In brief
ISO 9001 for software companies: what a quality management system covers in clauses 4–10, why clients ask, how it fits ISO 27001 and what to prepare.
ISO 9001 for software companies means running a certified quality management system (QMS) under the ISO 9001 standard, so that how you take requirements, design, build, test and deliver software is controlled and improved over time. An accredited certification body issues the certificate for three years, with surveillance audits in between.
This guide is for CTOs, delivery heads and quality leads at software and IT outsourcing companies whose clients have started asking for ISO 9001. For the framework overview, see ISO 9001 on pTrackly.
What does ISO 9001 require from a software company?
ISO 9001 is the International Organization for Standardization's standard for quality management systems. The current edition, ISO 9001:2026, was published on 16 September 2026; most existing certificates are still against ISO 9001:2015 during the transition. It does not tell you to use Scrum or Waterfall. It requires you to define your processes, assign responsibility, control your outputs and show that what you deliver consistently meets customer requirements.
The requirements sit in clauses 4 to 10. In a software business they map to familiar work:
| ISO 9001:2026 clause | What it covers | What it looks like in a software company |
|---|---|---|
| 4 Context | QMS scope, interested parties, processes | Scope covering project delivery, maintenance and customer support |
| 5 Leadership | Quality policy, roles and responsibilities | Management signs the quality policy; PMs and QA leads have defined duties |
| 6 Planning | Risks and opportunities, quality objectives | Objectives such as post-release defect rate or on-time milestones |
| 7 Support | Resources, competence, documented information | Skills matrix, training records, controlled process documents |
| 8 Operation | Customer requirements, design and development (8.3), external providers (8.4), nonconforming outputs (8.7) | Requirement sign-off, design reviews, testing, subcontractor control, handling severe defects |
| 9 Performance evaluation | Measurement, customer satisfaction, internal audit, management review | Post-project customer surveys, an annual internal audit, management review meetings |
| 10 Improvement | Nonconformity and corrective action, continual improvement | Root-cause analysis of incidents and tracked corrective actions |
Why do clients ask software vendors for ISO 9001?
Enterprise clients, especially when they outsource development, often include ISO 9001 in vendor qualification because it is independent evidence that your delivery runs on controlled processes rather than on a few individuals. Typical questions in tenders and vendor assessments are how you control delivery, how you handle defects and complaints, who owns quality, and how you manage subcontractors.
ISO 9001 does not answer security questions. If a client asks how you protect their data, they usually also want ISO 27001 or a SOC 2 report; see SOC 2 vs ISO 27001: which first.
How does ISO 9001 relate to ISO 27001?
ISO 9001 manages the quality of products and services; ISO 27001 manages information security. They are separate certificates, but both follow the common structure for management system standards (Annex SL, now called the Harmonized Structure): clauses 4 to 10 share titles and order, from context to improvement (Annex SL summary). The wording of each clause is not identical, but the shared structure lets you run one integrated management system.
| Element | Shared between ISO 9001 and ISO 27001 | Specific to each |
|---|---|---|
| Documented information control (7.5) | Yes | Different lists of required documents |
| Internal audit (9.2) and management review (9.3) | Can run as one programme | Different audit criteria |
| Nonconformity and corrective action (10.2) | Yes | No |
| Risk-based thinking | Shared approach | ISO 27001 adds an information security risk assessment and a Statement of Applicability |
| Supplier control | Yes | ISO 27001 adds supplier security requirements in Annex A |
Many certification bodies can audit both standards together; how they combine the audits depends on the body you choose. If you are also pursuing ISO 27001, the ISO 27001 implementation checklist for IT outsourcing covers the security side.
How is an ISO 9001 certificate issued and kept?
An accredited certification body issues the certificate after a two-stage audit: stage 1 reviews documentation and readiness, stage 2 assesses the running system. Under ISO/IEC 17021-1 the certification cycle is three years, with surveillance audits at least once a year and a recertification audit before expiry (certification cycle overview).
Check that the certification body is accredited by an accreditation body that belongs to the IAF, because international clients usually accept only accredited certificates.
What should a software company prepare for ISO 9001?
- Define the QMS scope: which services, offices and clients are in scope, and write it down.
- Write a quality policy and measurable quality objectives tied to real delivery outcomes.
- Describe your core processes (requirement intake and confirmation, design and development, testing, release, post-delivery support) and keep evidence of each step.
- Set up control of external providers: freelancers, subcontractors and the cloud services you deliver with.
- Set up handling of nonconforming outputs and corrective action, including severe post-release defects and customer complaints.
- Run the system long enough to produce records, then hold an internal audit and a management review before inviting the certification body.
Preparation time depends on scope and on how much of your process is already documented; treat any timeline as a scope-dependent estimate.
How does pTrackly support ISO 9001?
pTrackly includes an ISO 9001:2026 framework with requirements for clauses 4 to 10, a compliance matrix showing which controls meet which requirement, policy templates such as Quality Policy, QMS Scope, Quality Objectives, Internal Audit Procedure and Nonconformity & Corrective Action Procedure, and recurring evidence tasks. If you already run ISO 27001 in pTrackly, overlapping controls, policies and tasks are shared rather than duplicated.
pTrackly does not issue certificates, does not replace the certification body and does not write your delivery process for you. Your team still sets the scope, runs the processes, holds the internal audit and does the management review.
Frequently asked questions
Is ISO 9001 mandatory for software companies?
No general law requires software companies to hold ISO 9001. The requirement usually comes from clients, tenders or partners, so ask which certificate the client needs before you start.
Does ISO 9001 work with Agile and Scrum?
Yes. ISO 9001 does not prescribe a development method; it requires you to plan and control design and development (clause 8.3) and keep evidence. Sprint reviews, a definition of done and retrospectives can serve as evidence when they are run consistently.
Should we do ISO 9001 or ISO 27001 first?
If clients ask about data protection, ISO 27001 usually comes first; if they ask about process capability and delivery quality, ISO 9001 fits better. Because the two share a structure, the second one reuses your document control, internal audit and management review.
Is there a new version of ISO 9001?
Yes. ISO 9001:2026 was published on 16 September 2026 and replaces the 2015 edition. ISO 9001:2015 certificates stay valid during a transition of about three years (certification bodies cite 30 September 2029; confirm with yours). pTrackly's ISO 9001 framework follows the 2026 edition, so you can build to the current version or use it to plan your transition.
Preparing ISO 9001 alongside ISO 27001? Book a demo to see how pTrackly shares controls, policies and evidence across both standards.
