MANAGEMENT SYSTEMS & ASSURANCE01 / 06
six pathways
ISO
SCOPE1-2 DAYS
READINESS1-2 WEEKS
STAGE 1 + 2AUDIT
DECISIONREVIEW
INDEPENDENT
TECHNICAL
REVIEW
TECHNICAL
REVIEW
MANAGEMENT SYSTEMS & ASSURANCE / SIX PATHWAYS
Surety,
issued.
Quality, information security, privacy, IT service management, AI governance and SOC 2: six ways to show customers how your organisation actually works. We're the auditor. Here's what it costs, how long it takes, and whether you should bother yet — before you talk to anyone.
We audit. That's the whole business.ISO 9001 · ISO/IEC 27001 · 27701 · 20000-1 · 42001 · SOC 2
Verifiable and
unglamorous.
unglamorous.
SINCE 2013
50+ countries15,000+ clients certified
ISSUING BODY
SIS Certifications Pvt. Ltd.Accredited Certification Body
ACCREDITATIONS
IAS-CB-129UAF 51901221013
FRAMEWORKS
ISO 9001, ISO/IEC 27001, 27701,20000-1, 42001 and SOC 2
01 / 06
Certification
ISO 9001:2015 · Quality Management System
Quality that holds up under scrutiny.
ISO 9001 shows that the organisation runs one agreed way of working: processes are planned, results are checked, and what goes wrong is corrected rather than repeated.
Why it is asked for
Tender committees, vendor-registration portals and customers running second-party audits often ask for ISO 9001 before a supplier can be considered.
- Outcome
- Accredited certificate
- Audit
- Stage 1 + Stage 2
- Cycle
- 3 years, annual surveillance
What the audit looks at
- Scope and context: the management system fitted to how the organisation actually operates
- Leadership, quality policy and risk-based planning of quality objectives
- Competence, awareness and control of documented information
- Operational control, including product requirements and external providers
- Measurement, nonconformity, corrective action and continual improvement
02 / 06
Certification
ISO/IEC 27001:2022 · Information Security Management System
Make information security demonstrable.
ISO/IEC 27001 is a risk-based management system for protecting the confidentiality, integrity and availability of information, with controls chosen and justified against real assets and real risks.
Why it is asked for
Procurement teams, regulators and insurers increasingly ask for ISO/IEC 27001 by name before customer data, systems or contracts move to a supplier.
- Outcome
- Accredited certificate
- Audit
- Stage 1 + Stage 2
- Cycle
- 3 years, annual surveillance
What the audit looks at
- Risk assessment against the organisation's information assets
- Annex A controls selected, justified and recorded in a Statement of Applicability
- Access management, including joiners, leavers and periodic reviews
- Supplier security requirements and incident management
- Internal audit, management review and continual improvement
03 / 06
Certification
ISO/IEC 27701 · Privacy Information Management System
Put privacy into the system, not just the policy.
ISO/IEC 27701 adds privacy information management to the way personal data is governed: who acts as controller or processor, how data is recorded, retained, transferred and deleted, and how privacy risk is assessed.
Why it is asked for
Organisations that sign data processing agreements, or handle personal data for customers, are asked to show how privacy is managed in practice. Privacy builds on information security, but the two are not the same discipline.
- Outcome
- Accredited certificate
- Edition
- 2019 extends 27001; 2025 stands alone
- Cycle
- 3 years, annual surveillance
What the audit looks at
- Controller and processor roles, defined for each processing activity
- Records of processing and privacy risk and impact assessment
- Notice, consent and data-subject requests handled within required time limits
- International transfers and sub-processor obligations
- Personal-data breach handling and the evidence that the system works
04 / 06
Certification
ISO/IEC 20000-1:2018 · IT Service Management System
Make service delivery repeatable.
ISO/IEC 20000-1 is the international standard for a service management system: how IT-enabled services are planned, delivered, operated, measured and improved against agreed service levels.
