ISO STANDARDS
Below is an overview of the standards we implement, with a short description of what each one covers. If you’re not sure what you need, see ‘Which ISO standard do we need?’ in our FAQ.
ISO 9001 — quality management systems
What is ISO 9001? The international standard for quality management systems. It doesn’t prescribe what your product should be like, but how you make sure it is what you promised — consistently and repeatably. The current edition is ISO 9001:2026.
HACCP — food safety required by law
What is HACCP? A system for managing food safety hazards, based on seven principles. It isn’t an ISO standard: in Serbia, setting up a system based on HACCP principles is a legal obligation in food production, processing and distribution.
ISO 27001 — information security
What is ISO 27001? The international standard for information security management systems. It covers people, procedures, premises and technology, and the current edition is ISO/IEC 27001:2022.
ISO 14001 — environmental management systems
What is ISO 14001? The international standard for environmental management systems. It doesn’t require zero impact; it requires an organisation to know where it has an impact, how much, and what it does about it. The current edition is ISO 14001:2026.
ISO 45001 — occupational health and safety
What is ISO 45001? The international standard for occupational health and safety management systems. It replaced OHSAS 18001 and strengthened the requirements for top management leadership and for worker consultation and participation.
ISO 22000 — food safety
What is ISO 22000? The international standard for food safety management systems, applicable to the whole food chain. It includes the HACCP principles and adds a management system, communication along the chain and prerequisite programmes.
ISO 22301 — business continuity
What is ISO 22301? The international standard for business continuity management systems. It requires an organisation to know which activities must not stop and what to do while a disruption lasts.
ISO 27701 — privacy information management
What is ISO 27701? The international standard for privacy information management systems. Since the 2025 edition it is a standalone standard, and organisations can be certified to it without ISO 27001.
ISO 50001 — energy management
What is ISO 50001? The international standard for energy management systems. It requires you to prove with data that your energy performance has improved — having a system isn’t enough.
ISO 13485 — medical devices
What is ISO 13485? The international standard for quality management systems for medical devices. It grew out of ISO 9001, but its aim is regulatory compliance rather than customer satisfaction.
ISO 20000-1 — service management
What is ISO 20000-1? The international standard for service management systems. It names the processes that must exist — service catalogue management, service level management, and incident, problem and change management.
ISO 37001 — anti-bribery management
What is ISO 37001? The international standard for anti-bribery management systems. It deals with giving and receiving bribes; it doesn’t specifically address fraud or money laundering. The current edition is ISO 37001:2025.
ISO 41001 — facility management
What is ISO 41001? The international standard for facility management systems. It covers the services that keep premises running — maintenance, energy, cleaning, security and contracts with service providers.
ISO 21001 — educational organisations
What is ISO 21001? The international standard for management systems for educational organisations. It governs how an educational programme is planned, delivered and evaluated, with the focus on learners’ needs.
ISO 55001 — asset management
What is ISO 55001? The international standard for managing assets across their whole life — acquisition, use, maintenance and disposal.
ISO 39001 — road traffic safety
What is ISO 39001? The international standard for road traffic safety management systems. It is aimed at organisations that interact with the road traffic system — for example, those whose staff spend much of their working time on the road.
ISO 22716 — GMP for cosmetics
What is ISO 22716? Guidelines on good manufacturing practice (GMP) for the cosmetics industry — production, control, storage and shipment of cosmetic products.
ISO 26000 — social responsibility (guidance)
What is ISO 26000? Guidance on social responsibility. It isn’t a standard organisations are certified against — it gives guidance, not requirements.
GDPR — personal data protection (regulation)
What is GDPR? The European Union’s General Data Protection Regulation. It isn’t an ISO standard but an EU regulation, and an ISO certificate doesn’t prove compliance with it.
SOC 2 Type II — controls report
What is SOC 2 Type II? An independent service auditor’s report on a service organisation’s controls over a period of time. It isn’t an ISO standard, and no certificate is issued — the result is an attestation report.
SSAE — US attestation standards
What is SSAE? The AICPA’s Statements on Standards for Attestation Engagements — the US standards under which SOC reports are issued. It isn’t an ISO standard.