Technology and software
SaaS, fintech, cloud and digital service companies that need to demonstrate security and governance maturity.
Standards that answerWe use necessary technical cookies and measure only if you accept. Accept turns on our own measurement, Google Analytics, Google Ads and the Meta pixel; Reject keeps everything off, and you can change it at any time. See the details
All the material is on this page: sectors, regulation, market data, coverage, articles, press, glossary and questions. Each figure states where it comes from.

Eight chains with published situations. Choose one to see its cases, what its market asks for and the standards that respond.
SaaS, fintech, cloud and digital service companies that need to demonstrate security and governance maturity.
Standards that answerFive public frameworks in force and the management system standard that helps you arrive prepared for each one.
The European Union AI Act (Regulation 2024/1689), the first comprehensive regulatory framework on artificial intelligence.
The GDPR in the European Union (Regulation 2016/679), the LGPD in Brazil (Law 13.709/2018) and a growing set of national data protection laws in Latin America.
The NIS2 Directive in the European Union, sector-specific cybersecurity regimes and contractual requirements from customers and supply chains that call for demonstrable controls.
Anti-corruption frameworks with extraterritorial reach such as the FCPA (United States) and the UK Bribery Act, together with national integrity and compliance legislation in the region.
The European Union's CSRD on corporate sustainability reporting and a growing set of ESG and carbon footprint reporting requirements across global value chains.
Valid management system certificates worldwide, by region and by standard.
Source: ISO Survey 2024 · IAF CertSearch · Data year: 2024 · World total: 2,963,855 · In every region, the standard with the most certificates is ISO 9001.
One international operation with a presence in 97 countries. In the Americas, each country is served directly, with a local audit team, or by consultation, assessed case by case.
Local audit team and assigned account executive.
Request assessed case by case.
Coverage communicates scope and availability. The accredited scope by standard is published in the Trust Center.
Applied explanations on certification, auditing and management systems.
ISO 9001:2015 requirements explained clause by clause, with the evidence a third-party audit reviews and the steps to obtain the certificate.
ReadSeven risk areas to review with evidence before an ISO 9001 audit. They are not a ranking or automatic findings: each nonconformity requires an applicable criterion and objective evidence.
ReadEight checks for comparing certification bodies: identity, scope, accreditation, impartiality, competence, program, traceability and contractual terms.
ReadThe idea that certification is only for large companies holds back many SMEs that already do things well. The reality is more accessible than it seems.
ReadA field guide for arriving at the audit with a clear scope, evidence at hand, prepared owners and a system that can be explained without window dressing.
ReadA guide to understanding when information technologies can support an audit, how their feasibility is assessed and what evidence must be preserved without degrading the integrity of the process.
ReadBusiness customers no longer ask whether you take security seriously. They ask for evidence. ISO/IEC 27001 provides it.
ReadAI has moved from experiment to infrastructure. A management framework makes it possible to scale it while maintaining traceability and control.
ReadA brief amendment with a concrete effect: climate change explicitly enters the context of the organization.
ReadEach entry opens the original in its outlet.
Archive: 792 pieces · 218 outlets · 2024 – 2026
The words you will find in a proposal, an audit report or a certificate, with their definition, the clause they come from and an example.
Third-party attestation that a conformity assessment body is competent to perform specific tasks. It is granted by an accreditation body, independent of the certifier.
ISO/IEC 17000:2020, 7.7Third-party attestation related to a conformity assessment object, in this case a management system.
ISO/IEC 17000:2020, 7.6Description of the activities, products, services and sites covered by the certification. What is not included in the scope is not certified.
ISO/IEC 17021-1:2015, 9.1.2Resolution adopted by a person or committee other than those who performed the audit, on granting, maintaining, renewing, extending, reducing, suspending or withdrawing certification.
ISO/IEC 17021-1:2015, 9.5Presence of objectivity: absence of conflicts of interest, or their resolution in a way that does not influence the body’s activities.
ISO/IEC 17021-1:2015, 3.2Periodic audit, at least annual, that verifies the certified system remains compliant during the cycle.
ISO/IEC 17021-1:2015, 9.6.2Audit performed before the certificate expires to confirm continued conformity and renew the cycle.
ISO/IEC 17021-1:2015, 9.6.3Recognition of a valid accredited certification issued by another body, to continue the cycle with the receiving body.
IAF MD 2Systematic, independent and documented process for obtaining objective evidence and evaluating it against audit criteria.
ISO 19011:2018, 3.1Records, statements of fact or other information relevant to the audit criteria and verifiable.
ISO 19011:2018, 3.8Result of evaluating the evidence gathered against the criteria. It can indicate conformity, nonconformity or an opportunity for improvement.
ISO 19011:2018, 3.10Failure to meet a requirement. In certification it is classified as major (affects the system’s capability) or minor (isolated deviation).
ISO 9000:2015, 3.6.9Action to eliminate the cause of a nonconformity and prevent its recurrence. It is not the same as an immediate correction.
ISO 9000:2015, 3.12.2First part of the initial audit: reviews documentation, context and the organization’s readiness for stage 2.
ISO/IEC 17021-1:2015, 9.3.1.2Evaluation of the implementation and effectiveness of the management system, on-site or remote, with evidence for each requirement.
ISO/IEC 17021-1:2015, 9.3.1.3Audit that uses information and communication technologies to obtain evidence without physical presence, when feasible and justified.
IAF MD 4Common structure of ISO management system standards: the same clauses 4 to 10, base terms and core text, to facilitate integration.
ISO/IEC Directives, Part 1, Annex SLExternal and internal issues relevant to the organization’s purpose that affect its ability to achieve intended results.
Clause 4.1 (Annex SL)Person or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity.
ISO 9000:2015, 3.2.3Information the organization must control and maintain, and the medium that contains it. It replaces “documents” and “records”.
ISO 9000:2015, 3.8.6Periodic evaluation by top management of the system’s performance, with defined inputs and recorded decisions.
Clause 9.3 (Annex SL)Recurring activity to improve performance. It is evidenced by measurable actions and results.
ISO 9000:2015, 3.3.2The organization’s intentions and direction regarding quality, formally expressed by top management.
ISO 9001:2015, 5.2Results to be achieved, consistent with the policy, measurable, with an owner, deadline and follow-up.
ISO 9001:2015, 6.2Identification and control of products or services that do not meet requirements, to prevent their unintended use or delivery.
ISO 9001:2015, 8.7Information security management system: part of the overall system that establishes, implements, maintains and improves information security.
ISO/IEC 27000:2018, 3.62Reference list of information security controls that the organization compares against its risk treatment.
ISO/IEC 27001:2022, Annex ADocument stating which controls apply, their justification and status, and which are excluded and why.
ISO/IEC 27001:2022, 6.1.3 d)Element of an organization’s activities, products or services that interacts or can interact with the environment.
ISO 14001:2015, 3.2.2Source with the potential to cause injury and ill health.
ISO 45001:2018, 3.19No definition replaces the official text of the standard.
Short answers. Each links to the page that resolves the case.
G-CERTI's accreditation chain and its current scope are published under accredited scope, together with the source and date of the data. The scope must be checked there before presenting a certification to clients, tenders or authorities, and every certificate issued is verified by its code in the verifier.
G-CERTI certifies management systems within its current accredited scope and, as a third party, other standards published in its catalogue, including ISO/IEC 42001. Each standard's page states its certification route.
Yes. The transfer process is assessed against IAF MD 2. G-CERTI reviews the current certificate, the issuing body, the scope, the audit reports, any open nonconformities and the applicable conditions before confirming whether the transfer is viable. It is not approved automatically.
A report is issued listing the nonconformities found, classified as applicable. The organization implements corrective actions and provides closure evidence. The closure is then reviewed and, if appropriate, the process continues with the certification decision and the issuance of the certificate.
Certification is independent of consulting. In accordance with ISO/IEC 17021-1, a certification body maintains strict separation from consulting to the organizations it certifies, to protect the impartiality of the process. Any implementation support is provided by independent third parties, separate from the certification process.
The certificate number is entered on the verification page. The automated lookup searches for the code in G-CERTI's registry; if no result appears or context is needed, assisted verification confirms it in writing within 48 business hours.
Yes. G-CERTI certifies ISO/IEC 42001 as a third party: an audit of artificial intelligence governance and a certificate verifiable by its code.
Yes. Integrated audits allow two or more standards to be reviewed under a single program when the scope, technical compatibility and applicable rules allow it. Common combinations include ISO 9001 + ISO 14001 + ISO 45001, or ISO/IEC 27001 + ISO 22301.
The audit and issuance timeline is set out in the proposal, based on the standard, the size of the organization, the number of sites, complexity, documentation maturity and availability. Prior implementation of the management system is additional; there is no universal timeframe for all cases.
