Clause Explorer

A short pre-award assessment of whether a new supplier or a new location can realistically deliver the part before the business is committed.

How a new-part project is planned, resourced, and steered so it lands on time, on cost, and at the required quality.

Extra controls on what you buy and who tests it: competent laboratories, emergency purchasing, specification reviews and, for some categories, prohibited-substance and recycled-packaging rules.

Labels must be legal in the country of sale, every claim must be provable, and anyone printing their own labels needs artwork and print controls.

A threat assessment and a food defence plan, built by competent people, integrated into the FSMS and kept current.

A vulnerability assessment and a mitigation plan for economically motivated adulteration, substitution and mislabelling, built by competent people and integrated into the FSMS.

The logo and any reference to your certified status may be used for marketing only — never on the product, its label, its packaging or its certificates.

A documented allergen plan with a full allergen list, a cross-contact risk assessment, validated and verified controls, testing where profiles share a line, disciplined use of precautionary labels, and training for everyone.

A risk-based programme that samples the processing environment, trends the data, and is reviewed on defined triggers — for BIII, C, I and K.

Senior management must set culture objectives, resource them, back them with a dated plan, review them, and show that commitment reaches every employee.

A quality policy and objectives, product quality parameters and release, quantity control with calibrated equipment, and line clearance at start-up and changeover.

FEFO as well as FIFO stock rotation, post-slaughter time and temperature limits for C0, and risk-based cleaning controls for bulk tankers.

Foreign-matter management with a justified choice of detection equipment and breakage controls, plus specific rules for functional packaging, lairage inspection and feed additives.

Routine, risk-based site inspections that confirm the site, environment and equipment stay fit for food safety — now including catering and retail.

A documented design and development procedure for new products and for changes to products or processes, with trials, shelf-life verification, validated cooking instructions and packaging design principles.

Slaughter operations must keep every edible part of a carcass — blood included — traceable until the carcass is declared fit for human consumption.

A purchase specification that covers hygienic design before equipment is bought, and risk-based change management with commissioning evidence for new or changed equipment.

A documented policy and objectives with measurable targets and timelines for reducing food loss and waste, plus controls that keep donated and surplus product safe.

Serious events that threaten food safety, legality or the integrity of the certificate must be reported to your CB within three working days and handled through your emergency process.

For multi-site organisations (BIII, E, F, G): a resourced central function, an annual internal audit programme covering every site, and internal auditors who meet defined experience, education and training criteria.

The up-front planning that turns customer requirements into a defined product and a defined manufacturing process — the 'what we will make and how' stage.

Confirmed in the published text: clause 3 now carries twenty core management-system terms of its own — organisation, interested party, top management, management system and quality management system, policy and quality policy, objective and quality objective, risk, process, competence, documented information, performance, continual improvement, effectiveness, requirement, conformity, nonconformity, corrective action, audit, measurement and monitoring — with ISO 9000 remaining the normative vocabulary behind them. The 2015 edition defined nothing locally. One deliberate gap matters: 'opportunity', which now carries its own sub-clause in 6.1, is still not defined in either document. Annex A.2 adds working clarifications of six word pairs the requirements turn on — appropriate versus applicable, consider versus take into account, continual versus continuous, what 'ensure' means, the two documented-information phrasings, and 'strategic direction'.

Carrying out the plan from P3 — actually building the product and the process, validating them, and confirming readiness for series production.

Know the world your business operates in — the outside pressures and internal realities that help or hurt your ability to deliver quality — and keep that picture current.

Working out the bigger picture around your business — the external and internal issues that can affect how well your environmental management actually performs.

Working out the internal and external factors that can help or hinder your ability to keep people safe and run a working OH&S system.

Step back and map the bigger picture around your operation - the things outside and inside the factory that can help or hurt your ability to make safe food.

The context requirement itself carries over from 2015: determine the external and internal issues relevant to your purpose, strategic direction and QMS. What changes is one named issue — climate change. You must now determine whether climate change is a relevant issue for your organisation and record a conclusion either way. This is already mandatory: the February 2024 amendment inserted it into 9001:2015 ahead of the full 2026 revision, so the 2026 text confirms rather than introduces it.

Working out which internal and external issues shape your ability to protect information — the business you are in, the technology you depend on, the threats you face, the law you work under — and, since Amendment 1 (2024), whether climate change is a relevant issue.

Know who has a legitimate stake in your quality — customers, authorities, employees, suppliers, owners — and what each of them actually requires of you.

Identifying who cares about your environmental performance — regulators, neighbours, customers, staff — and deciding which of their needs and expectations you will treat as your own obligations.

Identifying who has a stake in your health and safety performance, including your own workers, and deciding which of their needs you will treat as requirements.

Work out who has a stake in your food being safe - customers, regulators, your supply chain, consumers - and what each of them legitimately requires of you.

The mechanics carry over from 2015: determine the interested parties relevant to the QMS and their relevant requirements. The 2026 text (in force since the 2024 amendment) adds a note-level nudge with practical teeth: interested parties can have climate-related requirements, and your register is expected to show they were considered. Customers asking for emissions data with quotations, insurers and lenders imposing site conditions, and regulators tightening energy or reporting rules are the everyday forms this takes. The published text also adds one small new determination: for each interested-party requirement, which of them your QMS will actually address — so the register needs a column, not just a list.

