ISO 9001 vs ISO 27001: Differences and Running Both

ISO 9001 vs 27001 comes down to what each system protects. ISO 9001 is the international standard for a quality management system (QMS): it makes sure you consistently deliver products and services that meet customer and regulatory requirements. ISO/IEC 27001 is the standard for an information security management system (ISMS): it protects the confidentiality, integrity and availability of information through a formal risk assessment and a set of 93 Annex A controls.

They are not alternatives. Many organisations hold both, and because the two standards share the same clause 4 to 10 structure, they can run as one integrated management system. Sovereign Secure is ISO 27001 certified itself and provides consultancy for both standards, with certification audits carried out by our partner certification body, MQA International.

ISO 9001 vs ISO 27001: what is the difference?

ISO 9001 manages quality and customer satisfaction; ISO 27001 manages information security risk. The skeleton is shared, but what each system controls, and what auditors test, is different.

What does ISO 9001 cover?

ISO 9001 takes a process approach to quality. It asks you to understand customer requirements, control design where you do it, manage external providers, deliver and release products and services under controlled conditions, deal with nonconforming outputs and measure customer satisfaction. ISO describes the standard and the rest of the family on its ISO 9000 family page. If you are new to it, our guide to what ISO 9001 is explains the seven quality principles and the requirements in plain English, and our ISO 9001 consultancy and certification page covers the clauses, costs and timeline in detail.

What does ISO 27001 cover?

ISO 27001 starts from risk. You define the ISMS scope, assess information security risks against your own criteria, decide how to treat them and record which controls apply in a Statement of Applicability. Annex A lists 93 controls in four themes: 37 organisational, 8 people, 14 physical and 34 technological. Our guides to the ISO 27001 risk assessment and the ISO 27001 Annex A controls explain both in full, and ISO’s page on ISO/IEC 27001 describes the standard itself.

Where do ISO 9001 and ISO 27001 overlap?

The overlap sits in the management system clauses. Clauses 4 to 10 (see the ISO 27001 requirements) follow the same structure in both standards, so most of the machinery can be built once; clause 8 is where they part company.

Some Annex A controls also support quality directly: supplier relationships (5.19 to 5.22), incident management (5.24 to 5.28), continuity (5.29 and 5.30), documented operating procedures (5.37) and change management (8.32). A well-run QMS often has the bones of these in place already.

ISO 9001 vs ISO 27001: clause-by-clause comparison matrix

This matrix goes one level deeper than the table above, requirement by requirement, so you can see which parts of an integrated system are built once and which belong to one standard only.

What does each standard need that the other does not?

ISO 27001 needs a security risk method and security controls that ISO 9001 never asks for; ISO 9001 needs operational quality controls that ISO 27001 never asks for.

• Only in ISO 27001: a risk assessment that produces consistent, valid and comparable results (clause 6.1.2), a risk treatment plan, a Statement of Applicability, and evidence that the selected Annex A controls work, such as access reviews, backups, logging, vulnerability management and supplier security clauses.
• Only in ISO 9001: determining customer requirements, design and development controls, control of externally provided products and services for conformity, release of products and services, control of nonconforming outputs, customer satisfaction monitoring, and control of monitoring and measuring equipment.

Should I get ISO 9001 or ISO 27001 first?

Get whichever standard your customers, tenders or regulators are asking for now. Neither is a prerequisite for the other.

If you already hold ISO 9001, adding ISO 27001 reuses your document control, internal audit, management review and corrective action processes. The new work is the risk assessment, the Statement of Applicability and the Annex A controls themselves, many of which are technical. If you already hold ISO 27001, adding ISO 9001 means describing and controlling your operational processes: customer requirements, design, suppliers, delivery and nonconforming outputs.

Can you run ISO 9001 and ISO 27001 as one management system?

Yes. An integrated management system runs both standards on one set of shared processes, so you maintain one system rather than two.

What to share:

• one document control and records process;
• one risk register, keeping the ISO 27001 risk criteria and method intact;
• one internal audit programme, with auditors competent in both standards and impartial about the areas they audit;
• one management review that covers the inputs each standard requires;
• one nonconformity and corrective action process.

What to keep separate: the Statement of Applicability, the quality controls on operations, and the scope statements where the certificates will cover different sites or services.

Common pitfalls: blending the two risk methods until the ISO 27001 assessment no longer gives repeatable results; assuming one scope fits both standards; and relying on internal auditors trained in only one of them.

Each standard is still certified in its own right, with its own scope and certification decision. Whether the certification audits can be combined, and how that affects audit time, is for the certification body to decide; we confirm it for your scope before you commit. ISO 9001:2026 keeps the clause 4 to 10 structure, so integration works the same way it did with the 2015 edition; our guide to ISO 9001:2026 covers what changed.

How are ISO 9001 and ISO 27001 audited?

Both follow the same certification cycle: a Stage 1 audit of readiness and documentation, a Stage 2 audit of how the system works in practice, a three-year certificate, surveillance audits in years two and three, and a recertification audit before expiry. What changes is what the auditor samples. An ISO 9001 auditor follows work through the business: orders, customer feedback, supplier evaluations and nonconforming outputs. An ISO 27001 auditor starts with the risk assessment and the Statement of Applicability, then samples the controls you said apply, which usually means technical evidence from IT. Our ISO 27001 consultancy prepares your team for that evidence-led audit.

Why Sovereign Secure

• We hold ISO 27001 ourselves, so we go through the same surveillance audits we prepare clients for.
• One team for both standards. Our consultancy covers ISO 9001 and ISO 27001, plus ISO 14001, 45001, 22301 and others on our ISO certification page, so the integrated system is designed once.
• Independent certification. We consult; MQA International carries out the certification audits and makes the certification decision. We never issue certificates.
• Security evidence reused. As a PCI SSC Qualified Security Assessor company and an IASME-licensed Cyber Essentials certification body, we map ISO 27001 controls to PCI DSS and Cyber Essentials, so evidence gathered for one can support the others.
• UK-based. A UK company since 2012, headquartered in Accrington, Lancashire, supporting clients across the UK and through offices in Los Angeles, Singapore, Dubai and Dhaka.

Get a quote for ISO 9001, ISO 27001 or both

Tell us which standard your customers are asking for, how many people and sites are in scope, any certificates you already hold and your deadline. We will send a fixed consultancy quote and a plan that builds once for both standards where that makes sense. Contact us for a quote or call +44 161 523 5276.