Organisations are often drawn to a standard because a competitor has it, or because a customer asked for it once. Both can be good reasons. Neither is enough on its own. A standard is a commitment of time and attention, so it is worth being clear about why you are making it.
Start from the reason, not the badge
Ask what is driving the need. A customer requirement, a regulator’s expectation, a way to bring discipline to how you work, or a market signal each lead to a different scope and a different level of effort. The reason also tells you when you are finished.
Know what the common standards are for
- ISO/IEC 27001: a certifiable management system for information security.
- ISO/IEC 27701: requirements for establishing, implementing, maintaining and continually improving a privacy information management system (PIMS).
- ISO 22301: business continuity, keeping critical services running through disruption.
- ISO 9001: quality management.
- ISO/IEC 20000-1: managing IT services.
- ISO/IEC 42001: managing AI systems.
Not every ISO publication is a management system standard you can be certified against. ISO/IEC 27017 (cloud security controls) and ISO/IEC 27018 (protecting personal information in public clouds) are guidance used alongside a main standard.
Integrate where standards overlap
Management system standards share a common structure, with similar requirements for leadership, risk, documentation, internal audit and management review. Where several apply to you, running them as one integrated system avoids duplicated documents, repeated audits and conflicting procedures. It also gives leadership one view of the whole. Integration does not mean every standard has identical requirements. It means building shared governance, risk management, document control, internal audit and management review processes while retaining the specific controls and requirements of each standard.
Check applicability before committing
Read what the standard requires and what your scope would be. Ask what evidence you would need, who would operate it, and what the certification body would audit. A short scoping conversation costs far less than a certification that does not fit.
Consider a growing technology company receiving requests from prospective enterprise customers for ISO 27001, ISO 9001 and ISO 22301 certifications. Initially, management considers pursuing all three simultaneously to strengthen its market position. However, after assessing its business risks, customer requirements and operational maturity, the organisation decides to prioritise ISO 27001 because information security is its most immediate concern. It then builds a management system that can accommodate additional standards as the business grows. This approach avoids unnecessary duplication and allows the organisation to establish a functioning system before expanding its certification commitments.
