ISO/IEC 27001 for US Manufacturers and Suppliers: What OEMs Require

• Done for you, end to end

  We write the policies, set up the controls and evidence, run the internal audit and coordinate the independent audit. You deal with one team from first call to final report.

• Simple and quick

  A free gap assessment, then one plan with dates from day one. Effivity, our GRC automation platform, is included to keep the evidence moving.

• 8,100+ client engagements

  In 60+ countries over 20+ years, with experts who bring 30+ years of experience.

• Under US$10,000, all-inclusive

  For most start-ups and SMEs: SOC 2, ISO 27001, ISO 42001, HIPAA or ISO 9001, including the independent audit. A fixed quote follows a free gap assessment.

Every Sterling consulting engagement comes with the following, so you are not buying extras to get to the finish line:

• Effivity, Sterling's GRC automation platform, with a full-year subscription, to run your controls, evidence, tasks and audits in one place.
• Sterling Academy: preferential course access, with complimentary awareness training for your people.
• Internal auditor training for your audit team, as applicable to your standard.
• For information-security engagements, a vulnerability assessment.

These are part of the engagement, not a separate purchase. The details depend on the standard you are working toward, which we confirm during the free gap assessment.

Consulting and auditing are always separated: the people who consult never audit you. That keeps your internal audit objective and protects the independence of the CPA firm, Qualified Security Assessor or certification body that performs the final step.

Behind this are 8,100+ client engagements in 60+ countries over 20+ years, led by experts with 30+ years of experience.

What the fee covers, and what it doesn't:

• It is the fee for your first SOC 2 report or your first certification only.
• Annual work is always additional and billed the following year: later SOC 2 report periods, and ISO surveillance and recertification audits.
• It assumes a typical start-up or SME scope: one product or service and one main location.
• Larger or multi-site scopes get a fixed quote after the gap assessment.
• PCI DSS is quoted separately: a fixed quote follows a free gap assessment.

^[1] Occupational Employment and Wage Statistics, May 2025: 15-1212 Information Security Analysts, national annual median wage. US Bureau of Labor Statistics. accessed October 23, 2026.

The outcome: a certificate from an accredited certification body that lets you answer an OEM's security questionnaire by reference and keeps you on the approved-supplier list. We do the preparation; the accredited body audits you and decides on the certificate.

A US contract manufacturer holds its customers' drawings, models, bills of materials and release schedules, and one ransomware event at a mid-size supplier can halt shipments to several OEMs at once. That is why US purchasing teams now screen suppliers on information security as well as quality.

• US OEMs and tier-one buyers. In Sterling's experience, supplier-risk questionnaires and master supply agreements increasingly require a recognized security management system or an independent assessment.
• US supply chain risk programs. NIST's Cybersecurity Framework 2.0, published February 26, 2024, places cybersecurity supply chain risk management inside its Govern function^[2]. Buyers who adopt it carry those questions down to their suppliers.
• Overseas customers of US plants. In Sterling's experience, European and Asian buyers list ISO 27001 in supplier requirements, which matters for any US plant that exports.

The outcome: you know which requirement applies to which contract, and nothing is double-built.

The CMMC Program's requirements apply to awardees of DoD contracts, and of lower-tier contracts beneath them, that will process, store or transmit Federal Contract Information or Controlled Unclassified Information on contractor information systems, and DoD is bringing them into solicitations and contracts in four phases^[3]. CMMC is its own program with its own assessments. ISO/IEC 27001 does not replace it, and our CMMC hub covers that work.

Where a plant serves both defense and commercial customers, Sterling's recommendation is one information security management system whose risk assessment, asset lists, access rules and records serve both sets of buyers.

The outcome: a scope your buyers' supplier-risk teams can match to the parts they buy from you.

• Option 1: business systems first. Engineering and quoting, ERP and quality systems, procurement, finance, HR, e-mail, file shares and supplier portals, with a documented boundary around the plant network.
• Option 2: plant included. Adds engineering workstations that program machines, production networks and vendor remote access to equipment.

What we recommend for most mid-size US manufacturers (Sterling's recommendation): certify the business systems and customer-data handling first, then widen scope at a later audit once plant controls are ready. For logistics and 3PL firms, warehouse and transport management systems, tracking and customer EDI links take the place of production systems.

The outcome: the risks your customers worry about most are visible, owned and evidenced. These are Sterling's own descriptions, not the standard's control list.