Listing who has a stake in how you protect information — customers, regulators, employees, suppliers, insurers, owners — what each of them requires of you, and which of those requirements the ISMS will address.

Draw the boundary honestly: which products, sites and processes your QMS covers — and justify anything you claim does not apply to you.

Drawing a clear boundary around what your EMS covers — which sites, activities, products and services are in, and being honest about it.

Defining clearly what activities, sites, people and processes your safety system actually covers, in writing.

Be clear and honest about exactly which products, processes and sites your food-safety management system covers.

Draw the boundary honestly: which products, sites and processes your QMS covers — and justify anything you claim does not apply to you.

Drawing the boundary of the ISMS — which parts of the organisation, which locations, which systems and information, and which interfaces with other organisations are inside — and writing it down.

IATF closes the scope loopholes: supporting functions — on site or remote (head office, design centres, distribution) — must be inside the QMS, and the ONLY permitted exclusion is product design (8.3), never manufacturing process design.

Every automotive customer adds their own rulebook (CSRs) on top of IATF — these must be evaluated and woven into your QMS, not filed and forgotten.

Run the business as a set of connected processes — each with an owner, inputs, outputs, performance measures and risks — supported by the documents and records they need.

Actually establishing, running and improving the EMS as a connected set of processes — not a binder of procedures, but how the place really works environmentally.

Having an actual system of connected processes for managing health and safety, not just a folder of documents.

Treat your PRPs, HACCP plan, procedures and records as one joined-up system of processes - not a pile of separate documents.

Run the business as a set of connected processes — each with an owner, inputs, outputs, performance measures and risks — supported by the documents and records they need.

The requirement to actually have a system — establish it, run it, maintain it and keep improving it — including the processes it is made of and how they interact, not a folder of policies.

You are accountable for the conformity of everything you supply — including outsourced processes and service/spare parts — to every customer, statutory and regulatory requirement.

Safety-related products and characteristics demand documented, end-to-end management — from identification and special approvals to trained people, traceability and cascading the requirements down your supply chain.

How the supplier manages its own sub-suppliers so that purchased material and services do not become the weak link in the chain.

Top management owning the EMS for real — resourcing it, steering it, and being seen to care about environmental performance, not delegating it to one overworked coordinator.

Top management visibly owning health and safety and being accountable for it, not delegating it away to a safety officer.

Top management must visibly drive food safety, not delegate it entirely to the technical team and walk away.

What top management must personally do for the ISMS — set the direction, fund it, integrate it into how the business runs, make people accountable and keep asking whether it works — rather than delegate it to IT.

Top management must personally own the QMS — accountable for whether it works, not spectators who delegated quality to the quality manager.

The 2015 list of top-management commitments carries over — policy and objectives aligned to strategy, integration into business processes, resources, communication, results, accountability. The published 2026 edition grows the list from ten commitments to twelve. New: leadership must demonstrably promote a quality culture and ethical behaviour — the most talked-about change of the revision, with a note explaining that culture and ethics show in shared values, attitudes, practices and actions. Also new: promoting risk-based thinking is now paired with promoting opportunity-based thinking, matching the 6.1 restructure. What was previously implied becomes an explicit commitment with a light evidence trail: culture and ethics are things top management does visibly, not values framed in reception.

The company must define and live corporate responsibility policies — at minimum an anti-bribery policy, an employee code of conduct, and an ethics escalation ('whistle-blower') policy.

Top management must review not only whether processes work (effectiveness) but what they cost in waste and resources (efficiency) — and the results must reach management review.

Every QMS process needs an identified owner who understands the role and is competent to do it — names, not vague departments.

Leadership must make sure customer requirements — including the legal ones — are understood and met, the risks to conformity are managed, and enhancing customer satisfaction stays the visible aim.

Leadership must make sure customer requirements — including the legal ones — are understood and met, the risks to conformity are managed, and enhancing customer satisfaction stays the visible aim.

A quality policy that genuinely fits your business: a frame for objectives, a commitment to meeting requirements and improving — written, communicated, understood and applied, not laminated and ignored.

A short, signed statement of your environmental intent — including commitments to protect the environment, meet your obligations and keep improving — that genuinely guides the business.

A short top-level statement, signed by leadership, committing the business to safe working, legal compliance, worker consultation and continual improvement.

A short, clear statement from leadership of their commitment to making safe food - communicated, understood and actually lived.

A quality policy that genuinely fits your business: a frame for objectives, a commitment to meeting requirements and improving — written, communicated, understood and applied, not laminated and ignored.

A short, top-level statement of what information security means for your organisation and what leadership commits to — appropriate to your purpose, including or framing your objectives, promising to meet applicable requirements and to keep improving — communicated inside and available to interested parties as appropriate.

Everyone with a QMS role must know it — responsibilities assigned, communicated and understood, including who ensures conformity, who reports on QMS performance, and who guards system integrity during changes.

Making sure everyone knows their part in the EMS — who is responsible for what, and who has the authority to report on how the system is performing.

Making sure everyone knows who is responsible and accountable for which parts of safety, and that they have the authority to act.

