Which ISO certification do I need?
There are dozens of ISO standards. Most businesses only need one or two. Which ones depends on what you want to achieve: demonstrating quality, improving information security, meeting legal requirements or anchoring sustainability. This page helps you choose.
All ISO management system standards follow the same basic structure (the High Level Structure). They are recognised internationally and issued by an accredited certification body, which is supervised by the Dutch Accreditation Council (RvA) . You can buy the standards themselves from NEN , the Dutch standards institute.
Decision table: which standard fits your goal?
Use the table below as a first filter. Find your goal in the left column and check which standard belongs to it.
| Goal | Main standard | Alternative or addition |
|---|---|---|
| Demonstrate that your processes deliver quality | ISO 9001 | None |
| Manage information security | ISO 27001 | NEN 7510 (healthcare) |
| Improve environmental performance | ISO 14001 | ISO 50001 (energy) |
| Occupational health policy and safety on the shop floor | ISO 45001 | VCA (high-risk sectors) |
| Ensure food safety | ISO 22000 | None |
| Medical devices (MDR compliance) | ISO 13485 | None |
| Business continuity after a crisis | ISO 22301 | None |
| Structurally reduce energy consumption | ISO 50001 | CO₂ Performance Ladder |
| Privacy management alongside information security | ISO 27701 | None |
| Manage AI systems responsibly | ISO 42001 | None |
| Demonstrate that you process personal data as a processor | SOC 2 | ISO 27001 |
| Demonstrate CO₂ emissions in a tender | CO₂ Performance Ladder | None |
| Information security across healthcare | NEN 7510 | ISO 27001 |
Many businesses combine ISO 9001 with ISO 14001 or ISO 45001. This saves audit days and documentation, because the standards share the same structure. You can read more about combining standards at the High Level Structure page.
By sector: which standard is common?
Industry & manufacturing
ISO 9001 is the standard for manufacturing companies that want to demonstrate quality. ISO 14001 and ISO 45001 are often added for environment and occupational health. Exporting companies sometimes ask clients specifically for ISO 9001.
Several standards at once: is it worth it?
Yes, if the standards you are considering have overlapping requirements. ISO 9001, ISO 14001 and ISO 45001 share an identical basic structure. You then build one management system, one set of documentation, and have them audited together. That saves 20 to 30 per cent on audit costs.
Are you starting for the first time? Then begin with one standard. Add a second once your first system is stable, usually after the first surveillance audit.
Do not let what clients “seem to ask for” guide your choice. Ask a follow-up question. Sometimes they want proof of a good system, not necessarily a specific certificate. An ISO 9001 certificate can cover that.
All standards at a glance
Quality management. The most widely applied standard worldwide.
ISO 9001Information security. Required in many public sector tenders.
ISO 27001Environmental management. Often combined with ISO 9001 or ISO 45001.
ISO 14001Occupational health and safety. Successor to OHSAS 18001.
ISO 45001Energy management. Relevant to the EED audit obligation.
ISO 50001AI management system. Newest standard (2023).
ISO 42001Medical devices. Alongside the MDR regulation.
ISO 13485Food safety. Basis for FSSC 22000.
ISO 22000Business continuity. For critical services and processes.
ISO 22301Information security in healthcare. Required for healthcare providers.
NEN 7510Safety at high-risk workplaces. Often required in construction.
VCAAmerican attestation for service providers that handle client data.
SOC 2Privacy management, an extension of ISO 27001.
ISO 27701Demonstrating CO₂ reduction in tenders.
CO₂ Performance LadderComparing costs
Do you also want to compare the costs of the standards side by side? The ISO certification costs page lists all standards with an indication for the first year.