ISO 9001 for IT companies
ISO 9001 and IT: it sounds like an awkward combination. Waterfall procedures for agile teams? Thick manuals for developers who work in sprints? It can be different. The standard is available through NEN , and a well-run quality management system fits modern IT organisations well. Certification takes place through an accredited body .
Why ISO 9001 for IT?
The market asks for it
- Enterprise clients: Large companies want certainty about your processes
- Government: Often mandatory in public tenders
- Financial sector: Banks and insurers require it from their suppliers
- International clients: ISO 9001 is known worldwide
It helps your business
- Structure in your processes (without bureaucracy)
- Clear agreements with clients about requirements
- Better insight into project performance
- Demonstrable work on client satisfaction
Which processes do you document for ISO 9001 as an IT company?
Core processes
Software development
For software companies:
| Process | Description |
|---|---|
| Sales & presales | From lead to contract |
| Requirements | Determine wishes and needs |
| Design & architecture | How we are going to build it |
| Development | Coding, sprints, builds |
| Testing | Quality control |
| Deployment | Bringing it to production |
| Maintenance & support | Fixing bugs, updates |
Supporting processes
- HR (recruitment, development, retaining talent)
- Purchasing (hardware, software, subcontractors)
- Infrastructure (servers, network, tooling)
- Administration (invoicing, contract management)
ISO 9001 and agile: they can work together
Many IT companies work in an agile way. The fear is that ISO 9001 makes this impossible. That is not true.
What ISO 9001 asks for
- Define processes: Not how you work, but that you know how you work
- Determine client requirements: Knowing what the client wants
- Check that it works: Measuring and evaluating
- Improve: Learning from what goes wrong
This fits well with agile principles.
How to combine them
| ISO 9001 requirement | Agile approach |
|---|---|
| Describe processes | Describe sprint ceremonies (stand-up, planning, retro) |
| Determine client requirements | User stories, acceptance criteria |
| Control design | Definition of Ready, Definition of Done |
| Testing | Automated testing, code reviews |
| Check release | CI/CD pipeline, release process |
| Improve | Retrospectives, velocity tracking |
The key is to describe how you work in an agile way. Not an ideal picture from a book, but how it really goes. The auditor wants to see that you have a system and that it works.
Examples of agile + ISO 9001
Sprint planning = Requirements review
Your user stories and acceptance criteria are your documented client requirements. Sprint planning is the moment you assess whether you can deliver.
Retrospective = Continuous improvement
The retro is exactly what ISO 9001 means by evaluation and improvement. Document the action points and follow them up.
Definition of Done = Release control
Your DoD describes when something is “done”. That is your check before you deliver.
Code reviews = Quality control
Peer reviews are a recognised way to safeguard quality.
ISO 9001 points of attention for IT companies
1. Requirements management
IT projects often fail because requirements are unclear. ISO 9001 asks you to determine and review client requirements.
In practice:
- Document requirements (user stories, specifications)
- Have the client confirm them (approval, sign-off)
- Manage changes (change requests)
- Trace requirements to the solution (traceability)
2. Configuration management
Software consists of many components that must work together.
What you need to control:
- Version control (Git, SVN)
- Dependency management
- Environment configuration
- Release management
3. Testing
ISO 9001 asks you to check whether output meets requirements.
Types of testing:
- Unit tests
- Integration tests
- System tests
- Acceptance tests (UAT)
- Performance tests
- Security tests
Documentation: Not every test case needs to be documented, but your test strategy and results do.
4. Incidents and bugs
Bugs are nonconformities. ISO 9001 asks you to record, analyse and resolve them.
In practice:
- Ticketing system (Jira, Azure DevOps, etc.)
- Prioritisation (severity, impact)
- Root cause analysis for recurring problems
- Measurement: how many bugs, time to resolution
5. Outsourcing and cloud
IT companies use many external services: cloud providers, SaaS tools, freelancers.
What ISO 9001 asks for:
- Selection criteria (how do you choose a supplier?)
- Agreements (SLAs, contracts)
- Monitoring (do they meet the agreements?)