Everyone with a part in food safety should know their responsibilities, and one named person must lead the food-safety team.

Everyone with a QMS role must know it — responsibilities assigned, communicated and understood, including who ensures conformity, who reports on QMS performance, and who guards system integrity during changes.

Making sure the jobs that keep the ISMS working are assigned to named people with the authority to do them, and that everyone knows who holds them — including the two the standard singles out: making the ISMS conform, and reporting on its performance to top management.

Top management must put names against the customer-facing duties: special characteristics, quality objectives and training, corrective and preventive actions, product design and development, capacity analysis, logistics, customer scorecards and customer portals.

The people responsible for product conformity must have the power to stop shipment and stop production to contain a problem — on every shift — and nonconforming product must not move without proper disposition.

Genuinely involving workers, especially non-managers, in building and running the safety system, and removing the barriers that stop them speaking up.

The heart of the audit — a structured walk of the actual series production process to judge how robustly it makes conforming parts, broken into six sub-elements.

Before things go wrong, work out what could — and what could go right — and plan actions proportionate to the impact on your product and customers.

Think ahead about what could undermine your food-safety system as a whole, and what could strengthen it, then plan to deal with both.

Whether everything the process needs to start correctly — released material, approved tooling, valid data, and confirmed requirements — is actually in place at the point of use.

Pulling together your context, interested parties, aspects and obligations to decide which risks and opportunities your EMS must plan around — heading off problems and capturing the improvements worth pursuing.

Planning the safety system around the risks and opportunities you have identified, taking your context, interested parties and scope into account.

The starting point of the restructured 6.1: take the issues from 4.1 and the interested-party requirements from 4.2 and work out which risks and which opportunities the QMS has to deal with — so the system gives the results it should, undesired effects are prevented or reduced, desired effects are enhanced, and improvement happens. In 2026 this determination stands on its own, ahead of two separate sub-clauses on what to do about each half.

The planning principle behind the whole ISMS: use what you learned about context and interested parties to decide what could stop the ISMS achieving its outcomes, what could help, and what you will do about both.

Identifying how your activities, products and services touch the environment, judging which of those interactions matter most, and keeping that list current — with a lifecycle view.

Systematically finding the hazards in your work and judging the risk they pose to people, including risks from the system itself and chances to improve.

Risks now have a sub-clause of their own. Having determined them, you analyse and evaluate each one, plan actions proportionate to its potential impact on conformity and customer satisfaction, build those actions into the QMS processes, and evaluate whether they worked. No risk method is prescribed — proportionality is the rule — and a note reminds you that risks include those arising during and after a disruption.

Defining one repeatable method for finding, analysing and ranking information security risks — with written criteria for what is acceptable and how assessments are done — and applying it so that two people assessing the same risk get comparable results.

Risk analysis must include, at minimum, the hard lessons: product recalls, audit findings, field returns and complaints, scrap and rework — learn from what has already hurt you.

Stop problems before they occur: a defined process to find potential nonconformities and act on them proportionate to their impact — including using lessons learned from similar processes elsewhere.

Plan for the bad days: documented, tested contingency plans for whatever could interrupt supply — equipment failure, utility interruption, labour shortage, key supplier failure, cyber-attack — so the customer keeps receiving conforming parts.

Knowing every environmental legal requirement and other commitment that applies to you, having access to them, and understanding what each one means for your operation.

Knowing which safety laws and other obligations apply to you, keeping that list current, and understanding what each one actually requires.

The change that ends the empty opportunities column. Opportunities get a sub-clause parallel to the one for risks: analyse and evaluate them, plan actions appropriate to your context and to the results you want, integrate the actions into QMS processes, and evaluate whether the benefit landed. The standard still does not define 'opportunity', so your process has to.

Deciding what to do about each risk that breaches your acceptance criteria, choosing the controls that will do it, checking the choice against Annex A, and recording all of it in the Statement of Applicability and a treatment plan the risk owners sign off.

Turning your significant aspects, compliance obligations and risks into concrete planned actions — and building those actions into how the business actually runs.

Turning your identified risks, opportunities and obligations into concrete actions and building them into your processes.

Set measurable quality objectives where they matter — relevant functions, levels and processes — consistent with the policy, and plan concretely how each will be achieved: what, who, when, with what, and how judged.

Setting measurable environmental goals for the functions that matter and laying out a real plan — what, who, when, resources and how you will judge success.

Setting measurable safety goals that flow from your policy and risks, then planning realistically how you will reach them.

Set clear, measurable food-safety goals at relevant levels and plan how you'll reach them.

Whether the sequence of operations and the flow of material through the plant are defined, controlled, and protect the product from mix-ups and damage.

Set measurable quality objectives where they matter — relevant functions, levels and processes — consistent with the policy, and plan concretely how each will be achieved: what, who, when, with what, and how judged.

Setting measurable information security objectives at the right levels, consistent with the policy and informed by the risk work, with a plan for each — what, who, when, which resources and how you will know it worked — then monitoring and updating them.

Objectives must include customer expectations, be achievable in defined timeframes, and be reviewed at least annually by top management — automotive customers expect their targets inside your targets.

Change the QMS deliberately, never by drift: consider why, what could go wrong, who needs resources and where responsibilities move — before the change, not after the chaos.

