The quality management standard most certified organisations start with, and the one most other management system standards borrow their structure from.
Quality management systems. Requirements.
Any organisation that has committed to a repeatable standard of delivery, most often because a customer, a regulator or a tender asked for the certificate.
The clause numbers and titles above are the standard's own public structure. The standard itself is copyright of its issuing body and you buy it from them. What we add is the interpretation underneath, and that lives in your workspace.
This is the running work for this standard specifically. The general shape is the same across all of them.
Each one is filed against the requirement it satisfies as the work happens, so the pack for the next visit already exists.
The continuity standard, built around one question: when the thing you deliver stops, how quickly does it come back, and who decided that was fast enough.
Not a certification but an attestation. An independent auditor reports on whether your controls were designed properly, and for Type II, whether they operated over a period.
The information security management standard. The management system clauses set the discipline, and Annex A supplies the control set you select from and justify.
The requirement, the control attached to it, the evidence that satisfies it, and the audit checklist it generates. Nothing prepared in advance, because there is nothing to prepare.
