decree 209/2024, provides for a reduction of the bid bond for those holding a certified quality management system. It also provides for a further reduction for other certifications listed in Annex II.13, including ISO 14001, ISO 45001, ISO/IEC 27001, ISO 37001 and UNI/PdR 125, where the tender documents specify them.

This does not mean it pays to pile up certificates for every tender. It means that, if tenders are a significant part of your revenue, you need to read the tender documents in your sectors and understand which certifications genuinely recur in the evaluation criteria. A clear hierarchy often emerges: one standard is almost always required, a second appears often, the others are marginal.

Question 2: which risk weighs most heavily on your business?

If no customer is asking you for a certificate yet, the choice starts from your main risk. A useful certification is one that brings under control the thing that would hurt you most if it went wrong.

Map risks according to what you actually do

Do a simple exercise with management: list the events that have cost you customers, money or time in recent years, and those you fear most. Then link each one to an area.

Recurring returns and complaints, late deliveries, design errors: that is a quality issue, so ISO 9001. A serious injury, a contract at third-party premises with interference risks, a labour inspection: health and safety, so ISO 45001. A ransomware attack, the loss of a laptop with customer data, a cloud supplier going down: information security and continuity, so ISO/IEC 27001 and possibly ISO 22301. A dispute over waste or discharges: environment, so ISO 14001.

This exercise has a valuable side effect. It forces you to think about the context of the organisation, which is precisely the starting point required by all management system standards.

When the main risk is data

For many service companies the most sensitive asset is not a machine but information: customer data, source code, projects, access credentials to clients' systems. In these cases ISO/IEC 27001 is often the first choice, even when nobody is asking for it yet, because it requires you to assess risks and choose proportionate controls.

Be careful, though, not to start from the most "fashionable" standard if your real risk lies elsewhere. A small construction firm with three computers in the office has a risk profile dominated by site safety, not cybersecurity. It still needs basic IT security measures, but the certification that creates most value is a different one. If you want to explore the data case, our complete guide to ISO 27001 explains requirements and the path.

Question 3: is there a regulation the certification helps you manage?

An ISO certification does not replace legal obligations, but it can help you organise them and show that you manage them methodically. If you are already subject to a demanding regulation, the related standard may be the most efficient starting point.

The clearest case is occupational health and safety. Italy's Legislative Decree 81/2008, article 30, in the wording now in force, states that, on first application, organisational models defined in accordance with the 2001 UNI-INAIL Guidelines or with UNI EN ISO 45001:2023+A1:2024 are presumed to comply, for the corresponding parts, with the requirements of that article. The original text referred to BS OHSAS 18001:2007, since replaced by ISO 45001. It is a direct link between a voluntary standard and the law, also useful for those working on the organisational models provided for by Legislative Decree 231/2001.

For cybersecurity, entities within the scope of NIS2 must apply the security measures set by Italy's National Cybersecurity Agency (ACN). The law does not require ISO/IEC 27001, but a certified system is a solid starting point: UNI published in 2025, with ACN's support, the reference practice UNI/PdR 174, which harmonises ISO/IEC 27001 with the NIST CSF 2.0 framework and is designed precisely to help organisations already certified to ISO/IEC 27001 extend their system towards the required measures.

The same reasoning applies to other areas. ISO/IEC 27701 helps govern the processing of personal data, but GDPR compliance remains a separate obligation that must be assessed on its own. ISO 37001 structures bribery prevention without replacing the assessments required by Legislative Decree 231/2001. ISO/IEC 42001 organises the management of artificial intelligence systems, useful for those facing the obligations of the AI Act. Finally, the gender equality certification provided for by art. 46-bis of Legislative Decree 198/2006 is based on the parameters of UNI/PdR 125.

The practical rule is this: if a regulation already requires you to assess risks, document measures and carry out checks, the corresponding ISO standard lets you do the work once for two purposes. If, on the other hand, the law does not concern you, that link alone does not justify the choice.