New in ISO 14001:2026 — when you change your EMS, plan the change on purpose: its intent, consequences, resources and responsibilities, so an improvement in one area doesn't create an environmental risk in another.

When you change something that touches food safety, plan it deliberately so the change doesn't introduce new hazards.

Whether the people running the process are competent, qualified for their tasks, and available in sufficient numbers — including for special tasks and shifts.

The clause is not new — 2015 already required QMS changes to be planned: purpose and consequences, system integrity, resources, responsibilities. The 2026 edition keeps all of that and closes the loop with three additions to what must be planned up front: how the change will be communicated to the people it affects, how its effectiveness will be monitored and evaluated, and how the results will be reviewed. 'We made the change' stops being the finish line; 'we confirmed it did what we intended' becomes the standard.

New in the 2022 edition: when you decide the ISMS needs to change — a new scope, a new cloud platform, a reorganisation, a new control framework — carry the change out in a planned way rather than letting it happen.

Whether the machines, tooling, gauges, and material handling are capable, maintained, and properly managed so the process can hold its requirements.

Whether the process is actively steered using its own data — targets, key figures, problem-solving, and continual improvement — so it stays in control and improves.

Whether what actually leaves the process — quantity, quality, on-time delivery, and final release — meets the customer's requirements.

How the supplier handles the customer relationship after the part ships — requirements, complaints, field performance, service parts, and overall satisfaction.

Providing what the EMS needs to run and improve — people, time, money, infrastructure and monitoring equipment.

Providing the people, time, money and equipment needed for the safety system to actually work.

Make sure you've got the right staff, buildings, equipment and working conditions - including external help - to keep food safe.

Determining and providing what the ISMS needs to be established, run, maintained and improved — people, time, money, tools and expertise — rather than expecting IT to absorb it.

Provide the resources the QMS actually needs — money, people, equipment, time — looking honestly at what you have, what constrains you, and what must come from outside.

Provide the resources the QMS actually needs — money, people, equipment, time — looking honestly at what you have, what constrains you, and what must come from outside.

Provide and maintain the buildings, equipment, utilities, transport and IT your processes need to make conforming product — maintained being the operative word.

Provide and maintain the buildings, equipment, utilities, transport and IT your processes need to make conforming product — maintained being the operative word.

Plant layout and equipment plans must be developed cross-functionally using risk thinking and lean principles — optimise material flow and value-add, and re-evaluate whenever capacity or processes change.

Provide and maintain the working environment your processes need for conforming product — the relevant mix of physical conditions and, where it genuinely affects quality, the human climate.

Provide and maintain the working environment your processes need for conforming product — the relevant mix of physical conditions and, where it genuinely affects quality, the human climate.

Keep premises in order: clean, orderly and in good repair, consistent with product and process needs — institutionalised housekeeping, automotive style.

Making sure the instruments and methods you use to check product are themselves trustworthy — the right tool, working properly, calibrated where it matters.

Making sure the instruments and methods you use to check product are themselves trustworthy — the right tool, working properly, calibrated where it matters.

Knowing your gauge is calibrated is not enough — MSA asks whether the whole measurement SYSTEM (gauge + operator + method + environment) can actually distinguish good from bad on each control-plan measurement.

Calibration records must tell the full story: traceable standards, as-found/as-left readings, and — critically — documented assessment of product risk whenever an instrument is found out of specification.

Internal labs need a defined scope and demonstrated competence for every test they perform; external labs must be accredited (ISO/IEC 17025 or national equivalent) or specifically customer-approved.

Capture and protect the knowledge your business runs on — the recipes, fixes and customer quirks living in people's heads — and plan how to gain what you will need next.

Capture and protect the knowledge your business runs on — the recipes, fixes and customer quirks living in people's heads — and plan how to gain what you will need next.

Make sure everyone whose work affects quality can actually do their job — define what competent means per role, check against it, close gaps, and prove it with records.

Making sure people whose work affects the environment, or your compliance, are genuinely capable — through the right mix of education, training and experience.

Making sure everyone whose work affects safety is genuinely trained and capable, and keeping proof of it.

Anyone whose work affects food safety must be properly competent - through training, experience or education - and you must prove it.

Make sure everyone whose work affects quality can actually do their job — define what competent means per role, check against it, close gaps, and prove it with records.

Knowing which jobs affect information security, deciding what competence each of them needs, making sure the people in them have it — by education, training or experience — closing gaps, and keeping the evidence.

A documented training process covering awareness and competence needs (including customer requirements), plus structured on-the-job training for any new or changed role affecting quality — down to contract and agency staff.

Internal auditors must be demonstrably competent for what they audit — system, process or product — with documented criteria covering audit approach, automotive process thinking, CSRs, core tools and the standards themselves, and competence maintained over time.

The people you send to audit your suppliers must meet documented competence requirements too — supplier audits done by the unqualified create risk, not assurance.

Everyone working under your control — including contractors — must know the policy, their relevant objectives, how they contribute to quality, and what it costs when requirements are not met.

Everyone on site understanding the environmental policy, the significant aspects they affect, how they contribute, and what happens if they ignore the rules.

Making sure workers understand the hazards around them, the policy, their part in safety, and what can go wrong if controls fail.

