ISO Certified Data Consultancy: Why Five Standards Matter More Than One
Ask any supplier in the European data market whether they are an ISO certified data consultancy and most will say yes. Ask which standard, and the answer is almost always the same one: ISO 9001.
That answer is no longer enough for the institutions buying data services. Banking, telco and retail clients are now being asked by their own regulators to evidence how their suppliers manage information security, privacy, service delivery and disruption — not just quality. One certificate does not answer four questions.
IDS Consulting (Integration Data Systems) holds five, all current, all audited by an accredited third party.
| Standard | What it certifies | IDS certificate | Valid until |
| ISO 9001:2015 | Quality Management System — how work is planned, delivered, measured and corrected | 636R1 C (first certified 08.05.2024) | 07.05.2029 |
| ISO/IEC 27001:2023 | Information Security Management System — how information is classified, protected, accessed and monitored | 636R1 I (first certified 08.05.2024) | 07.05.2029 |
| ISO/IEC 27701:2019 | Privacy Information Management System — how personal data is governed, as an extension of the ISMS | 873.100R1 J (first certified 18.12.2023) | 17.12.2029 |
| ISO 22301:2019 | Business Continuity Management System — how service continues through disruption | 636 B (first certified 30.05.2025) | 29.05.2028 |
| ISO/IEC 20000-1:2018 | Service Management System — how IT services are defined, delivered and supported against a service catalogue | 636R1 T (first certified 08.05.2023) | 07.05.2029 |
All five are issued by CERTINSPECT Register SRL, accredited by RENAR under SR EN ISO/IEC 17021-1:2015 (accreditation no. SM 110) and by IAS (MSCB-401), within the IAF multilateral recognition arrangement. The certified scope covers IT consulting, software development, implementation and data management consulting.
Why We Hold All Five
Because our consultants work inside client data departments — in core banking platforms, telco data warehouses, retail analytics environments. We are not handing over a deliverable at the door. We are operating within systems that hold regulated, personal and commercially sensitive data every working day.
That delivery model creates four distinct obligations, and each one has a standard behind it:
- Quality (9001) — the client’s project must land as specified, with a documented way to catch and correct deviation.
- Information security (27001) — our access to client systems must be governed, logged and revocable.
- Privacy (27701) — where personal data is in scope, the controls must be demonstrable, not assumed.
- Continuity (22301) — the client’s reporting deadline does not move because something broke on our side.
- Service management (20000-1) — maintenance and support must run against a defined service catalogue, not goodwill.
Certification is how we prove those obligations are met by a system, not by individual effort.
Continuous improvement isn't a slogan here — it's certified.
Each standard below reflects our commitment to protecting your data, respecting your business, and never treating “good enough” as good enough.
- ISO 9001 – Quality Management
- ISO 27001 – Information Security Management
- ISO 20000-1 – IT Service Management
- ISO 27701 – Security Techniques
- ISO 22301 – Business Continuity Management System
What This Changes for Clients
Three practical things.
Procurement moves faster. Vendor due-diligence questionnaires in banking and telco increasingly map directly onto ISO control sets. Where a certificate already exists, the evidence request shortens from weeks to a document transfer.
Regulatory conversations get easier. Under DORA, financial entities must assess and monitor ICT third-party providers; NIS2 pushes comparable expectations across other critical sectors. ISO 27001 and ISO 22301 map onto a substantial share of those requirements. To be precise: certification is not the same as regulatory compliance, and we never present it as such — but it gives a client’s risk team a recognised, audited starting point instead of a blank page.
Assurance is continuous, not annual theatre. Certificates are maintained through surveillance audits — ours are scheduled for 2027 and 2028 — and re-earned through full recertification. We completed recertification across the management systems in April and May 2026. The system has to keep working to keep the certificate.
The Standards Are Moving — and So Are We
Two revisions are reshaping the landscape right now, and both are worth tracking if you buy or sell data services.
ISO 9001:2026 was published on 16 September 2026, bringing quality culture, ethical behaviour and strengthened change management into the requirements. Organisations certified to the 2015 edition have until 30 September 2029 to transition.
ISO/IEC 27701:2025 repositions privacy information management as a standalone management system rather than an extension of ISO 27001, with its clause structure realigned to ISO 27001:2022 and ISO 42001. Existing 2019 certificates transition by 31 October 2028.
Our ISO/IEC 27001:2023 certificate already reflects the current revision of the information security standard. The 9001 and 27701 transitions are planned work, not surprises.
The Bottom Line
Five standards are not five badges. They are five answers to the questions a regulated client’s risk, legal, procurement and IT functions will each ask separately before a single consultant starts work.
We hold them because our clients are banks, telcos and retailers who cannot afford to take a supplier’s word for it — and because, after 14 years and 150+ consultants, we would rather be audited than assumed.
We always deliver. Expert Data Services. We help you stay on top of your data for a successful business — so buckle up and ride the data journey with us.
Want the certificates for your vendor file? Get in touch and we will send the current set.