Why it is asked for
Managed service providers, cloud and application support firms, outsourcers and internal IT functions are asked to prove that the discipline behind their service levels exists. The certificate covers the organisation; ITIL qualifications cover individuals.
- Outcome
- Accredited certificate
- Audit
- Stage 1 + Stage 2
- Cycle
- 3 years, annual surveillance
What the audit looks at
- Service scope and portfolio, including components delivered by suppliers
- Service level management with agreed targets and reporting
- Incident, service request and problem management
- Change, configuration and release control, with continuity and capacity planning
- Service reporting, supplier review and continual improvement
05 / 06
Certification
ISO/IEC 42001:2023 · Artificial Intelligence Management System
Govern AI with evidence, not assumptions.
ISO/IEC 42001 is a management system standard for organisations that develop, supply or use AI: knowing which AI systems are in use, assessing the harm they could cause, controlling the data and models behind them, and keeping people accountable for the outputs.
Why it is asked for
Enterprise buyers, regulators and boards are asking who is accountable for AI inside a product or a decision. Certification covers the organisation's management system; it is not a product approval and does not guarantee that an AI system is safe, unbiased, lawful or free from error.
- Outcome
- Accredited certificate
- Audit
- Two-stage audit
- Cycle
- 3 years, annual surveillance
What the audit looks at
- AI role and scope: which systems are developed, supplied or used
- AI policy, accountability and named ownership of each system
- Risk assessment and assessment of impact on individuals and society
- Data provenance and quality, competence and human oversight
- Lifecycle controls, live monitoring, incidents and continual improvement
06 / 06
Attestation
SOC 2 Type 2 · AICPA Trust Services Criteria
Show how your controls operate over time.
SOC 2 is an attestation engagement, not an ISO certification. A Type 2 examination reports on the design and operating effectiveness of controls against the applicable Trust Services Criteria across a defined observation period.
Why it is asked for
North American enterprise customers and vendor-risk teams often ask for a SOC 2 Type 2 report, sometimes even when ISO/IEC 27001 is already held. Only an independent licensed CPA firm may perform the examination and sign the opinion; SIS scopes the engagement and coordinates the attesting firm.
- Outcome
- Attestation report
- Signed by
- Independent licensed CPA firm
- Period
- Observation period, typically 3–12 months
What the examination covers
- Scope and Trust Services Criteria: Security always, others where customer commitments require them
- A system description written by management, including subservice organisations
- Control environment, risk assessment and vendor monitoring
- Access and change control that leaves evidence across the whole period
- Monitoring, vulnerability management and incident response
TWO ROUTES
Certified, or attested.
Five of the six pathways end in an accredited ISO certificate. SOC 2 ends in an independent report. Knowing which one a customer is actually asking for is the first decision.
01 / CERTIFICATION
An accredited certificate.
ISO 9001, ISO/IEC 27001, 27701, 20000-1 and 42001 are certified by an accredited certification body after a Stage 1 and Stage 2 audit. Certificates run three years with annual surveillance.
02 / ATTESTATION
A report on how controls operated.
SOC 2 is an examination against the AICPA Trust Services Criteria. Only an independent licensed CPA firm may perform it and sign the opinion; SIS scopes the engagement and coordinates the attesting firm.
03 / INDEPENDENCE
We audit. We don't build.
We perform the independent audit and issue the report or certificate. We explicitly do not design controls, write policies, or provide remediation consulting. If you are not there yet, you need a readiness consultant.
COMPLEMENTARY STANDARDS
More than one standard?
Some organisations need more than one, depending on their risks, contracts, customers and operating environment. None of the six is mandatory, and none automatically substitutes for another. The right combination depends on what you actually need to demonstrate.
ISO/IEC 27001 + ISO/IEC 27701
Security and privacy
Privacy management builds on the information-security system. Under the 2019 edition, 27701 is certified as an extension to 27001; the 2025 edition can stand on its own.
ISO/IEC 27001 + SOC 2
A certificate and a report
Both draw on the same access, change and incident controls, but they answer different buyers: an accredited certificate, and an attestation report signed by a CPA firm. Neither replaces the other.
ISO/IEC 20000-1 + ISO/IEC 27001
Service and security
Service management and information security share change control, incident handling, supplier management and continuity, so the evidence often overlaps.
ISO/IEC 42001 + ISO/IEC 27001
AI and the data behind it
AI governance sits on top of information security, and often privacy, so organisations working with AI frequently consider them together.
ISO 9001 + other management systems
One structure, several standards
Management-system standards share a common clause structure, internal audit and management review, which can make an integrated approach practical.
THE PROCESS
A predictable sequence
from scoping to certification.
The general route for the five ISO management-system standards. Durations are typical, scope-dependent, and nothing about the outcome is automatic.
Application & proposal
Understand the requirement and agree the scope: the standard, the sites, services and activities covered, and anything outsourced.
Gap review & readiness
Review readiness against the applicable requirements so that gaps are found before the audit rather than during it.
Stage 1 + Stage 2 audit
Stage 1 confirms the documented system and scope are established. Stage 2 tests the system in operation, tracing real records through the relevant controls.
Findings & decision
Nonconformities are addressed with corrective action, and an independent technical review of the audit file comes before any certification decision.
Certificate & surveillance
The certificate states its scope and can be verified online. It runs three years, with surveillance audits each year and recertification before expiry.
HOW TO VERIFY ANY AUDITOR
A certificate is only as valuable as the body that issued it.
QUESTIONS
Key
details.
A founder shouldn't have to sit through a sales call to find out whether they can afford to sell into enterprise. Rates are on the pricing page. Nobody will call you unless you ask.
Start from the requirement as your customer, contract or tender actually states it. Consistent quality points to ISO 9001; protecting information to ISO/IEC 27001; personal data to ISO/IEC 27701; managed IT services to ISO/IEC 20000-1; AI you develop, supply or use to ISO/IEC 42001; and customers who want a report on how controls operated over a period, often in North America, to SOC 2. Many organisations need only one.
ISO certification is issued by an accredited certification body after a Stage 1 and Stage 2 audit of a management system; the certificate runs three years with annual surveillance. SOC 2 is an attestation: an independent licensed CPA firm examines controls against the AICPA Trust Services Criteria and signs an opinion. A Type 2 report covers an observation period and has no expiry date, though buyers usually expect one no older than twelve months.
ISO/IEC 27001 manages the security of information: its confidentiality, integrity and availability. ISO/IEC 27701 adds privacy information management for personal data: controller and processor roles, records of processing, data-subject rights, retention and transfers. Under the 2019 edition, 27701 is certified as an extension to 27001; the 2025 edition can stand alone. Certification does not by itself make an organisation compliant with GDPR or any other law.
Yes. They draw on the same access, change and incident controls, so one evidence set can support both. They answer different buyers, though: some accept the certificate, while others, often North American enterprise customers, ask for a SOC 2 report even when ISO/IEC 27001 is held. Neither automatically replaces the other.
A defined scope and a management system that is already operating: documented processes, internal audit and management review records, and evidence that controls run in practice. For SOC 2, controls must operate and leave evidence throughout the observation period. The audit is independent, so if the system still needs to be built, engage a readiness consultant first.
No. ISO/IEC 42001 certifies the organisation's management system for AI: its inventory of AI systems, risk and impact assessment, control of data and models, and human oversight. It is not a product approval, and it does not guarantee that an AI system is safe, unbiased, lawful or free from error, or by itself establish compliance with AI regulation.
Often, yes. Management-system standards share a common structure and much of their evidence, such as risk assessment, supplier management, incident handling, internal audit and management review. Whether a combined or integrated audit suits your scope is something to settle at application; it depends on the standards, sites and services involved.
REQUEST A FIXED-FEE QUOTE
ISO / 06
Get an exact
figure.
Fill out a short questionnaire with your company size and framework needs. We return a binding fixed-fee proposal within one business day.
Request a quote ↗