ISO 9001 or ISO/IEC 27001: which should your organisation pursue first?
We hear this question from almost every new client: “We know we need ISO certification — but which one?” Budgets and internal bandwidth are usually limited enough that pursuing two standards at once isn't realistic in year one, so the choice matters.
Start with who is actually asking for it
In our experience advising organisations across Kenya, the fastest way to decide is to look at who is requesting certification and why. If a specific tender, client contract, or regulator is explicitly asking for ISO 9001 (Quality Management) or ISO/IEC 27001 (Information Security), that requirement should usually take priority — it has a deadline attached and a clear business reason behind it.
If nothing external is forcing the decision
When there's no immediate external deadline, we ask clients two questions:
Does your business handle sensitive client, financial, or personal data as a core part of what you do? Software companies, financial services firms, business process outsourcers, and any organisation processing personal data at scale tend to get more immediate value from ISO/IEC 27001. It formalises how you protect data, manage access, and respond to security incidents — all things clients in these sectors are increasingly asking about directly, even outside of a formal certification requirement.
Is your core challenge consistency of service or product quality? Manufacturers, service providers with multiple delivery teams, and organisations scaling quickly often see more value from ISO 9001 first. It forces documentation of how work actually gets done, which reduces rework and makes onboarding new staff faster.
A note on cost and timeline
Both standards follow a broadly similar path: gap assessment, documentation and policy development, implementation and internal audit, then a two-stage certification audit with an accredited certification body. ISO/IEC 27001 engagements tend to run slightly longer in our experience, because the risk assessment and risk treatment work (a core requirement of the standard) is more involved than the quality-focused documentation work in ISO 9001. Neither is something we'd recommend compressing into a few weeks if the goal is a management system your team can actually sustain.
You don't have to decide alone
If you're weighing this decision for your own organisation, the fastest way to get a clear answer is a short conversation about your sector, your clients' requirements, and any upcoming tenders or contracts. We're happy to have that conversation without a sales pitch attached.