Six stages: 1) application and scope, 2) documentation review, 3) stage 1 audit (documentary), 4) stage 2 audit (on-site or remote), 5) file review and decision by a competent function separate from the audit team, 6) issuance of the verifiable certificate when applicable.
It depends on the standard. In general: a management policy, measurable objectives, a system manual (if applicable), the documented procedures required by the standard, and the records evidencing implementation. A checklist specific to the chosen standard is provided when the process begins.
Yes. In accordance with IAF MD 4, remote or information-technology-based audits are used when they are technically feasible and justified for the scope involved. The remote proportion depends on the standard, sites, processes, risk and applicable rules.
The certificate is valid for 3 years. During that period, annual surveillance audits are carried out to verify the maintenance of the management system. At the end of the cycle, a recertification audit is performed.
By reading the certificate issued, the applicable public registry and the requirements of the client or authority requesting it. Looking only at the name of the standard is not enough: the holder, activity, sites, validity, standard and scope must all match.
Recognition depends on the accreditation chain, the scope of the certificate and the rules applicable to the target market. It is presented as a reference framework, with case-by-case verification of its acceptance.
It may be valid when the tender specifications accept the standard, the scope, the issuing body and the corresponding accreditation chain. Acceptance is checked against the text of the tender, the certificate issued and the target market.
Applications and audits are coordinated by qualified personnel, and G-CERTI Co., Ltd. keeps the review, the final decision and the issuance control separate. The acceptance of each certificate depends on its scope, validity, accreditation chain and target market.
The cost is per project and depends on the standard, the size of the organization, the number of sites and the complexity of the processes. The proposal is defined after reviewing the scope, mode, country, sites and required cycle.
The proposal details the items included and the applicable additional conditions — audit mode, annual surveillance, scope changes, taxes and services not included. The financial scope is documented before the process begins.
Payment terms are defined by contract and country. Published amounts are expressed in USD, and the formal proposal documents the payment method, taxes and applicable conditions.
Integrated audits optimize time when the standards share structure, processes, sites and a compatible audit team. The optimization is defined according to the scope and applicable rules.
Available methods are stated in the corresponding proposal or invoice. They may include bank transfer, card or local options depending on country, legal entity and applicable conditions.
Yes. An invoice is issued in accordance with the corresponding legal entity and the tax regulations applicable in each country.
The proposal details all items included and any applicable additional conditions. Every item is documented before proceeding.
Impartiality in accordance with ISO/IEC 17021-1 and a traceable documentary review. The schedule is defined by contract according to scope, and acceptance of the certificate is interpreted against the applicable accredited scope; inconclusive cases go to assisted confirmation.
In accordance with ISO/IEC 17021-1, G-CERTI maintains a formal complaints and appeals procedure. The complaint is sent to info@gcerti.org or through the corresponding form. Each case is assessed through the defined path and answered according to the applicable procedure.
The certification decision may be appealed in accordance with the applicable procedure. The appeal is assessed by a body independent of the original audit team, with an objective and impartial review under ISO/IEC 17021-1.
Specialized diploma programs on ISO standards (9001, 14001, 45001, 27001, 42001, among others), Lead Auditor and Internal Auditor programs, and technical events. All include a training credential issued by G-CERTI; a training credential is not equivalent to the accredited certification of a company's management system.
Both modes are available. Online classes are live, with direct interaction. In-person classes are held in Buenos Aires. In-company training is also offered for teams.
Yes. The programs include an academic credential issued by G-CERTI Formación. It is verified by its code at gcerti.org. It is a training credential: it documents the person trained, while accredited certification is reserved for an organization's management system.
No, they are different. The credential documents the training completed by a person; certification assesses an organization's management system through third-party audit. They are separate processes.
G-CERTI is one international operation with a presence in 97 countries and service in the local language; one of its service locations is in Buenos Aires (Argentina). G-CERTI Co., Ltd. retains the final decision and issuance control, subject to the applicable standard and scope.
Operations are handled by G-CERTI's authorized representation, with separate functions: whoever audits does not decide, and the certification decision is made by the issuer (G-CERTI Co., Ltd.).
Third-party certification remains independent of consulting and training. Its authority rests on traceable accreditation and on documentary verification mechanisms with assisted confirmation when applicable.
If your question is not on this page, the way forward is to write to the team: a technical conversation defines scope, timing and the next step.

Tell us the standard, the scope and your deadline. We reply in writing with what is assessed and how long it takes.