United States · Manufacturing and supply chain
ISO 9001 for US Manufacturers and Suppliers: What OEMs and Contracts Require
Why US OEMs, federal contracts (FAR 46.202-4) and RFPs require ISO 9001 from suppliers, and how we take you to certification on schedule.
Did you know ISO 9001 can cost less than US$10,000, all-inclusive? If you've been quoted more, talk to us before you sign.
100% success, on time: the Sterling Promise
We stay with you until your agreed outcome is achieved, through consulting, audit preparation and the resolution of audit findings. The engagement defines the standard, scope, outcome and responsibilities; your organization puts the agreed controls into use; an accredited certification body issues the certificate, and that decision stays independent.
Done for you, end to end
We write the policies, set up the controls and evidence, run the internal audit and coordinate the independent audit. You deal with one team from first call to final report.
Simple and quick
A free gap assessment, then one plan with dates from day one. Effivity, our GRC automation platform, is included to keep the evidence moving.
8,100+ client engagements
In 60+ countries over 20+ years, with experts who bring 30+ years of experience.
Under US$10,000, all-inclusive
For most start-ups and SMEs: SOC 2, ISO 27001, ISO 42001, HIPAA or ISO 9001, including the independent audit. A fixed quote follows a free gap assessment.
Included in every engagement
Every Sterling consulting engagement comes with the following, so you are not buying extras to get to the finish line:
- Effivity, Sterling's GRC automation platform, with a full-year subscription, to run your controls, evidence, tasks and audits in one place.
- Sterling Academy: preferential course access, with complimentary awareness training for your people.
- Internal auditor training for your audit team, as applicable to your standard.
- For information-security engagements, a vulnerability assessment.
These are part of the engagement, not a separate purchase. The details depend on the standard you are working toward, which we confirm during the free gap assessment.
Consulting and auditing are always separated: the people who consult never audit you. That keeps your internal audit objective and protects the independence of the CPA firm, Qualified Security Assessor or certification body that performs the final step.
Behind this are 8,100+ client engagements in 60+ countries over 20+ years, led by experts with 30+ years of experience.
All-inclusive pricing for start-ups and SMEs
Did you know SOC 2 or ISO 27001 can cost less than US$10,000, all-inclusive? If you've been quoted more, talk to us before you sign.
Sterling's all-inclusive fee for SOC 2, ISO 27001, ISO 42001, HIPAA or ISO 9001 is under US$10,000 for most start-ups and SMEs. It covers our done-for-you consulting and the independent audit: the SOC 2 report from a US-licensed CPA firm, as AICPA standards require, or the certification audit by an accredited certification body. For HIPAA, it covers HIPAA compliance consulting and an independent HIPAA assessment. Effivity, training and a vulnerability assessment are included. That's less than a month's cost of an in-house security hire: the US Bureau of Labor Statistics puts the national median annual wage for information security analysts at $129,180 (May 2025), about $10,765 a month in pay alone[1].
A fixed quote follows a free gap assessment.
What the fee covers, and what it doesn't:
- It is the fee for your first SOC 2 report or your first certification only.
- Annual work is always additional and billed the following year: later SOC 2 report periods, and ISO surveillance and recertification audits.
- It assumes a typical start-up or SME scope: one product or service and one main location.
- Larger or multi-site scopes get a fixed quote after the gap assessment.
- PCI DSS is quoted separately: a fixed quote follows a free gap assessment.
[1] Occupational Employment and Wage Statistics, May 2025: 15-1212 Information Security Analysts, national annual median wage. US Bureau of Labor Statistics. accessed October 23, 2026.
Why US OEMs, federal buyers and RFPs require ISO 9001
The outcome: a certificate from an accredited certification body that clears supplier approval, scores in the bid and moves you from trial lots to production volume. We do the preparation; the accredited body audits you and decides on the certificate.
For a US buyer who cannot visit every plant, an independent quality management certificate is the quickest proof that you control what you make. Four US situations bring the request.
- US OEM supplier approval. In Sterling's experience, a quality system certificate is often a gate before a first purchase order, written into the OEM's supplier manual.
- Federal contracts. The Federal Acquisition Regulation requires higher-level quality standards in solicitations and contracts for complex or critical items, and names ISO 9001 among its examples[2].
- Flow-down from a prime. Under the matching FAR clause, the contractor must comply with the listed standard and pass applicable requirements down to lower-tier contracts for critical and complex items[3].