Question 4: where are you starting from and how many resources can you commit?

The last question is about you, not the market: what you already have in place and how much internal time you can really invest. Two companies with the same requests may make different choices depending on their starting point.

Assess what already exists

Almost no SME starts from scratch. If you already have an up-to-date risk assessment, safety procedures that are applied, an active health and safety officer and training records in order, you are closer to ISO 45001 than you think. If you already handle complaints, monitor suppliers and measure customer satisfaction, you have a good basis for ISO 9001. An initial analysis of practices already in use often changes the order of priorities.

Time, people and scope

Every path requires an internal lead with dedicated time, management involvement and area managers who are willing to gather evidence. The standards explicitly require leadership commitment, and auditors check it.

The variables that weigh most on timing and investment are the number of people and sites, the complexity of processes, the chosen scope and the starting level. There is no standard cost per standard: that is why a serious quote always starts from an analysis of your situation. To understand how the phases unfold, read the guide on how long ISO certification takes.

This is also where an expert makes the difference. At Complaion the dedicated Lead Auditor starts from exactly these four questions: they analyse customer requests, risks, obligations and existing practices, and propose the path best suited to the company's needs, which is sometimes a single standard and sometimes an integrated system.

One standard or several together: when does integration make sense?

It makes sense to start with a single standard when market demand is clear and internal resources are limited. It makes sense to integrate when two or more standards are already required or soon will be.

ISO management system standards share the same harmonized structure, defined in Annex SL of the ISO/IEC Directives, Part 1: the same clause titles, the same core text, the same common terms. Context, leadership, planning, support, operation, performance evaluation and improvement recur in all of them. That is why policy, context analysis, internal audits, management review and corrective action handling can be built once and serve several standards.

The most common case is the combination of ISO 9001, ISO 14001 and ISO 45001, frequent in manufacturing, construction and technical services. Another natural pairing is ISO 9001 with ISO/IEC 27001 for IT companies, or ISO/IEC 27001 with ISO 22301 for those providing critical services. We explore benefits and limits in the guide to the integrated management system.

Integrating, however, does not mean doing everything at once. An effective strategy is to design the system to grow: you certify the most urgent standard today, but set up documents, roles and the compliance calendar so that the second standard can be added without redoing the work. It is the approach our Lead Auditor follows when building the roadmap with the company.

Three example companies: how the choice changes

The examples below are simplified, but they show how the four questions lead to different conclusions even for companies of similar size.

A contract machining workshop with 40 employees

The workshop works for three large industrial customers. Two of them require ISO 9001 in their supplier qualification questionnaires, the third lists it as a requirement for joining a new programme. The main risk is product nonconformities and late deliveries; on safety, the company already has a good level of management.

The choice is clear: it starts with ISO 9001 as the first certification, with a scope covering machining and quality control. The system is set up so that ISO 45001 can be added later, making use of the existing safety documentation. To find out more, see our guide to the ISO 9001 quality management system.

A software house with 25 people

The company develops cloud management software for professional firms. It does not take part in tenders, but its largest customers send increasingly detailed security questionnaires and two deals have stalled because it has no certificate. The main risk is an incident involving customer data.

Here ISO 9001 would have little commercial impact. The choice falls on ISO/IEC 27001, with a scope covering development, cloud service delivery and support. If the company starts to integrate AI-based features, it can consider ISO/IEC 42001 on the same structure.

A services company that lives on public tenders

The company provides cleaning and facility services to public bodies and hospitals, with many staff spread across several sites. Quality, environment and safety often appear in the tender documents in its sectors, and some calls award points for gender equality.

In this case an integrated system covering quality, environment and safety is the most sensible choice, because the three standards are requested together and share a large part of the work. UNI/PdR 125 is assessed as a next step, depending on how much weight it carries in the tenders the company actually bids for.

Which mistakes should you avoid when choosing an ISO certification?

The most expensive mistakes almost always stem from a decision taken without data.

