Platform
Modules
By sector
By sector
By standard
Blog
News
Events
ISO
Quality and security teams running an ISO-based management system, and suppliers whose customers require one.
The ISO standards behind a management system, and how they divide: a few you can be certified against, and many more that are guidance or control sets supporting them. Knowing which is which decides what you can claim.
ISO publishes tens of thousands of standards, and the ones a compliance team meets fall into two groups that are constantly confused. A small number are management system standards: they state requirements, and an accredited certification body can audit you against them and issue a certificate. The rest are guidance, codes of practice or control sets. They are just as useful, and you cannot be certified to them.
Getting this wrong is expensive in a tender. A supplier that writes "ISO 31000 certified" on a bid has told the evaluator something that cannot be true, because ISO 31000 is guidance and has no certification scheme. The same trap catches ISO 27002 and ISO 27005.
ISO 9001 is the quality management system standard, and the one most contracts mean when they ask for "a quality system". It is certifiable, and it is also the foundation the defence world builds on: AQAP 2110 contains its requirements and adds NATO's on top.
One certifiable standard, surrounded by publications that make it workable:
ISO 27017 and ISO 27018 are codes of practice rather than separate certifications. You are certified against ISO 27001; those two extend the control set and can be brought inside that certificate's scope.
ISO 31000 is the international guidance for managing risk of any kind, and it is deliberately not certifiable. Its value is a common vocabulary and a defensible process, which is what an auditor is looking for when they ask how you decided something was acceptable.
If you supply defence, ISO 9001 is rarely the whole ask. The AQAP publications build on it: AQAP 2110 contains the ISO 9001 requirements and adds configuration management, government quality assurance and contract risk, while AQAP 2310 does the same with EN 9100. So an ISO 9001 system is the foundation you would build either way, and the defence work is the delta on top.
ComplyTrain is not limited to the standards written up on this site. The product is built around a requirement tree, and a requirement tree can be built for any standard, agreement or contractual specification that has requirements in it - ISO 13485, ISO 14001, ISO 45001, IEC 62443, EN 9100 and the rest included. The pages here are what we have documented so far, not the boundary of what the system handles.
We add standards on request, and the list grows steadily. If the standard your customer or contract requires is not here, tell us which one you need and we will tell you what supporting it in your workspace involves.
Most teams end up holding more than one of these at once - a quality system, a security system and a risk framework - and the overlap between them is where the duplicated effort lives:
Because the requirement tree is the product's core rather than a per-standard feature, a standard we have not written a page for is a content job, not an engineering one. Ask, and it can be added.
ComplyTrain holds no ISO certification of its own and does not claim one. It is the system you build and run your own management system in, and where the evidence for your certificate lives.
Tell us how you need to work with ISO and what you need from it. We will come back to you about what ComplyTrain can do.
Thank you. Your list is on its way to your inbox, and we will come back to you on what working with these standards in ComplyTrain involves, usually within one business day.
Of the ones covered here, ISO 9001 and ISO 27001. They state requirements, and an accredited certification body audits you against them. ISO 27002, ISO 27005, ISO 27017, ISO 27018 and ISO 31000 are guidance, codes of practice or control sets: they support a certification without being one. Claiming certification to any of those on a bid is a claim an evaluator can disprove.
Not as standalone certificates. They are codes of practice that extend the ISO 27002 control set for cloud services and for personal data in the cloud. The certificate you hold is ISO 27001, and those controls can be brought inside its scope.
No, and deliberately so. ISO 31000 is guidance for managing risk, not a set of auditable requirements. What it gives you is a common vocabulary and a defensible process - which is what an auditor is really asking for when they want to know how you concluded a risk was acceptable.
AQAP 2110 contains the requirements of ISO 9001 and adds NATO's on top: configuration management, government quality assurance, risk to contract performance and the customer's right of access. So an ISO 9001 system is the foundation, and the AQAP work is the delta. AQAP 2310 does the same thing with EN 9100 for aviation and space.
Yes. The pages on this site are the standards documented so far, not the limit of what the product handles - ComplyTrain is built around a requirement tree, and one can be built for any standard with requirements in it, ISO 13485, ISO 14001, ISO 45001 and IEC 62443 included. We add standards on request. Tell us which one you need and we will explain what supporting it in your workspace involves.
Implementation
The overlap between a quality system, a security system and a risk framework is where most of the duplicated effort hides.
Know which of your standards can carry a certificate and which cannot. It decides what you may write on a bid, and what an auditor will actually ask to see.
Not as a manual. A tracked set is countable, and gaps are visible before somebody else finds them.
Access control, supplier assessment and competence records appear in more than one standard. Traced properly, the same record satisfies each without being rewritten.
A consistent, calibrated scale with the reasoning recorded is what ISO 31000 describes and what ISO 27001 clause 6.1 expects to see.
A standard usually arrives as a contract condition rather than a project anyone planned for, and often at a company with no quality manager. Software is half the answer. Skylen's consultants are the other half, and because they build on ComplyTrain from day one you keep a live system your team owns rather than a binder and a departed consultant.
A clause-by-clause read of where you stand against the standard your contract cites, turned into a prioritised plan you could act on with us or alone.
What an assessment coversOur consultants build the system with your team - procedures, document control, the records you need to keep and the review cadence - and prepare you for the certification audit.
How an engagement worksWe run and maintain the quality system for you, so a small team can reach and hold a standard without hiring a quality manager.
What full-service meansThe primary sources behind this page. Where a standard is quoted here, the publisher's own page is the authority.
One system for the whole compliance programme. Start with the module you need most.
Collect information the same way every time, and decide in advance what happens next.
Know whether your controls are operating, not just whether a policy says they exist.
Turn the compliance work you already know about into a plan with owners, dependencies and dates.
Know what you can offer, and hold the evidence behind every configuration you offer it in.
Eight built-in reports across every module, scheduled, delivered, and filed where the evidence lives.
The sector news that matters to your organisation - read and rated by AI, and delivered as a scheduled digest in your own language.
AI reads the tender pack and pulls out the requirements, deadlines and rules - then helps you draft the response from your own approved content, with you reviewing every step.
One current register of the suppliers and partners you depend on - each risk-assessed, re-assessing itself on schedule, and wired straight into your risk register.
See every requirement you face - across every standard, plus your own contracts and policies - traced to the documents, evidence and processes that satisfy it.
Identify, score, treat and review your risks in one place - with AI to help anyone run a proper assessment, and a defensible trail behind every decision.
Assign training, prove it was understood, and hold the competence records an auditor asks for.
Draft compliance documents with AI, keep every version under control, and export them beautifully branded - all in one place.
Audits, corrective actions, processes and approvals in one quality system, organised around ISO 9001.
A 90-day plan for the smallest defence suppliers: let the tender set your scope, document what you already do, fix the security basics primes check, and keep the system small enough for two people to maintain.
Learn how to qualify, approve and monitor sub-suppliers, flow down requirements through purchase orders, and keep the records an auditor will ask to see under ISO 9001 clause 8.4 and AQAP.
Learn how to run an ISO 9001 Clause 9.3 management review that turns evidence into decisions, with the right inputs, actionable outputs, and a cadence that fits your risks.