ISO 9001 for IT companies: certified online

IT companies sell work that clients cannot inspect before they buy. Code quality, configuration care, support behaviour and response times only show in daily use. A buyer therefore looks for evidence that your delivery does not depend on one person's memory or goodwill.

ISO 9001:2015 provides that evidence. It is the world's leading standard for quality management systems. It asks you to define your processes, set measurable objectives, manage risks and improve continually. Procurement teams, larger customers and partner companies often list it in supplier questionnaires and tender documents, because it is a recognised proof that is easy to check.

For a small software house, an agency or a managed service provider, a certificate can remove a barrier at the first stage of a selection, before the technical conversation even starts.

• ISO 9001 at a glance
• ISO for small and medium businesses

The standard does not prescribe tools or methods. It does not matter whether you work in an agile or a classic way. It asks that you know your processes, control them and learn from failures. The table shows where typical IT risks meet the standard.

• ISO 27001 for information security

The six key requirements sound abstract. In an IT company they translate into a few concrete working habits.

1. 01

   Understand your context (clause 4)

   Write down who your clients are and what they expect. A SaaS vendor, for example, notes that clients expect availability and data care, and that the terms of its hosting provider limit what it can promise.

2. 02

   Set a quality policy and objectives (clause 5)

   Keep the policy to one page. Choose objectives you can measure, such as the share of tickets answered within the agreed response time or the number of defects reported after a release.

3. 03

   Assess risks and opportunities (clause 6)

   A simple register is enough. Typical entries are dependence on a key person, a supplier outage and scope creep. An opportunity might be automating regression tests.

4. 04

   Define and control processes (clause 8)

   Describe the path from request to estimate, build, test, release and support. A release checklist and a code review rule make the process visible and repeatable.

5. 05

   Ensure resources and competence (clause 7)

   Keep training records, an onboarding checklist for new developers and an overview of who can cover which system.

6. 06

   Monitor and improve (clauses 9 and 10)

   Run an internal check and a management review at fixed intervals. After an outage, hold a short review and turn the findings into corrective actions.

• Overview of all standards

The wording of the standard is general. These examples show what the key terms mean in an IT company.

Interested party

Anyone with expectations towards your company: clients, end users, hosting providers, partner agencies and your own employees.

Documented information

Runbooks, architecture notes, release checklists, ticket history, the quality policy and records of reviews.

Externally provided process

Work or services you buy in and rely on, such as freelance developers, cloud hosting or licensed software components. Clause 8.4 asks you to control them.

Customer property

Client data, access credentials, source code and test environments that the client entrusts to you. You protect them and report problems.

Nonconformity

A requirement that was not met, for example a release deployed without the planned test.

Corrective action

A step that removes the cause, not only the symptom. After a repeated outage, you change the deployment checklist so it cannot happen the same way again.

Management review

A regular meeting where owners or managers look at objectives, incidents, client feedback and risks, and decide on improvements (clause 9.3).

Zertify is an online platform. You complete a self-assessment with 30 yes/no questions. The pass threshold is 20 of 30. You do not need an account to buy. SICE reviews every assessment before the certificate is issued. The certificate is issued by G6 Agency AG under licence from SICE, usually within 4 hours after you have passed and paid.

The price is 599 CHF (599 EUR) in the first year, then 399 CHF (399 EUR) per year including the yearly online re-audit. The certificate is valid for 3 years. It is a yearly subscription that renews automatically. You can cancel at any time in your customer account, effective at the end of the current year. The certificate then ends with the paid year. For customers in Switzerland and Liechtenstein, the prices include 8.1% Swiss VAT.

There is no on-site audit. The certificate rests on your online self-assessment and is confirmed every year by a short online re-audit. Every certificate can be verified publicly by number and QR code, so your clients can check it themselves. Some tenders set their own requirements for the certificate. Read the tender text and compare the routes before you decide.

• ISO 9001 certificate
• Prices
• Start the free self-assessment

Before you start, collect what you already have: your process descriptions, release rules, ticket workflow, supplier list and training records. Most IT companies have more of this than they think. The questions are answered with yes or no, so a clear picture of your current practice is the best preparation.

If your clients also ask about information security or service management, you can combine standards. The multi-standard discount is 20% for 2 standards and 30% for 3 or more, and it also applies to the yearly fee.

Read how the process works step by step, or compare the certification routes before you decide.

• How it works
• Compare the certification routes
• Certification without an on-site audit