- US RFPs and distribution contracts. In Sterling's experience, bids and 3PL agreements use a quality certificate as a pass-fail screen before price is scored.
What US federal contracts say about quality standards
The outcome: you know whether a contract carries a quality clause, and your system meets it on day one.
- When it applies. FAR 46.202-4 requires agencies to set procedures for deciding when higher-level contract quality requirements are needed, and makes them necessary for complex or critical items or where the work calls for control of design, work operations, in-process controls, testing and inspection[2].
- Which standards. The examples it lists include ISO 9001, ASQ/ANSI E4, ASME NQA-1, SAE AS9100, SAE AS9003 and ISO/TS 16949[2]. The contracting officer inserts the title, number and date of the standard into the clause[3].
- Down the chain. The clause at FAR 52.246-11 carries the requirement to lower-tier contracts where items are critical or complex[3].
Defense work adds the CMMC Program for contractors that handle Federal Contract Information or Controlled Unclassified Information on their systems[4]. That is cybersecurity, not quality; our CMMC hub covers it.
What a US manufacturer's certificate should cover
The outcome: a scope your customer's approved-supplier team can match line for line to the parts on its purchase order.
- Contract review. Drawings, specifications and PO terms checked before you accept, with revisions caught.
- Purchasing and outside processes. Plating, heat treatment and machining vendors approved and monitored.
- Production and inspection. Every line and shift, with calibrated gauges and traceability.
- Shipping and after-sales. Packing, delivery, customer property, complaints and returns.
- Sites. Each plant and warehouse your bids cover.
Build-to-print? Where your customer owns the design, design and development may not apply; we document the justification. For 3PL and distribution firms, receiving, storage, pick accuracy and transport replace production.
Where US manufacturers lose time
The outcome: we close these gaps before the certification body audit.
- A binder the floor never uses. Auditors ask operators to show how they work.
- OEM supplier manuals ignored. Customer-specific requirements, such as change approvals and reporting formats, sit on top of the standard.
- Unapproved outside processors. Coating or heat treatment from an unvetted vendor undermines the certificate.
- Expired gauges. Calibration records with gaps are an easy finding.
- "Retrained the operator." Corrective action needs a root cause and a check that it worked.
- Management reviews with no data. Scrap, returns and on-time delivery figures belong on the agenda.
- One site certified, three bid. Match the scope to the RFP from the start.
- Working forward from today. When a tender sets a certificate deadline, plan backward from that date; our contracts and RFPs page shows the sequence.
- Certification as a finish line. Surveillance audits follow, so records must stay current between visits.
How we take US manufacturers to certification
The outcome: a certificate in time for the bid or supplier audit, planned around your production calendar, with the work done for you. Sterling's record is 100% success and on-time completion across 8,100+ client engagements in 60+ countries over 20+ years, led by experts with 30+ years of experience. The people who consult never audit you, and Sterling does not certify.
1. Free gap assessment. We compare your processes, customer requirements and records with the standard and propose a scope. 2. Design. We write procedures, work instructions and forms from the way you already build and ship. 3. Records. Your teams run the system until inspection results, calibration logs, supplier evaluations and corrective actions exist. Effivity, our GRC automation platform, holds them. 4. Internal audit and management review. We test the system first; internal auditor training lets your own team carry it on. 5. Certification body audit. We coordinate the audit with the accredited body you choose and support you to the decision.
Facing a supplier audit or bid deadline? Choose Get a proposal and a Sterling expert will reply with a dated plan.
How Sterling delivers ISO certification
ISO management system standards such as ISO/IEC 27001, ISO/IEC 42001 and ISO 9001 are certified by an accredited certification body, not by a consultant[1]. Sterling never certifies. The certificate carries the name of the body that issued it, and that independence is what makes it credible to your buyers.
What Sterling does is prepare your company so that the certification body's audit goes smoothly. We coordinate:
- a gap assessment against the standard;
- the management system itself: scope, risk assessment, policies, procedures and records, sized for your company;
- training for your people and an internal audit before the certification audit;
- management review and corrective actions;
- the certification audit process, from choosing an accredited body to closing any findings.
Consulting and auditing are always separated. The people who consult never audit you, so the internal audit is a genuine test and the certification body's audit is independent.
Sterling has completed 8,100+ client engagements in 60+ countries over 20+ years, and our experts bring 30+ years of experience.
