ISO certification for tenders, contracts and approved supplier lists.

Sometimes, and we tell you accurately at the first call. A single-site organisation implementing one standard typically needs three to six months, because the system has to operate long enough to produce evidence and the certification body needs audit dates. If the tender closes sooner, the requirement matrix shows whether the buyer accepts a certificate by contract start or equivalent evidence, before you commit to the bid.

If the tender asks for an accredited certificate, yes, and a certificate from an unaccredited body will fail the evaluator's check. Before you sign with any certification body we confirm that it is accredited for your standard and scope. Since 1 January 2026 the Global ACI arrangement has replaced the IAF MLA and ILAC MRA,, so older tender wording may merit a clarification question.

The standard and edition the tender names, and a scope that covers the services and sites the contract involves, because an evaluator can read the scope on the certificate and on the body's register. A certificate for your head office alone may not satisfy a contract delivered from another site, and editions expire: ISO 37001:2016 certificates are no longer valid after 28 February 2027. We draft the scope from the tender wording at the first stage.

For many central government contracts, yes. Procurement Policy Note 014 covers procurements started on or after 24 February 2025 by central government departments, their executive agencies, non-departmental public bodies and NHS bodies, where the contract involves citizens' personal information or ICT systems handling OFFICIAL data. Cyber Essentials, or equivalent controls, must be in place when data is passed and renewed annually. Def Stan 05-138 asks Ministry of Defence suppliers for Cyber Essentials or Cyber Essentials Plus by risk level.

CMMC is in Phase 1, which began on 10 November 2025: applicable solicitations can make a Level 1 or Level 2 self-assessment, affirmed in SPRS, a condition of award. On 13 July 2026 the US Department of War suspended Phase 2, which would have added Level 2 certification assessments by an authorised C3PAO. We prepare you for the level your solicitation or your prime contractor names.

It has been tied to their Performance-Based Bonus. The FY 2023 guidelines, AO 25 IATF Memorandum Circular No. 2023-1, made continuing ISO-QMS certification, or equivalent, of at least one critical frontline service or core process an accountability for departments, agencies, state universities and colleges and GOCCs. The FY 2024 circular does not repeat it, so check the current one. The New Government Procurement Act does not mention ISO; for suppliers, the requirement comes from each bid document.

Yes, and it is usually quicker than starting again. Document control, internal audit, management review and corrective action already exist, and ISO management system standards share a common structure, so ISO 14001, ISO 45001 or ISO/IEC 27001 can be built onto the system you run and audited as one integrated programme. Revise™ covers adding standards and extending the scope of the certificate you hold.

We help prepare it, and your organisation submits it. Under Drive™ we draft the answers to the management system questions from the evidence held in Effivity; under Design™ we review the answers your team drafts. Every answer has to be true of your organisation, so we never describe a control you do not operate. The same evidence pack then serves the next tender.

No to both. Sterling provides consulting, software, training and audit readiness; an independent, accredited certification body audits and makes the certification decision, and the buyer makes the award. What we commit to under the Sterling Promise is the certification outcome agreed in your proposal, on time. Your price, your delivery record and your bid decide the contract.