NIST SP 800-171 internal audit playbook
Use internal review cadence to keep evidence and ownership moving.
ISO 9001 and CMMC: running one compliance program, not two
ISO 9001 and CMMC often land on the same leadership team because quality, cybersecurity, supplier oversight, and contract eligibility all touch the same operations. This guide explains what can be shared, what must stay separate, and how to sequence both programs without confusing one audit path for the other.
Answer first: do they count for each other?
Direct answer: No. ISO 9001 certification does not satisfy CMMC, and CMMC does not satisfy ISO 9001. They use separate scopes, requirements, auditors, and certificates. What can transfer is operating discipline: document control, records habits, internal review cadence, corrective action, supplier oversight, and leadership accountability.
That distinction matters because a rushed team can waste money in two opposite ways. One mistake is to treat ISO 9001 as irrelevant to cybersecurity work and rebuild every governance habit from scratch. The other is to assume a polished quality management system proves CMMC implementation. The better approach is to share the foundation while keeping the standard-specific evidence, scope, and decision-makers clear.
For Andvio buyers, this usually means naming the business driver first. A customer may be asking for ISO 9001 or AS9100 as a quality condition. A prime may be flowing down cybersecurity requirements tied to CMMC. A leadership team may be trying to professionalize both quality and security before a bid. Each driver deserves its own readiness path, but those paths can use one management rhythm.
What each standard is actually for
ISO 9001:2015 is the international quality management system standard published by ISO. Its requirements sit across clauses 4 through 10: context of the organization, leadership, planning, support, operation, performance evaluation, and improvement. ISO describes the standard as built around process thinking, risk-based thinking, and the Plan-Do-Check-Act cycle.
CMMC is a US government cybersecurity program for organizations in the defense industrial base that process, store, or transmit Federal Contract Information or Controlled Unclassified Information. The DoD CMMC overview describes assessments at multiple levels, with Level 2 aligned to the 110 security requirements in NIST SP 800-171 Revision 2.
The difference is not academic. ISO 9001 asks whether your quality management system is defined, operated, measured, and improved. CMMC asks whether your cybersecurity practices meet the applicable safeguarding requirements for the information and systems in scope. A controlled document repository may help both teams, but the quality procedure inside it is not the same as a system security plan, and an ISO certificate is not a CMMC assessment result.
Why a government contractor ends up needing both
Quality requirements can arrive through direct customer expectations, prime contractor flow-downs, aerospace supply-chain requirements, or solicitation clauses. FAR 52.246-11, Higher-Level Contract Quality Requirement, gives the government a way to require a higher-level quality standard when the contract calls for it. Aerospace suppliers may also encounter AS9100, the SAE/IAQG aerospace quality management standard built on ISO 9001 with additional sector requirements.
Cybersecurity requirements usually follow the data and the contract language. If work involves FCI or CUI, the team may need to understand CMMC level expectations, assessment type, scoping, supplier flow-down, and cybersecurity evidence. These conversations may include IT, security, contracts, engineering, purchasing, HR, and operations, which are many of the same groups a QMS relies on.
That shared cast of owners is why one team ends up with both programs. The work is not identical, but the habits are related. A shop-floor nonconformity and a cybersecurity POA&M are different records, yet both need ownership, due dates, evidence of closure, and management attention. A supplier quality review and a subcontractor cybersecurity review are different activities, yet both benefit from a clear supplier register and defined escalation path.
What genuinely transfers between the two programs
The reuse is strongest in the operating system around compliance, not in the requirements themselves. Teams get value when they build one way to control documents, gather records, run internal reviews, assign corrective actions, and prepare leaders to make decisions. They get into trouble when they collapse the scopes or pretend the same evidence proves two different things.
| Capability | In ISO 9001 | In CMMC | Reuse potential |
|---|---|---|---|
| Scope definition | QMS scope across products, services, sites, and processes | CUI boundary, FCI/CUI handling, systems, users, and assessment level | Use a shared scoping workshop, but document separate boundaries. |
| Documented policy | Quality policy, objectives, process procedures, and required documented information | Security policies, SSP narratives, procedures, and control implementation descriptions | Reuse approval, review, and ownership rules, not the policy content. |
| Document and version control | Controlled documents, revision history, access, and current-use controls | Controlled cybersecurity policies, procedures, diagrams, and evidence artifacts | High reuse: one document-control discipline can serve both libraries. |
| Records retention and retrieval | Training records, inspection records, calibration, nonconformity, corrective action | Logs, screenshots, tickets, configuration evidence, training, access reviews | High reuse for naming, retention, indexing, and retrieval habits. |
| Internal review | Internal audit programme and management review | Self-assessment, mock assessment, readiness reviews, and program governance | Reuse audit muscle: sampling, interviews, findings, and evidence trails. |
| Corrective action | Nonconformity and corrective action workflow | Remediation items, POA&M where allowed, risk decisions, closure evidence | High reuse for owner assignment, aging, validation, and leadership review. |
| Management review and governance | Leadership review of QMS performance and improvement needs | Executive visibility into cybersecurity risk, remediation, and assessment readiness | Reuse the cadence and dashboard, while keeping metrics standard-specific. |
| External providers | Control of externally provided processes, products, and services | Supplier flow-down, subcontractor expectations, cloud and MSP responsibilities | Reuse supplier inventory and responsibility mapping; tailor the criteria. |
| Competence and training | Competence requirements and training records for quality-impacting work | Security awareness, role-based training, admin competence, incident procedures | Reuse training records discipline, but map different role requirements. |
What does not transfer — and where teams get burned
The first trap is assuming an ISO certificate will satisfy CMMC evidence expectations. It may show that the organization can run a management system, but during the current Phase I posture, CMMC self-assessment evidence still has to prove cybersecurity implementation against the CMMC scope. A future third-party assessor, if Phase II requirements are reinstated, would not treat a quality certificate as a substitute for security control evidence.
