What’s Changing?

The ISO 9001 standard, recognized globally as the cornerstone of quality management systems (QMS), is undergoing a significant revision. Originally expected in December 2025, the revised ISO 9001 is now set for publication in September 2026, followed by a three-year transition window ending in September 2029.

Key anticipated changes include:

• Ethics and Leadership Integrity – Increased emphasis on leadership accountability, ethical decision-making, and transparency to strengthen stakeholder trust.
• Customer Experience – A broader view of the customer journey beyond satisfaction metrics.
• Sustainability and Climate Change – Greater integration of environmental responsibility and climate-related goals.
• Digitalization and Emerging Technologies – Encouraging the use of AI, automation, and digital tools to enhance operational effectiveness.
• Enhanced Risk Management – Addressing emerging risks like cybersecurity, supply chain fragility, and societal disruptions.
• Harmonized Structure – Maintaining alignment with other standards (e.g., ISO 14001, ISO 45001) while clarifying terminology and concepts.

Why It Matters

ISO 9001:2026 is not just a compliance update, it’s a reflection of the evolving landscape of global business. The inclusion of sustainability, ethics, and technology helps future-proof organizations and align quality objectives with broader strategic goals.

For certified companies, the update provides a new opportunity to assess their current systems, identify gaps, and strengthen leadership accountability. Organizations that embrace these changes early will be better positioned to remain competitive and resilient in the years ahead.

Timeline and What’s Next

• February–March 2025: Final Committee Draft (FCD) expected — this near-final version will give organizations the clearest preview of the new requirements.
• June 2025: Draft International Standard (DIS) made available for public review and comment.
• Q1 2026: Final Draft International Standard (FDIS) expected — typically reflects the final language that will be published.
• September 2026: ISO 9001:2026 officially published.
• October 2026 – September 2029: Transition period — organizations may begin auditing to the new version, with certification bodies gradually shifting requirements.
• September 2029: Final deadline — all ISO 9001:2015 certificates will become invalid; organizations must be certified to ISO 9001:2026.

Final Thoughts

The path to ISO 9001:2026 starts now. Use this period to engage your leadership, evaluate your quality management systems, and view the standard not as a checkbox, but as a strategic advantage. Contact Brett Pollock (Brett.Pollock@iapmoscb.org) to future proof your business.

CMMC is a U.S. Department of Defense (DOD) program to improve the cybersecurity of its contractors. It has different levels of security standards that companies must meet, depending on the sensitivity of the information they handle. Contractors need to pass assessments to qualify for certain DOD contracts.

Here’s 5 key advantages of the CMMC certification:



1. Increased Business Opportunities

One of the biggest CMMC certification perks is gaining eligibility for government contracts. Without certification, companies risk losing access to lucrative DoD projects. Achieving CMMC certification demonstrates commitment to cybersecurity, making businesses more attractive to federal agencies and defense contractors.

2. Strengthened Cybersecurity Posture

By meeting CMMC standards, organizations improve their overall security framework. The certification requires implementing access controls, data encryption, threat monitoring, and incident response measures—ensuring a proactive approach to cybersecurity.

3. Compliance with Federal Regulations

CMMC aligns with cybersecurity frameworks such as NIST SP 800-171, helping organizations meet federal compliance requirements. Certified companies avoid regulatory fines, legal risks, and potential contract terminations.

4. Competitive Advantage in the Market

Beyond defense contracts, CMMC-certified companies stand out in the broader market. Many private-sector clients prioritize working with businesses that adhere to high cybersecurity standards, giving certified companies an edge over non-compliant competitors.

5. Reduced Risk of Cyber Threats

Cyberattacks on businesses have become more frequent and sophisticated. Implementing CMMC security controls reduces the risk of ransomware, phishing, and insider threats—helping organizations prevent costly data breaches and system downtime.

How to Achieve CMMC Certification

Organizations seeking CMMC certification should follow these steps:

• Conduct a Security Gap Assessment: Identify areas where cybersecurity measures need improvement.
• Select the Appropriate CMMC Level: Determine the level of certification required based on contract needs.
• Implement Necessary Security Controls: Apply best practices for access control, incident response, and data encryption.
• Train Employees on Cybersecurity Practices: Educate staff on security protocols and risk mitigation strategies.
• Engage a Certified Third-Party Assessor: Work with a C3PAO to undergo a formal CMMC assessment.

On 31 October 2025, the three-year grace period will end, requiring all organizations certified to the ISO/IEC 27001 standard to have transitioned to the latest version. For organizations currently aligned with the 2013 version, this final year is a critical window to plan, prepare and implement the necessary updates to maintain compliance and enhance their information security practices.

Best practices to keep your company up to date with updated standard:

Update risk management strategies

The 2022 update calls for more proactive risk management. As part of the transition, organizations should refine their approach to risk assessment and treatment, ensuring alignment with the latest security requirements.

Key actions include:

• Risk assessment methodology: Review and update your risk assessment processes to align with the new ISO requirements.
• Incident response: Strengthen your organization’s incident response and recovery plans. With the new standard's focus on threat intelligence and security monitoring, incident response should now integrate real-time threat detection and automated response measures.
• Supply chain risks: Recognize the importance of managing third-party risks. Organizations should assess whether current suppliers meet the updated security requirements and, if necessary, enhance contractual terms and ongoing monitoring to ensure compliance.

Reinforce ongoing compliance for continuous improvement

ISO 27001:2022 is designed not as a one-time goal but as a framework for continuous improvement in information security management. Beyond the transition, the standard encourages organizations to keep improving their ISMS to stay ahead of emerging threats and adapt to new security challenges.

Proactive security management: With a focus on threat intelligence, organizations should continually update threat profiles and adjust their controls accordingly.

Review and refine controls: Regularly review the effectiveness of implemented controls to ensure that they continue to serve the organization's security needs.



Develop a culture of security: Use the ISO 27001 standard as a foundation to build a security-first mindset across the organization, promoting best practices in information security at every level.

The aerospace and defense industry is entering a pivotal growth phase shaped by AI, digital sustainment, supply chain pressures, and evolving defense priorities. Deloitte’s 2026 Aerospace & Defense Outlook breaks down the five key trends that will define the year ahead, and what they mean for manufacturers, operators, and suppliers. Read the full analysis to understand where the industry is headed.

Boeing’s takeover of Spirit AeroSystems marks a major reshaping of the global aerospace supply chain, with Boeing and Airbus splitting control of a once-independent manufacturing giant. The move aims to address quality issues, stabilize production, and redefine supplier relationships across key aircraft programs. Read the full Reuters report to understand what this deal means for the industry

SBC’s LinkedIn shares insights into new industry updates. Check out our ‘Mike Drop’ articles with our Sr, Director of Certifications, Michael Madewell, which covers any new news from accreditation updates to changes in the industry.

https://www.linkedin.com/company/systemscertificationbody/

In celebration of the upcoming holidays, our offices will be closed from Thursday, Dec. 25, through Thursday, Jan. 1. We will reopen Friday, Jan. 2. During this period, our team will have a well-deserved break to spend time with family and friends, recharge, and prepare for the upcoming year. As such, response times to emails and other inquiries may be delayed. We appreciate your understanding and patience during this time.