ISO 9001 for US Government and Defense Suppliers

• Done for you, end to end

  We write the policies, set up the controls and evidence, run the internal audit and coordinate the independent audit. You deal with one team from first call to final report.

• Simple and quick

  A free gap assessment, then one plan with dates from day one. Effivity, our GRC automation platform, is included to keep the evidence moving.

• 8,100+ client engagements

  In 60+ countries over 20+ years, with experts who bring 30+ years of experience.

• Under US$10,000, all-inclusive

  For most start-ups and SMEs: SOC 2, ISO 27001, ISO 42001, HIPAA or ISO 9001, including the independent audit. A fixed quote follows a free gap assessment.

Quick, done for you, with a 100% success and on-time completion record across 8,100+ client engagements in 60+ countries over 20+ years. We run the free gap assessment against ISO 9001 and the quality clauses in the solicitation or flow-down you hold. Then we build the system around your operation, train your people, run the internal audit and take you through the certification body's audit, from choosing an accredited body to closing findings. You deal with Sterling throughout; the consultants who build your system never audit it. If CMMC is on your horizon, say so at the first call: we keep the evidence streams separate and state clearly which requirements the quality work does not meet.

Every Sterling consulting engagement comes with the following, so you are not buying extras to get to the finish line:

• Effivity, Sterling's GRC automation platform, with a full-year subscription, to run your controls, evidence, tasks and audits in one place.
• Sterling Academy: preferential course access, with complimentary awareness training for your people.
• Internal auditor training for your audit team, as applicable to your standard.
• For information-security engagements, a vulnerability assessment.

These are part of the engagement, not a separate purchase. The details depend on the standard you are working toward, which we confirm during the free gap assessment.

Consulting and auditing are always separated: the people who consult never audit you. That keeps your internal audit objective and protects the independence of the CPA firm, Qualified Security Assessor or certification body that performs the final step.

Behind this are 8,100+ client engagements in 60+ countries over 20+ years, led by experts with 30+ years of experience.

What the fee covers, and what it doesn't:

• It is the fee for your first SOC 2 report or your first certification only.
• Annual work is always additional and billed the following year: later SOC 2 report periods, and ISO surveillance and recertification audits.
• It assumes a typical start-up or SME scope: one product or service and one main location.
• Larger or multi-site scopes get a fixed quote after the gap assessment.
• PCI DSS is quoted separately: a fixed quote follows a free gap assessment.

^[1] Occupational Employment and Wage Statistics, May 2025: 15-1212 Information Security Analysts, national annual median wage. US Bureau of Labor Statistics. accessed October 23, 2026.

The outcome. You answer the right request with the right evidence, and a federal bid or a prime's supplier approval is not lost to a mix-up.

Suppliers to the Department of Defense and other US federal buyers hear two requests that sound alike:

• Quality. Can you deliver what the contract specifies, every time? ISO 9001 answers this.
• Cybersecurity. Can you protect the government information you hold while doing it? The Cybersecurity Maturity Model Certification program, CMMC, answers this.

A shop that spends a year on a quality certificate believing it covers a cybersecurity clause finds out at the worst moment, when a prime's flow-down calls for evidence the quality system never produced. CMMC appears here as context only; it has its own rule, assessors and timeline.

The outcome. You know exactly which clause puts ISO 9001 in front of you, and whether a certificate is what it requires.

• The FAR trigger. Agencies must set procedures for deciding when higher-level contract quality requirements are needed. Requiring them is necessary for complex or critical items, or when the technical requirements call for control of design, work operations, in-process controls, testing and inspection, or attention to organization, planning, work instructions and documentation control^[1].
• ISO 9001 by name. The same section lists examples of higher-level quality standards: ISO 9001, ASQ/ANSI E4, ASME NQA-1, SAE AS9100, SAE AS9003, ISO/TS 16949 and the product-specific SAE AS5553^[1].
• Flow-down to small suppliers. Under the standard clause, the contractor must comply with the standards the contracting officer lists and pass them to lower-tier suppliers for critical and complex items, or where the technical requirements need that control^[2]. That is how ISO 9001 reaches a small manufacturer that never bids as a prime.

The regulation does not say every contract must name a standard, or that a certificate is the only proof. The solicitation governs, so read its quality clause first.

CMMC is the Department of Defense's program for verifying that contractors and suppliers protect Federal Contract Information and Controlled Unclassified Information. Its rule, 32 CFR Part 170, sets requirements for defense contractors and their lower-tier suppliers to meet prescribed cybersecurity standards for that information, and for assessing compliance^[3]. It applies to DoD awardees and lower-tier suppliers that will process, store or transmit such information on contractor systems, and DoD is bringing it into solicitations in phases^[4].

• Level 1. The basic safeguarding requirements of the Federal Acquisition Regulation^[5].
• Level 2. The security requirements of NIST SP 800-171 Revision 2^[5].
• Level 3. Adds selected requirements from NIST SP 800-172^[5].

Requirements flow down to every tier that will handle the information, at a level set by the information type and the prime contract^[7]. Your contracting officer or prime confirms whether, and at what level, CMMC applies to you.

A summary, not legal advice; the solicitation always governs.

The CMMC rule sets out what its levels contain, and quality management is not among them^[5]. Its standards-acceptance provision recognizes certain completed DoD assessments, so work is not duplicated, and says nothing about quality management certificates^[6]. Run two tracks with two sets of evidence.

A working quality system still gives you a head start. Document control, internal audits, corrective action, supplier evaluation, training records and management review are habits cybersecurity assessments reward. That is Sterling's observation about shared discipline, not a claim that either program accepts the other. If your contract involves controlled information, scope CMMC first, because contract eligibility turns on it.

The outcome. A certificate whose issuer and scope stand up to a prime's supplier-quality team.

• Issuer. An accredited certification body certifies and its name is on the certificate. Sterling never certifies. Ask the buyer whether it names an accreditation requirement, and choose a body that meets it before you sign.
• Scope. The scope statement must cover the products, processes and locations you actually sell to government customers. A certificate for your commercial line will not reassure a defense prime buying from a different plant.

Beyond the standard's general requirements, Sterling focuses on what primes look for:

• Contract requirements. Specifications, drawings, delivery rules and records-retention duties must flow from the order into the shop floor or delivery team.
• Changes and nonconforming output. Deviations, concessions and corrective actions handled clearly, with records.
• Supplier management. Approval and monitoring of suppliers whose materials or services go into government work.
• Measurement and calibration. Calibration records wherever product acceptance relies on instruments.
• Document and record control. The right revision for a given order, retrievable years later.
• A sector standard ahead. If customers will later name an industry standard such as AS9100, build with it in view; that standard's own text confirms how it relates to ISO 9001.

For most start-ups and SMEs, Sterling's all-inclusive fee for a first ISO 9001 certification is under US$10,000, covering our done-for-you consulting and the certification audit by an accredited certification body. Conditions and inclusions are in the pricing note on this page; a fixed quote follows a free gap assessment.

What can move a scope outside that range: several sites or lines, a larger headcount, design and development responsibility, and records that must be built from scratch. Surveillance and recertification audits are billed in later years. See the ISO 9001 cost guide.

This is Sterling's recommendation, not a government or ISO requirement. 1. Read the quality clause and any flow-down in your contract or bid before choosing a standard. 2. Pursue ISO 9001 when the buyer names it or its supplier-quality team requires it, with an accredited certification body that satisfies them. 3. Run CMMC as a separate project scoped from the information you hold, and start it first if you handle controlled information. 4. Keep the scope statement accurate and matched to the work you sell to government customers. 5. Use one document control and corrective action process for both tracks, sharing infrastructure, never claims. 6. See the ISO 9001 hub, the CMMC hub and our page for manufacturing and supply chain companies.

Bidding on a federal contract or answering a prime's supplier survey? Get a proposal sized to your plant and your contract.

ISO management system standards such as ISO/IEC 27001, ISO/IEC 42001 and ISO 9001 are certified by an accredited certification body, not by a consultant^[1]. Sterling never certifies. The certificate carries the name of the body that issued it, and that independence is what makes it credible to your buyers.

What Sterling does is prepare your company so that the certification body's audit goes smoothly. We coordinate:

• a gap assessment against the standard;
• the management system itself: scope, risk assessment, policies, procedures and records, sized for your company;
• training for your people and an internal audit before the certification audit;
• management review and corrective actions;
• the certification audit process, from choosing an accredited body to closing any findings.

Consulting and auditing are always separated. The people who consult never audit you, so the internal audit is a genuine test and the certification body's audit is independent.

Sterling has completed 8,100+ client engagements in 60+ countries over 20+ years, and our experts bring 30+ years of experience.

^[1] About the IAF MLA (multilateral recognition arrangement). International Accreditation Forum (functions transferred to Global Accreditation Cooperation Inc., 1 Jan 2026). accessed October 23, 2026.

• ISO 9001: standard overviewStandard overview
• CMMC: standard overviewStandard overview
• Meet US Contract, MSA and RFP Compliance Clauses FastUnited States
• ISO 9001 Cost for US Companies: What You Pay and WhyUnited States
• ISO 9001 for US Manufacturers and Suppliers: What OEMs and Contracts RequireUnited States
• Sterling in the United StatesUnited States

1. 48 CFR 46.202-4 Higher-level contract quality requirements. Electronic Code of Federal Regulations (eCFR). accessed October 26, 2026.

2. 48 CFR 52.246-11 Higher-Level Contract Quality Requirement. Electronic Code of Federal Regulations (eCFR). accessed October 23, 2026.

3. 32 CFR 170.1 Purpose (CMMC Program). Electronic Code of Federal Regulations (eCFR). accessed October 23, 2026.

4. 32 CFR 170.3 Applicability. Electronic Code of Federal Regulations (eCFR). accessed October 23, 2026.

5. 32 CFR 170.14 CMMC Model. Electronic Code of Federal Regulations (eCFR). accessed October 23, 2026.

6. 32 CFR 170.20 Standards acceptance. Electronic Code of Federal Regulations (eCFR). accessed October 23, 2026.

7. 32 CFR 170.23 Application to subcontractors. Electronic Code of Federal Regulations (eCFR). accessed October 23, 2026.

The information on this page is provided for general informational purposes only. It is not legal advice, and it is not a substitute for advice from a qualified attorney about your own situation.

Requirements depend on your scope, your customers' contracts, your industry and the regulations that apply to you. Two companies asking for the same standard can have very different obligations. We confirm yours during a gap assessment, and we update our content as standards change, but you should check the current text of any standard or rule that matters to you.

Sterling consults and prepares. It does not decide whether you meet a standard. That decision belongs to the independent party that performs the final step: the US-licensed CPA firm for a SOC 2 report, the Qualified Security Assessor or acquirer for PCI DSS, and the accredited certification body for ISO certificates. Timelines and outcomes depend on your readiness and on those parties.

Standards and marks named on this site belong to their respective owners.