The second trap is assuming a CUI enclave narrows the QMS scope. A cybersecurity enclave can be a smart way to manage protected information, but ISO 9001 scope is based on the quality management system, the organization, its products and services, and its customers. One boundary can inform the other, but it does not define it automatically.
The third trap is reusing a quality manual as a system security plan. The tone may sound official, and some governance pieces may overlap, but an SSP has to explain systems, controls, implementation, responsibility, and evidence in a cybersecurity context. Quality documentation cannot be relabeled into security evidence without doing the underlying security work.
The fourth trap is naming one compliance owner with no process owners behind them. ISO 9001 and CMMC both expose weak accountability. Quality, purchasing, HR, engineering, operations, contracts, IT, and security each own pieces of the system. A single coordinator can run the calendar, but the evidence has to come from the process owners who operate the work.
The fifth trap is scheduling a Stage 2 certification audit and a CMMC self-assessment update, government-led review, or future assessment window in the same quarter with the same overloaded team. Even if both programs are mature, findings, evidence requests, interviews, and leadership reviews demand attention. Separate the review windows enough to close issues and protect the team from avoidable fatigue.
A sequencing model that doesn't double the work
A practical sequence starts with shared foundations, then moves into standard-specific work according to the nearest real business driver. The goal is not to slow either program down. The goal is to stop the same people from rebuilding the same governance habits twice.
- Confirm the drivers. Write down the contract, customer, solicitation, prime flow-down, or internal decision behind each framework. Done means leaders agree which dates are external, which are preferred, and which are still uncertain.
- Define the two scopes. Draft the QMS scope and the CMMC system/data scope separately. Done means the team can explain products, services, sites, processes, CUI boundary, FCI/CUI handling, and major exclusions without collapsing them into one map.
- Build the shared control room. Establish document control, records indexing, issue tracking, corrective action workflow, owner lists, meeting cadence, and leadership reporting. Done means both programs can find documents, assign work, age open items, and prove closure consistently.
- Run readiness diagnostics. Use ISO 9001 readiness gap assessment for the QMS and CMMC readiness gap assessment for cybersecurity scope. Done means findings are ranked by risk, owner, dependency, and external deadline.
- Close documentation gaps. Build QMS documented information through ISO 9001 QMS documentation support, and build cybersecurity policies, SSP content, procedures, and evidence through the CMMC documentation track. Done means documents match real operations and are controlled.
- Test before the formal event. Use internal audit and certification support for ISO 9001 and mock assessment or evidence walkthroughs for CMMC. Done means findings are visible early enough to correct them before the certification body or CMMC assessment organization begins formal work.
- Separate audit windows. Schedule formal events with enough runway to respond to findings, collect missing evidence, and keep operations moving. Done means no single week depends on the same small team answering every audit request for both programs.
If you are still choosing where to begin, Andvio's matching process starts by clarifying framework, scope, timeline, and service need so provider conversations begin with the right category of help.
Frequently asked questions
Does ISO 9001 certification satisfy any CMMC requirement?
No. ISO 9001 certification does not satisfy CMMC requirements, and CMMC does not satisfy ISO 9001. The programs can share operating discipline, but the certificates, scopes, auditors, and evidence criteria remain separate.
Can the same consultant do both?
Sometimes. A consulting firm may support ISO 9001 readiness and CMMC readiness if it has the right experience in both. Contractors should confirm credentials, scope experience, and independence boundaries, especially where formal certification or assessment work belongs to a separate organization.
Is AS9100 the same as ISO 9001?
No. AS9100 is an aerospace quality management standard built on ISO 9001 with additional aviation, space, and defense requirements. A supplier pursuing AS9100 is still dealing with a QMS, but the scope and customer expectations are more specific than ISO 9001 alone.
Who performs each audit?
ISO 9001 certification audits are performed by an independent certification body or registrar selected by the organization. CMMC assessments are performed through the CMMC assessment ecosystem according to the level and contract requirement. Andvio matches readiness support; it does not audit or certify.
Which should we do first?
Start with the driver carrying the nearest contract, customer, or revenue risk. If both are active, build shared foundations first, then sequence ISO 9001 and CMMC work around firm external dates and enough runway to close findings before formal audits or assessments.
How Andvio helps
Andvio matches government contractors with vetted partners for CMMC readiness and ISO 9001 work, including teams that can run both programs against one shared foundation. That can include readiness diagnostics, documentation support, internal audit preparation, cybersecurity remediation coordination, and provider selection for the next stage of work. Andvio does not audit, certify, accredit, register, or issue certificates. Use the Certification Match Quiz to share your framework, scope, and timing so the first provider conversation starts in the right lane.
Related posts
Need a provider for ISO 9001, CMMC, or both?
Use the Certification Match Quiz to route your framework, scope, timeline, and service need to a vetted provider category.