Everyone on site should understand the food-safety policy, why their work matters, and the consequences of getting it wrong.

The 2015 core carries over: people doing work under your control must be aware of the quality policy, the objectives relevant to them, their own contribution, and what it means when requirements are not followed. The 2026 edition extends awareness to the quality-culture and ethical-behaviour expectations now placed on leadership in 5.1.1 — so the culture thread runs through the whole workforce, not just the top table. Leadership promising an open, ethical quality culture that the shop floor has never heard of is exactly the gap this closes.

Making sure every person working under the organisation's control knows the information security policy, how their own behaviour contributes to the ISMS — and what better security buys the organisation — and what happens when they or the organisation fail to conform.

People must demonstrably know their impact on quality and the risks of bad product reaching the customer — and the company must actively work on motivation and empowerment, including making improvement everyone's business.

Decide deliberately how the QMS communicates — what gets said, when, to whom, how and by whom — internally and externally, instead of leaving it to corridor chance.

Handling environmental information both ways — telling the right people inside and outside what they need to know, and properly receiving and responding to what comes in.

Having clear arrangements for safety communication, both within the business and with outside parties, that work in both directions.

Set up reliable communication - with suppliers, customers, regulators and your own teams - so food-safety information flows when it needs to.

Decide deliberately how the QMS communicates — what gets said, when, to whom, how and by whom — internally and externally, instead of leaving it to corridor chance.

Deciding what information security communication the organisation needs, internally and externally — what is said, when, to whom and how — so that policy changes, incidents, breach notifications and customer assurances do not depend on improvisation.

Keep the documents the standard and your own processes need — created properly, identified, current, available where the work happens, protected, and with records that cannot quietly change.

Keeping the documents and records your EMS needs under control — current, available where used, protected, and properly versioned.

Keeping the documents and records your safety system needs, controlling them properly, and making sure people use the current version.

Keep the documents and records your food-safety system needs - current, available, protected and under control.

Keep the documents the standard and your own processes need — created properly, identified, current, available where the work happens, protected, and with records that cannot quietly change.

Having the documents and records the standard explicitly requires, plus whatever your organisation decides it needs for the ISMS to work — scaled to your size, your activities and the competence of your people.

Your QMS must be documented as a quality manual (one document or a set) including scope, documented processes, their sequence and interactions, and a matrix showing where customer-specific requirements are addressed.

When ISMS documents are created or changed, giving them proper identification, a suitable format and medium, and a review and approval step so people can trust what they are reading.

Keeping ISMS documents and records available where needed, protected against loss of confidentiality, misuse and corruption, and managed through distribution, storage, change, retention and disposal — including documents from outside that you rely on.

A defined retention policy sized to automotive reality: production part approvals, tooling records, design records and purchase orders kept for the production life plus one calendar year — minimum — unless the customer or law says longer.

When a customer engineering standard or spec changes, you must have a documented process to review, distribute and implement it fast — within the timeframe the customer sets, or two weeks if they set none — including updating your own documents and records of the change.

Plan how each product gets made before making it: requirements, criteria for processes and acceptance, resources, controls, and the records that will prove it was done right.

Putting real controls on the activities tied to your significant aspects — including how you manage outsourced processes and the lifecycle of your products and services.

Plan, carry out and control the day-to-day processes needed to make safe product, and manage any planned or unplanned changes to them.

Plan how each product gets made before making it: requirements, criteria for processes and acceptance, resources, controls, and the records that will prove it was done right.

Running the processes that deliver information security day to day — to criteria you have set, with the records to prove it, with changes controlled and with the suppliers and cloud services you depend on under control too.

Product planning must include customer requirements and technical specs as inputs, plus logistics, feasibility, project planning and acceptance criteria — and you must keep customer projects and product information confidential.

Putting the controls from your risk planning into day-to-day operations, and making sure work happens within them.

Choosing controls in the right order, starting with getting rid of the hazard and only using PPE as a last resort.

Assessing the safety impact of changes before you make them, so a new machine, layout or process does not introduce fresh hazards.

Making sure what you buy, the contractors you bring in, and the work you outsource all meet your safety requirements.

Being ready for the environmental emergencies that could realistically happen — spills, fires, leaks — with planned responses you have actually practised.

Planning for the emergencies that could realistically happen, and testing that your response actually works.

The basic hygiene and operating conditions - cleaning, pest control, maintenance, personal hygiene, allergen segregation - that keep the whole environment fit to make food.

Actually performing the risk assessment defined in 6.1.2 — at planned intervals and whenever significant change is proposed or happens — and keeping the results.

Define how you talk with customers: product information, enquiries and orders, feedback and complaints, handling their property, and contingency requirements when relevant.

Define how you talk with customers: product information, enquiries and orders, feedback and complaints, handling their property, and contingency requirements when relevant.

Before you promise, know what you are promising: capture all requirements (stated, unstated-but-necessary, statutory), review that you can actually meet them, and manage changes so everyone works to the same requirement.

Before you promise, know what you are promising: capture all requirements (stated, unstated-but-necessary, statutory), review that you can actually meet them, and manage changes so everyone works to the same requirement.

Whatever the customer marks as special — safety, fit, function, regulatory — must be identified, documented and controlled exactly as they require, with their symbols and approval rules followed.