[1] About the IAF MLA (multilateral recognition arrangement). International Accreditation Forum (functions transferred to Global Accreditation Cooperation Inc., 1 Jan 2026). accessed October 23, 2026.
Sources
1. ISO 9001, Quality management systems, Requirements. ISO. accessed October 23, 2026.
2. 48 CFR 46.202-4 Higher-level contract quality requirements (FAR). eCFR (Office of the Federal Register). accessed October 26, 2026.
3. 48 CFR 52.246-11 Higher-Level Contract Quality Requirement (DEC 2014) (FAR clause). eCFR (Office of the Federal Register). accessed October 26, 2026.
4. 32 CFR 170.3 Applicability (CMMC Program). eCFR (Office of the Federal Register). accessed October 26, 2026.
Information only
The information on this page is provided for general informational purposes only. It is not legal advice, and it is not a substitute for advice from a qualified attorney about your own situation.
Requirements depend on your scope, your customers' contracts, your industry and the regulations that apply to you. Two companies asking for the same standard can have very different obligations. We confirm yours during a gap assessment, and we update our content as standards change, but you should check the current text of any standard or rule that matters to you.
Sterling consults and prepares. It does not decide whether you meet a standard. That decision belongs to the independent party that performs the final step: the US-licensed CPA firm for a SOC 2 report, the Qualified Security Assessor or acquirer for PCI DSS, and the accredited certification body for ISO certificates. Timelines and outcomes depend on your readiness and on those parties.
Standards and marks named on this site belong to their respective owners.
FAQs
Frequently asked questions
What is ISO 9001?
ISO 9001 is titled Quality management systems, Requirements[1]. It does not certify that your product is good; it shows you run a controlled system for making it consistently: you understand what the customer ordered, plan the work, check the result and fix causes rather than symptoms. Sterling's plain-English descriptions of the standard are ours; the standard's text is the reference.
Is ISO 9001 required to sell to OEMs or the US government?
No law requires it of suppliers in general. It becomes a requirement when an OEM's supplier manual, an RFP or a contract names it. In federal contracts, the FAR quality clause obliges the contractor to comply with whichever higher-level standard the contracting officer lists, and ISO 9001 is one of the examples[2][3]. Read each contract's wording.
How is ISO 9001 different from CMMC?
They cover different things. ISO 9001 is a quality management standard[1]. CMMC is a DoD cybersecurity program that applies to contractors handling Federal Contract Information or Controlled Unclassified Information on their information systems[4]. Holding one does not satisfy the other; our CMMC hub covers the second.
Who issues the ISO 9001 certificate?
An accredited certification body audits your quality management system and decides whether to issue the certificate. Sterling does not certify and does not conduct the certification audit. We prepare you, run the internal audit beforehand and coordinate the external audit with the body you select.
Can we certify more than one plant?
Yes. Scope can cover one site or several, and the certification body decides how to sample them. The cleanest route is one system all plants follow, with local work instructions where processes differ. We settle this at the gap assessment. Multi-site sampling and travel are factors in the certification body's audit days.
How long does it take?
It depends on the number of sites, how much is already documented and how long the system runs before the audit to produce records. You receive a dated plan after the free gap assessment, and our guide for government and defense suppliers explains how bid deadlines shape the order of work.
What happens after the first certificate?
The certification body returns for surveillance audits, so internal audits, management reviews and corrective actions continue. Surveillance and recertification work is billed in later years and sits outside the first-certification fee. Your Effivity subscription keeps the registers, audit schedule and corrective actions in one place, which makes the first surveillance visit routine rather than a scramble.
What is included when we work with Sterling?
Every engagement includes a full-year subscription to Effivity, our GRC automation platform; preferential Sterling Academy course access, with complimentary awareness training for your people; and internal auditor training for your audit team, as applicable to your standard, which suits ISO 9001's internal audit requirement.
Keep exploring
More in Compliance for Manufacturing and supply chain in the US
Compliance for Manufacturing and supply chain in the US
Free gap assessment
Start with a free gap assessment
Not sure where you stand? Start with a free gap assessment. In one conversation, a Sterling consultant looks at what your customers, investors or contracts are asking for, compares it with what you have in place today, and tells you what is missing, in what order to fix it and how long it is likely to take.
usa@sterling-grc.com+1 201 263 4443 (global headquarters) · A Sterling consultant replies within one working day
What would you like to achieve?
Choose a starting point. The enquiry form asks for your name, work email, phone with country code and company.
Book my free gap assessmentContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice