ISO Survey 2025: Information security is growing more than three times as fast as quality management
ISO Survey 2025: Information security is growing more than three times as fast as quality management
The ISO Survey 2025 has been published. Its message: ISO 9001 remains the foundation – but growth is happening in information security, energy and compliance. We have analysed the figures for you, with a focus on Germany and a critical eye on the underlying data.
The figures at a glance
The ISO Survey records, every year, the number of valid accredited certificates for selected management system standards; the reference date of the current edition is 31 December 2025. The data come mainly from IAF CertSearch, the global database of accredited certifications. 80 of the 81 accreditation bodies in scope and 2,574 certification bodies participate.
- ISO 9001 (quality): 1,611,729 certificates covering 2,419,972 sites
- ISO 14001 (environment): 739,390 certificates
- ISO 45001 (occupational health and safety): 599,532 certificates
- ISO/IEC 27001 (information security): 125,622 certificates
- ISO 50001 (energy): 47,394 certificates
ISO 9001 remains by far the world’s most certified management system standard. China alone accounts for around 42 per cent of all ISO 9001 certificates.
Where the growth is
Compared with the previous year, ISO 9001 grew by 9.3 per cent. ISO/IEC 27001, by contrast, grew by 29.9 per cent – more than three times as fast. Anti-bribery management systems under ISO 37001 (+85.4 per cent) and business continuity under ISO 22301 (+36.7 per cent) grew even more strongly, albeit from a much smaller base. Energy management under ISO 50001 rose by 23.2 per cent.
The survey itself does not name causes. One plausible explanation is the growing demand for information security – driven by regulation such as the EU NIS2 Directive and by supply chains. More and more customers require reliable evidence from their suppliers.
Germany in international comparison
With 52,404 ISO 9001 certificates, Germany ranks fourth worldwide – behind China, India and Italy. For ISO 50001, Germany ranks second with 10,544 certificates; only China reports more. Germany ranks fifth for medical devices (ISO 13485) and eighth for both environmental and information security management.
The increases reported for Germany are strikingly high: +50.0 per cent for ISO/IEC 27001, +61.6 per cent for ISO 50001 and +14.0 per cent for ISO 9001. These figures deserve a second look.
About the data: why Germany’s increases should be read with caution
- ISO points to gaps for Germany in both years: in 2024 only some DAkkS-accredited certification bodies reported their data, and in 2025 coverage remains incomplete. ISO does not quantify how much the captured data base changed between the two years. In addition, data from UKAS CertCheck were added in 2025, particularly for the United Kingdom.
- According to our cross-check, the comparison figures match the published totals of both years exactly – for all countries and standards. Newly captured certificates therefore show up as growth. For the previous comparison 2023/2024, ISO itself explicitly noted that year-on-year comparisons are not strictly like-for-like.
- One indicator: in Germany, the number of ISO 9001 certificates rises by 14.0 per cent, while the number of recorded sites falls by 29.5 per cent. This points to data-capture effects rather than real market movement.
- Our assessment: the figures show a direction, not an exact growth rate. ISO itself points out that coverage varies across countries, industries and standards.
AI management systems: a market at its start
For the first time, the survey covers ISO/IEC 42001 for AI management systems and ISO 37301 for compliance management systems. For ISO/IEC 42001 it reports 271 certificates in 40 countries worldwide – 100 of them in the USA and 7 in Germany. ISO 37301 accounts for 1,018 certificates. For comparison: ISO 9001 counts more than 1.6 million. For organisations using artificial intelligence, ISO/IEC 42001 provides a structured framework – the market for such evidence is only just beginning.
What the statistics do not show
- The survey counts accredited certificates only. Non-accredited certificates and declarations of conformity under ISO/IEC 17050-1 are not included.
- Sector-level conclusions are hardly possible: for around 78 per cent of ISO 9001 certificates, the economic sector is not specified.
- The number of certificates says nothing about how effective the underlying management systems are.
What does this mean for your organisation?
Statistics do not replace decisions. Three questions can help:
- What evidence do your customers actually require? If your customers are raising the bar on information security, ISO/IEC 27001 is often the next step after ISO 9001.
- Does your existing certification still add value? For mature management systems, an externally confirmed declaration of conformity under ISO/IEC 17050-1 can be a robust alternative – provided your customers accept it. Read more in our article Declaration of conformity under ISO/IEC 17050-1 (in German).
- Can several standards be run as one integrated system? ISO 9001, ISO 14001, ISO 45001, ISO/IEC 27001 and ISO 50001 share the same high-level structure. An integrated management system avoids duplicate documentation and audits.
Event tip: “Zertifizierung – Quo Vadis?”
Certificate or declaration of conformity – which route suits your organisation? Dr. Roland Scherb – Managing Director of PeRoBa®, long-standing lead auditor, author, trainer and consultant – addresses this question in the free online keynote “Zertifizierung – Quo Vadis?” hosted by BVMW Bayern on 23 November 2026, 10:00–10:45 CET (Zoom, in German). Go to the event at BVMW Bayern (in German)
Quality is a philosophy and our passion.
Source: ISO Survey of Management System Standard Certifications 2025 (as at 31 Dec 2025), Explanatory Note (October 2026) and results tables, available via IAF CertSearch. Analysis and figures: PeRoBa®.
About PeRoBa®:
PeRoBa® Unternehmensberatung GmbH has specialised in management systems since 1991. The company has been headquartered in Baldham since 2011 and also maintains an office on Prinzregentenstraße in Munich. PeRoBa® advises, audits and assesses to support clients in introducing and implementing their management systems, and also offers audits, QM training, seminars and workshops. Since January 2016, the in-house, patented software iVision® – Smart Remote Audit Solution has been on the market.
Dr. Roland Scherb is the founder and Managing Director of PeRoBa® Unternehmensberatung GmbH, certified to DIN EN ISO 9001, ISO 14001 and ISO 27001 and based in Baldham. He is President of the Bundesverband der Auditoren e. V. (German Federal Association of Auditors), head of the ISO Certification Competence Forum at BVMW e. V. (German Association for Small and Medium-sized Businesses) and a member of the DIN working committee NQSZ NA 147-00-07 GA on the revision of DIN EN ISO 19011. He is also a book author as well as a trainer and lecturer at renowned educational institutions on management systems and the associated core methods.
How may we help you?
If you have any questions, don’t hesitate to contact us!
You can use our contact form to write us a message, call us or make a free online appointment.