Before accepting new or changed work, a multidisciplinary team must analyse whether you can actually make it — to spec, at rate, at capacity — and the analysis must be evidenced.

Be able to trace ingredients, packaging and product one step back and one step forward, fast enough to act in a recall.

Implementing the risk treatment plan from 6.1.3 — putting the chosen controls in place, on time, by the people named — and keeping the results.

If you design products (or under IATF, processes), do it as a managed project: defined stages, reviews, verification and validation activities, clear responsibilities, the right people, and records throughout.

If you design products (or under IATF, processes), do it as a managed project: defined stages, reviews, verification and validation activities, clear responsibilities, the right people, and records throughout.

IATF widens design to include manufacturing process design and demands a documented D&D procedure; planning must include all affected stakeholders — APQP in all but name.

People doing design must be competent in the applicable tools and techniques; products with embedded software need a documented software quality assurance process with capability assessment.

Gather everything the design must satisfy before designing: functional and performance requirements, lessons from previous designs, statutory rules, standards, and the consequences of failure — complete, unambiguous, conflicts resolved.

Gather everything the design must satisfy before designing: functional and performance requirements, lessons from previous designs, statutory rules, standards, and the consequences of failure — complete, unambiguous, conflicts resolved.

IATF specifies the input lists: for product design — requirements from contract review, targets for quality/life/reliability/cost, customer make/buy intent, lessons learned; for process design — product outputs, capacity targets, error-proofing methods, and experience from previous developments.

Identify special characteristics through a defined process — from risk analysis, customer designations and your own knowledge — and carry them visibly through every document: drawings, FMEA, control plan, work instructions.

Control the design as it progresses: reviews to judge progress, verification that outputs meet inputs, validation that the product works in the real application — problems acted on, everything recorded.

Control the design as it progresses: reviews to judge progress, verification that outputs meet inputs, validation that the product works in the real application — problems acted on, everything recorded.

Measure design projects at defined stages and report to management (and customer if required); validate per customer requirements including any industry/government timing; run a prototype programme with control plan when the customer requires one.

Before shipping, products and processes must pass the customer's approval process (typically PPAP) — and you must apply the same discipline to your suppliers before their parts enter your approved product.

Design outputs must let the rest of the business succeed: meeting input requirements, adequate for production and service, including monitoring/measuring needs and acceptance criteria, and stating what is essential for safe, proper use.

Design outputs must let the rest of the business succeed: meeting input requirements, adequate for production and service, including monitoring/measuring needs and acceptance criteria, and stating what is essential for safe, proper use.

IATF specifies what design must hand over: for product — DFMEA, results, special characteristics, error-proofing, drawings/GD&T, service/repair information; for process — PFMEA, control plan, layout, work instructions, capacity analysis, process approval acceptance criteria and more.

Once designed, change carefully: identify and review every change, control it to prevent harm to conformity, and record changes, reviews, authorisations and actions.

Once designed, change carefully: identify and review every change, control it to prevent harm to conformity, and record changes, reviews, authorisations and actions.

Every design change after product approval gets evaluated for impact, validated before implementation, and where required by the customer — approved by them first; embedded software changes are documented at both software and hardware level.

Plan for the food-safety emergencies that could hit your site - power loss, flood, contamination, fire, supply failure - and test your response.

Everything you buy that ends up in or affects your product must conform — so evaluate, select, monitor and re-evaluate providers against defined criteria, and keep the records.

Everything you buy that ends up in or affects your product must conform — so evaluate, select, monitor and re-evaluate providers against defined criteria, and keep the records.

Supplier processes get included in your QMS scope where you control them; selection follows a documented process assessing risk, quality, delivery, cost and capability; customer-directed suppliers still get your controls applied.

Match your control effort to the risk: ensure purchased items cannot degrade your output, define controls for both the provider and the incoming result, and verify adequacy.

Match your control effort to the risk: ensure purchased items cannot degrade your output, define controls for both the provider and the incoming result, and verify adequacy.

Define your incoming verification process explicitly, and guarantee that all purchased products and services comply with the statutory and regulatory requirements of the countries of receipt, shipment AND customer destination.

Push your supply chain up the QMS ladder: unless the customer agrees otherwise, suppliers should be developed from basic conformity toward ISO 9001 certification and beyond (with automotive-software suppliers assessed appropriately).

Monitor supplier performance on defined indicators — delivered conformity, disruptions including field issues, delivery performance, premium freight — plus customer disruptions caused by suppliers; use second-party audits per your risk-based programme.

Act on what monitoring finds: prioritised supplier development based on performance and risk — and pass down to suppliers all applicable requirements, statutory/regulatory ones and special characteristics included, cascading the chain.

Tell suppliers exactly what you need before they supply it: the processes/products/services, approval rules, competence requirements, interactions, your monitoring of them, and any verification you or your customer will do at their site.

Tell suppliers exactly what you need before they supply it: the processes/products/services, approval rules, competence requirements, interactions, your monitoring of them, and any verification you or your customer will do at their site.

Running production under controlled conditions — people know what to make, how to make it, how to check it, and the equipment and environment are up to the job.

Before analysing hazards, gather the facts: describe your products and ingredients, define intended use, and draw and verify accurate process flow diagrams.

