Partner services
ISO certification for public sector suppliers
Public sector frameworks increasingly ask for ISO certificates before you can bid. If you don't hold the right ones, you can't apply, however good your services are. We introduce you to a trusted certification partner with public sector experience, and make sure what you achieve lines up with the frameworks you're targeting.
Rated 5.0 on GoogleAt a glance
Standards covered
- ISO 9001
- ISO/IEC 27001
- ISO/IEC 20000-1
- ISO 14001
- What's included
- Gap analysis, documentation and support through to certification
- Delivered by
- A trusted partner with public sector experience, introduced and co-ordinated by Advice Cloud
Why it matters
Why public sector buyers ask for ISO certification
Public sector buyers need assurance before they trust a supplier with their data, services or users. An ISO certificate is independent evidence that you run a managed, audited system, checked by an outside certification body rather than described in a bid.
Under the Procurement Act 2023, the Government Commercial Agency (GCA) decides lot by lot whether qualifications such as Cyber Essentials or ISO certificates are needed. Where a contract asks for a particular certificate, buyers must also accept equivalent proof.
- Pass mandatory qualification checks on the lots and tenders that require a certificate
- Evidence for quality and security questions, backed by an audited system
- Ready before the window opens, rather than racing a framework deadline
Where it's required
Frameworks that ask for ISO certificates
Requirements are set lot by lot and change between iterations. These examples were checked on 11th November 2026.
G-Cloud 15 (RM1557.15)
Lots 1a and 1b require ISO 9001, ISO/IEC 20000-1 and ISO/IEC 27001, and GCA validates the evidence. On the other lots, certificates are optional but can be declared on your listing.
Public Sector Software Solutions (RM6396)
At GCA's March 2026 market engagement, Cyber Essentials, ISO 9001, ISO/IEC 27001, ISO/IEC 20000-1 and ISO 14001 were expected across all lots. Treat this as provisional until GCA publishes the tender documents.
Individual tenders
Outside frameworks, buyers often ask for ISO certificates in the selection stage of their own tenders, particularly ISO 9001 and ISO/IEC 27001.
The requirements
Which ISO standard do you need?
Each standard answers a different question a buyer is asking. Start with the ones your target frameworks require, then the ones your buyers score.
| Standard | What it covers | What it shows a buyer | Most relevant when |
|---|---|---|---|
| ISO 9001 | Quality management | You deliver consistently, and you find and fix what goes wrong | Almost any supplier. A common baseline in selection questionnaires |
| ISO/IEC 27001 | Information security management | You identify, manage and reduce information security risk across people, processes and technology | You host, process or have access to a buyer's data, including SaaS |
| ISO/IEC 20000-1 | IT service management | You run IT services to a managed, measured standard | You provide hosting, managed services or IT support |
| ISO 14001 | Environmental management | You manage and reduce your environmental impact | Bids that score sustainability. Pairs well with a Carbon Reduction Plan |
ISO/IEC 27001 or Cyber Essentials?
They answer different questions. Cyber Essentials is a UK government-backed scheme that checks five technical controls against common internet attacks. ISO/IEC 27001 certifies a whole information security management system, from policies and people to suppliers and incident handling.
Holding ISO/IEC 27001 doesn't automatically mean you meet Cyber Essentials Plus, and some frameworks ask for both.
What certification involves
- 1Gap analysis. Compare how you work today with the standard.
- 2Build the system. Policies, processes and records, scoped to the services you sell.
- 3Run it and check it. Internal audit and management review, so there's evidence it works.
- 4External audit. An independent certification body audits you in two stages.
- 5Keep it. Surveillance audits each year, and recertification every three years.
Check your certification body is UKAS-accredited. Some frameworks specify it.
How we help
The right partner, lined up with the frameworks you're targeting
We don't certify you ourselves. We introduce you to a trusted partner who specialises in ISO certification, has worked with public sector suppliers and delivers to a standard we're happy to put our name to. We stay involved, so the certificates you end up with match the frameworks and tenders you're going for.
- 1
Talk to us
We check which standards your target frameworks and buyers ask for, and by when.
- 2
Meet our partner
We introduce you to our certification partner(s) for a gap analysis and a proposal.
- 3
Get certified
Our partner supports you through to certification, and we line it up with your applications.
Talk to us about ISO certification
Tell us what you need and we'll come back to you, or book a call with one of our team.
Speak with our ISO experts
Pick a time that suits you. We'll talk through the frameworks you're targeting, the standards they ask for and how quickly you need to move.
ISO certification: your questions answered
Do I need ISO certification to get onto a government framework?
Not always. GCA decides lot by lot whether certificates are needed, so check the documents for each lot you plan to apply for. On G-Cloud 15, for example, Lots 1a and 1b require ISO 9001, ISO/IEC 20000-1 and ISO/IEC 27001, while the other lots treat them as optional.
Is ISO 27001 the same as Cyber Essentials?
No. Cyber Essentials checks five technical controls. ISO/IEC 27001 certifies a full information security management system. Holding one doesn't mean you hold the other, and some frameworks ask for both.
Which ISO standard should a technology supplier get first?
The one your target frameworks and buyers ask for. Where nothing is mandated, ISO/IEC 27001 is usually the most relevant if you handle buyer data, and ISO 9001 is a common baseline. We'll check your targets before you commit to anything.
Will a buyer accept an equivalent to an ISO certificate?
Under the Procurement Act 2023, where a contract asks for a particular certificate, government buyers must accept equivalent proof. You'll still need to show that your equivalent meets the same standard.
Why does UKAS accreditation matter for public sector contracts?
UKAS, the United Kingdom Accreditation Service, is the UK's national accreditation body. It checks that certification bodies are competent and impartial, so a certificate from a UKAS-accredited body has been issued by an auditor who has been audited too.
That matters to public sector buyers. Some GCA framework documents specify certification from a UKAS-accredited body, and a certificate from an unaccredited body doesn't carry the same independent check. A buyer can reject it, which could cost you a place on a framework or a contract you'd otherwise win.
Before you commit, check that the certification body is accredited for the specific standard you need. You can search UKAS's directory of accredited organisations to confirm it.
Can I apply for a framework before I'm certified?
It depends on the framework. Some need the certificate at submission. For Public Sector Software Solutions, GCA has said it is exploring asking for evidence at first call-off instead, but that isn't confirmed. If a deadline is close, talk to us early.
How long does ISO certification take?
It depends on your size, the scope of services you certify and how much of a management system you already have. The gap analysis gives you a realistic timeline before you commit.
How much does ISO certification cost?
Cost depends on how many standards you need, the scope of services you certify, the size of your business and how ready you are today. You'll have a proposal after the gap analysis.
Do ISO certificates expire?
Certification runs on a three-year cycle, with surveillance audits each year and a recertification audit at the end. Build that into your plans so a certificate doesn't lapse mid-framework.
Who will deliver the work?
One of our trusted partners, introduced by us. You'll know who they are and what they propose before you commit to anything, and we stay involved throughout.