1. Customer IP. Drawings and models classified, access limited to the engineers who need them, controlled sharing with sub-tier suppliers. 2. Network separation. Office, plant and guest or contractor networks kept apart, so malware in one area stops there. 3. Vendor remote access. Each machine-builder or integrator session approved, time-limited, logged and individually authenticated. 4. Legacy equipment. Where a controller cannot be patched, isolation and monitoring recorded as a deliberate decision. 5. Recovery against production. A tested restore showing how fast scheduling, shipping and quality release resume. 6. People. Phishing and invoice-fraud training for office, seasonal and agency staff alike.

The outcome: we remove these delays before the audit.

• Security left to IT alone. Plant, engineering, quality and purchasing own much of the risk.
• A fuzzy plant boundary. Scope it or draw a clear line; an ambiguous edge draws findings.
• Flat networks. Segmentation needs planned downtime windows, so it starts early.
• Open vendor sessions. Shared or always-on remote logins are a common finding.
• Backups never restored. A documented restore test, not an assumption.
• Treating ISO 9001 as enough. Document control and corrective action carry over, but security needs its own risk assessment and records. Our ISO 9001 page for manufacturers covers the shared parts.

The outcome: a certificate on schedule, planned around your production calendar and shutdowns, with the work done for you. Sterling's record is 100% success and on-time completion across 8,100+ client engagements in 60+ countries over 20+ years, led by experts with 30+ years of experience. The people who consult never audit you, and Sterling does not certify.

1. Free gap assessment. We review sites, systems and customer requirements, propose a scope and rank the gaps. 2. Design. We write the risk method, Statement of Applicability, policies and procedures for how your plants and offices run. 3. Evidence. Your team runs the system until real records exist; Effivity, our GRC automation platform, holds them. The included vulnerability assessment shows technical exposure early. 4. Internal audit and management review. We test first and close findings. 5. Certification body audit. We coordinate the audit with the accredited body you choose and support you to the decision.

Ready to answer your next OEM questionnaire with a certificate? Use Get started and a Sterling expert will reply.

ISO management system standards such as ISO/IEC 27001, ISO/IEC 42001 and ISO 9001 are certified by an accredited certification body, not by a consultant^[1]. Sterling never certifies. The certificate carries the name of the body that issued it, and that independence is what makes it credible to your buyers.

What Sterling does is prepare your company so that the certification body's audit goes smoothly. We coordinate:

• a gap assessment against the standard;
• the management system itself: scope, risk assessment, policies, procedures and records, sized for your company;
• training for your people and an internal audit before the certification audit;
• management review and corrective actions;
• the certification audit process, from choosing an accredited body to closing any findings.

Consulting and auditing are always separated. The people who consult never audit you, so the internal audit is a genuine test and the certification body's audit is independent.

Sterling has completed 8,100+ client engagements in 60+ countries over 20+ years, and our experts bring 30+ years of experience.

^[1] About the IAF MLA (multilateral recognition arrangement). International Accreditation Forum (functions transferred to Global Accreditation Cooperation Inc., 1 Jan 2026). accessed October 23, 2026.

• ISO/IEC 27001: standard overviewStandard overview
• CMMC: standard overviewStandard overview
• Meet US Contract, MSA and RFP Compliance Clauses FastUnited States
• ISO 27001 Timeline for US Companies: How Long Certification TakesUnited States
• How US Start-ups Answer Security Questionnaires FastUnited States
• ISO 9001 for US Manufacturers and Suppliers: What OEMs and Contracts RequireUnited States
• Sterling in the United StatesUnited States

1. ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection, Information security management systems, Requirements. ISO. accessed October 23, 2026.

2. The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (February 26, 2024). NIST. accessed October 26, 2026.

3. 32 CFR 170.3 Applicability (CMMC Program). eCFR (Office of the Federal Register). accessed October 26, 2026.

The information on this page is provided for general informational purposes only. It is not legal advice, and it is not a substitute for advice from a qualified attorney about your own situation.

Requirements depend on your scope, your customers' contracts, your industry and the regulations that apply to you. Two companies asking for the same standard can have very different obligations. We confirm yours during a gap assessment, and we update our content as standards change, but you should check the current text of any standard or rule that matters to you.

Sterling consults and prepares. It does not decide whether you meet a standard. That decision belongs to the independent party that performs the final step: the US-licensed CPA firm for a SOC 2 report, the Qualified Security Assessor or acquirer for PCI DSS, and the accredited certification body for ISO certificates. Timelines and outcomes depend on your readiness and on those parties.

Standards and marks named on this site belong to their respective owners.