Running production under controlled conditions — people know what to make, how to make it, how to check it, and the equipment and environment are up to the job.

The control plan is the production rulebook: for every part (or family), at every phase — prototype, pre-launch, production — what is controlled, how, how often, by whom, and what happens when it goes wrong.

Operators work to standardised instructions they can actually use, in their language; every job set-up gets verified (first-off/last-off comparison where applicable); after any shutdown, verify before running.

Maintain production capability as a system: documented TPM with objectives and improvement, full lifecycle management of production tooling (in-house and at suppliers), and order-driven production scheduling fed by key planning information.

Know what every item is and its inspection status at every stage — and where traceability is required, be able to trace it, with records.

Identify every realistic biological, chemical, physical and allergen hazard, decide which are significant, and choose how to control each one (HACCP principle 1).

Know what every item is and its inspection status at every stage — and where traceability is required, be able to trace it, with records.

Traceability is risk-based but with teeth: documented analysis of traceability requirements per product, ability to identify nonconforming/suspect product clearly, and where customers require it, serialised or lot traceability that supports rapid containment.

Other people's property in your care — tooling, material, designs, data — gets identified, verified, protected, and any loss or damage reported to the owner with records kept.

Before relying on a control measure, validate it - show with evidence it's capable of achieving the level of hazard control you need.

Other people's property in your care — tooling, material, designs, data — gets identified, verified, protected, and any loss or damage reported to the owner with records kept.

Protect the product from the process of getting it to the customer: identification, handling, contamination control, packaging, storage, transmission/transport — preserved to the extent conformity requires.

Document the live plan for controlling significant hazards: critical control points and operational PRPs, their limits, how you monitor them, and what you do when they fail (HACCP principles 2-5).

Protect the product from the process of getting it to the customer: identification, handling, contamination control, packaging, storage, transmission/transport — preserved to the extent conformity requires.

Preservation gets automotive specifics: contamination control, detailed storage rules, cleaning, ESD where relevant — plus inventory management (FIFO expected), obsolescence control, and periodic stock condition assessment.

Your responsibility does not end at the gate: meet the post-delivery requirements that apply — warranty, service, recalls, disposal — scaled to risk, product life and customer requirements.

Your responsibility does not end at the gate: meet the post-delivery requirements that apply — warranty, service, recalls, disposal — scaled to risk, product life and customer requirements.

Information from service must flow back into manufacturing and design (including analysis where the customer requires), and where you have a service agreement with the customer, its centres must meet the agreed requirements.

Production changes — planned or forced — get reviewed and controlled so conformity survives, with records of the review, who authorised, and what actions followed.

Production changes — planned or forced — get reviewed and controlled so conformity survives, with records of the review, who authorised, and what actions followed.

Production changes get a documented process with risk-based validation before implementation and customer approval where required; temporary deviations from the control plan (the backup method when the poka-yoke breaks) come from an approved, customer-aware list with restoration discipline.

Nothing ships until planned verification proves it conforms — and the release record names the evidence and the person who authorised it.

After completing the control plan, refresh the supporting information - product specs, characteristics, flow diagrams and PRPs - so the system stays accurate.

Nothing ships until planned verification proves it conforms — and the release record names the evidence and the person who authorised it.

Layered automotive tightening: control-plan-defined release arrangements at all stages, evidence of statutory/regulatory conformity before release, and acceptance criteria — with sampling plans for attribute data set at zero-defect acceptance.

Periodically re-prove the whole part: layout inspection (every dimension) and functional verification per control plan and customer frequency — and for appearance parts, masters, evaluation conditions and qualified people.

Purchased product conformity gets assured by a defined mix: receiving inspection, supplier data with verification, assessments/audits, certificate review — your choice, but documented and risk-matched.

Bad product must not travel: identify it, control it, decide its fate (correct, segregate, contain, return, inform the customer, concession), verify corrections, and record what was found, done and decided — including who decided.

The thermometers, scales, metal detectors, pH meters and timers you rely on for food-safety decisions must themselves be accurate and verified.

Bad product must not travel: identify it, control it, decide its fate (correct, segregate, contain, return, inform the customer, concession), verify corrections, and record what was found, done and decided — including who decided.

Deviating from spec needs the customer's written word: concession/deviation approval before further processing, records of expiry and quantity, compliance with customer-specified processes, prompt customer notification when nonconforming product has shipped, and disposal rules that make unusable product truly unusable.

Suspect product is treated as nonconforming until proven otherwise; rework and repair follow risk-assessed, documented processes with customer approval where required, full traceability, and disposition records.

Check, by methods other than routine monitoring, that your PRPs and hazard control plan are implemented and effective (HACCP principle 6).

Deal properly with nonconformities and potentially unsafe product - contain it, correct it, fix the cause, and withdraw or recall when needed.

Decide what to measure, gather the data, and actually analyse it to judge how well your food-safety system is performing.

Deciding what you will measure to know whether the ISMS and its controls work — with methods that give repeatable results, set times, named people — then analysing the numbers and keeping them as evidence.

Decide what to measure, how, when, and when to analyse it — then actually evaluate QMS performance and effectiveness from the data, keeping the evidence.