- Evaluation (periodic assessment)
Examples of quality objectives for IT
| Objective | KPI | Target |
|---|---|---|
| Client satisfaction | NPS or CSAT score | ≥ 40 (NPS) or ≥ 8 (CSAT) |
| Delivery reliability | % of sprints/releases on time | ≥ 90% |
| Defect rate | Bugs per release | Downward trend |
| Uptime | Production availability | ≥ 99.5% |
| Incident response | Time to first response | ≤ 1 hour (critical) |
| Code quality | Test coverage | ≥ 80% |
Which ISO 9001 documentation do you need as an IT company?
Minimum required
- Quality policy: Short and to the point
- Process overview: How you build software or deliver services
- Development process: From idea to production
- Test strategy: How you safeguard quality
- Incident process: How you handle bugs and outages
- Complaints procedure: How you handle client complaints
Where you can keep your ISO 9001 documentation as an IT company
You do not need to create Word documents. Options:
- Confluence/Notion: Many IT companies already use this
- GitHub/GitLab wiki: Close to the code
- Internal docs site: Your own documentation platform
- READMEs: The specific agreements per project or repository
Whatever you choose: make sure it is easy to find and up to date. The auditor wants to see that employees know where to find information.
Combining ISO 9001 and ISO 27001 for IT companies
For IT companies, combining with ISO 27001 (information security) is often logical.
Why combine?
- Clients ask for both (especially enterprise, government and financial)
- Much overlap in structure (both use the High Level Structure, HLS)
- Information security is part of quality
What ISO 27001 adds
- Information Security Management System (ISMS)
- Risk assessment for information security
- 93 security controls (Annex A)
- Attention to confidentiality, integrity and availability
Practical integration
| Aspect | ISO 9001 | ISO 27001 |
|---|---|---|
| Policy | Quality policy | + Information security policy |
| Risks | Quality risks | + Security risks |
| Competence | Subject knowledge | + Security awareness |
| Suppliers | Quality requirements | + Security requirements |
| Incidents | Bugs, complaints | + Security incidents |
Common ISO 9001 nonconformities at IT companies
Minor nonconformities
- Requirements not traced to tests
- Changes not documented (change requests)
- No evaluation of external service providers (cloud, SaaS)
- Test results not recorded
- Client satisfaction not measured
Major nonconformities
- No defined development process
- No internal audits carried out
- No management of the production environment
- No traceability for incidents
Tips from IT companies with ISO 9001
”Start with what you already do”
“We were already working with Jira and Confluence. We only had to describe how we use those tools and why."
"Automate where possible”
“Our CI/CD pipeline is documented as our release process. Automated tests are our quality checks."
"Use the tools you already have”
“We don’t have a separate quality system. Everything is in our normal tools: GitHub for code, Jira for issues, Confluence for docs."
"Make it developer-friendly”
“Developers hate bureaucracy. We set up the system so that it costs minimal extra work.”
What does ISO 9001 cost for an IT company?
Startup (1-10)
Small IT organisation (1-10 employees)
| Cost item | Indication |
|---|---|
| Guidance | €2,000 - €4,000 |
| Certification audit | €1,500 - €2,500 |
| Internal audit | €500 - €1,000 |
| Total first year | €4,000 - €7,500 |
Annual maintenance: €1,500 - €2,500
Frequently asked questions about ISO 9001 for IT
Does ISO 9001 fit our agile way of working?
Yes. ISO 9001 does not prescribe how you work, only that you have a controlled process. Agile ceremonies (planning, stand-up, retro) fit well.
Do we have to document everything?
No. Document what is needed to show that your system works. User stories in Jira count as documentation. Automated tests count as quality control.
Does our whole company have to be certified?
No. You can limit the scope to, for example, your SaaS product or your consultancy services. The scope must be logical, however.
Is ISO 9001 enough, or do we also need ISO 27001?
That depends on your clients. Enterprise clients and government increasingly ask for ISO 27001. If you work with sensitive data, ISO 27001 is sensible.
How long does the process take?
For an average IT company, 3-6 months. You need to be able to show that your system has been working for a while (at least a few sprints or releases).
More information
- ISO 9001 step-by-step plan: From start to certificate
- Costs and timeline: Detailed cost overview
- Combining with other standards: ISO 27001 and more
- ISO 9001 for healthcare institutions: Approach for healthcare
- ISO 9001 for logistics: Transport and warehousing
- ISO 27001: Information security