The first is choosing by imitation: certifying to ISO 9001 because "everyone has it", when customers are asking for something else. The certificate arrives, but it does not unlock any deal.

The second is certifying too many standards at once without resources. Three systems launched in parallel with a single part-time lead produce documents written for the audit and rarely applied. At the first surveillance the gaps emerge, and the system becomes a burden instead of a tool.

The third is getting the scope wrong. A scope that is too narrow does not meet the customer's request; one that is too broad brings in sites and activities that are not needed, with more work and longer audits. The scope should be decided with the customer who requires it, reading carefully what they ask for.

The fourth is forgetting maintenance. A certification is valid for a multi-year cycle with periodic checks: choosing a standard means committing to keeping it alive, with internal audits, reviews and updates.

The last is trusting whoever promises everything. Whoever prepares you cannot issue the certificate: that is done by an accredited certification body, independent of whoever supports you. Be wary of "guaranteed certificate" offers.

How Complaion helps you choose and obtain the right certification

Choosing your first ISO certification well saves you years of wasted work. Complaion does this every day with more than 1,000 clients. A dedicated Lead Auditor follows your company from the initial analysis to the certification body's audit: they start from the four questions in this guide, review customer requests, risks and obligations with you, and propose the path best suited to your needs, a single standard or an integrated system.

The Complaion platform collects evidence, manages documents, keeps the compliance calendar and prepares the audit, so the system stays in order even when you add a second standard or face surveillance audits and renewals. Before the certification body's visit, the internal audit is carried out by your Complaion Lead Auditor. See how it works on the platform page.

Want to know which standard to start from? Talk to a Lead Auditor or request a quote built around your company from the pricing page.

Frequently asked questions about choosing an ISO certification

Which ISO certification do companies ask for most?

ISO 9001 on quality management is the most widely used management system standard in the world according to ISO data. It is often the prerequisite for joining industrial customers' supplier lists and appears in many tenders. This does not automatically make it the right choice for you, though. If your customers ask about information security or the environment, the most useful standard may be a different one.

Is ISO certification required by law?

In general, no: ISO certification is voluntary. It becomes effectively necessary when customers, contracts or calls for tender require it, or when it gives access to benefits such as bid bond reductions in public tenders. Some regulations attach specific effects to certain standards, such as Italy's Legislative Decree 81/2008 for models compliant with ISO 45001. Legal obligations, however, remain with the company with or without a certificate.

Which ISO certification should an SME start with?

Start with the one that answers your customers' most concrete request or your business's highest risk. For many manufacturers it is ISO 9001, for many IT companies it is ISO/IEC 27001, for those working on construction sites it may be ISO 45001. The answer changes according to sector, markets and starting point. An initial analysis with an expert keeps you from investing in the wrong standard.

Can I obtain several ISO certifications at the same time?

Yes, it is possible and often worthwhile, because management system standards share the same harmonized structure. Policy, context, internal audits and management review can serve several standards together. You do, however, need enough internal time. If resources are limited, it is better to certify one standard at a time while designing the system to accommodate the next ones.

Is ISO 27001 mandatory for NIS2?

No, NIS2 does not require an ISO certification. Entities within its scope must apply the security measures set by Italy's National Cybersecurity Agency. A system certified to ISO/IEC 27001 is nonetheless a solid basis, because it already requires risk assessment, documented controls and periodic checks. ACN supported a UNI practice that helps certified organisations extend their system towards the NIS measures.

How do I decide what scope to give the certification?

The scope defines which activities, sites and processes the certificate covers. It should be chosen starting from what customers ask of you: if the request concerns a specific service, that service must fall within the scope. A scope that is too broad increases work and audit duration, one that is too narrow risks not being accepted. It is best to define it with whoever supports you before starting the path.

How much does choosing one certification over another cost?

There is no fixed price per standard. The investment depends on the number of people and sites, process complexity, chosen scope and starting point. The number of standards matters too, but an integrated system lets you share a lot of work across different standards. To get a reliable indication you need a quote based on your actual situation.