Measuring what matters environmentally — the right parameters, with calibrated equipment — then analysing the results to judge how you are really performing.

Measuring how your safety system is actually performing, with the right indicators, calibrated equipment and proper analysis.

Decide what to measure, how, when, and when to analyse it — then actually evaluate QMS performance and effectiveness from the data, keeping the evidence.

Prove your manufacturing processes can do the job and stay capable: process studies on new processes, capability maintained as the control plan specifies, and the documented reaction plan executed when capability or stability slips — including 100% containment and customer notification when required.

Statistical methods are chosen deliberately during planning (APQP/PFMEA stage), included in the control plan — and the people using them actually understand variation, control, capability and over-adjustment.

Track how customers actually perceive you — not how you hope they do — using defined methods, and act on what the perception data says.

Actively checking that you are meeting your legal and other environmental obligations, at a planned frequency, and keeping the proof of your compliance status.

Regularly checking, and proving, that you actually meet the safety laws and other obligations that apply to you.

Track how customers actually perceive you — not how you hope they do — using defined methods, and act on what the perception data says.

Customer satisfaction gets measured by hard performance, continuously: delivered part quality, customer disruptions including field returns, delivery schedule performance (and premium freight), and customer notifications on quality or delivery issues — internal indicators verified against the customer's own portal view.

Turn your data into decisions: analyse and evaluate to judge conformity, satisfaction, QMS performance, planning effectiveness, risk actions, supplier performance and improvement needs.

Turn your data into decisions: analyse and evaluate to judge conformity, satisfaction, QMS performance, planning effectiveness, actions on risks and — separately — on opportunities, supplier performance and improvement needs.

Trends and performance data must drive the priority order of improvement actions — worst and most customer-critical first, visibly.

Audit your own system at planned intervals: does it meet your requirements and the standard's, and is it effectively implemented — with objective auditors, defined criteria, results to management, corrections without delay, and records.

Checking your own EMS at planned intervals — against the standard and your own arrangements — using objective auditors and acting on what they find.

Checking your own safety system at planned intervals, by impartial auditors, to confirm it meets the standard and is actually working.

Run planned internal audits to check the FSMS meets the standard and your own requirements, and is working in practice.

Audit your own system at planned intervals: does it meet your requirements and the standard's, and is it effectively implemented — with objective auditors, defined criteria, results to management, corrections without delay, and records. In the 2026 edition the programme sub-clause carries the title 'Internal audit programme' (9.2.2); the content is unchanged.

Auditing your own ISMS at planned intervals to find out two things: does it meet your own requirements and the standard's, and is it actually implemented and maintained in practice.

Planning the audits as a programme — frequency, methods, responsibilities, planning and reporting — weighted by what matters most and what went wrong last time, with objective auditors, defined criteria and scope for each audit, results reported to the right managers and records kept.

IATF demands a documented audit process and three distinct audit layers over each three-year cycle: full QMS audits (CSRs sampled in), manufacturing process audits covering all shifts (with process approach effectiveness, PFMEA/control plan adherence), and product audits at appropriate stages — programme prioritised by risk, performance and changes.

Leadership reviews the whole QMS at planned intervals against a defined input list and produces real decisions: improvement opportunities, change needs, resource needs — minuted and retained.

Top management formally stepping back at planned intervals to judge whether the EMS is still suitable, adequate and effective — and deciding what to change.

Top management formally stepping back at planned intervals to judge whether the safety system is working and decide what to change.

Leadership periodically reviews the whole FSMS using real data, and decides on changes, resources and improvements.

The steering meeting keeps its 2015 shape — top management, planned intervals, continuing suitability, adequacy, effectiveness and alignment with strategic direction — but the published text changes what flows in and what it is called. The input list grows from six to eight: changes in the needs and expectations of interested parties becomes a new, explicit input alongside changes in external and internal issues, and the effectiveness of actions on risks and on opportunities are now two separate inputs, each pointing back to the restructured 6.1. The outputs are retitled 'results' (9.3.3) with the same content: decisions on improvement opportunities, on changes to the QMS and on resource needs.

Top management sitting down at planned intervals to judge whether the ISMS is still suitable for the organisation, adequate for its risks and effective in practice — and deciding what to change.

At least annually (more often when risk demands), with automotive-specific inputs — cost of poor quality, process effectiveness AND efficiency, warranty, field failures, customer scorecards, feasibility results — and a documented action plan when customer performance targets are missed.

The set of things the management review must consider — actions from last time, changes in context and in what interested parties expect, how the ISMS is performing, feedback, the risk picture and improvement opportunities.

What has to come out of the review — decisions on improvement opportunities and on any changes the ISMS needs — recorded as documented information.

Find and act on improvement opportunities deliberately — better products, fewer future failures, better QMS results — covering correction, corrective action, continual improvement, breakthrough change, innovation and reorganisation.

Continually looking for ways to improve environmental performance and the EMS, and acting on the opportunities you find.

Continually looking for ways to make the safety system better and reduce risk further, not just maintaining the status quo.

When something goes wrong, react to it, find the real cause, fix it so it doesn't come back, and check the fix worked.

Clause 10 is renumbered in the published edition. The 2015 clause 10.1 (improvement — general) and clause 10.3 (continual improvement) are folded into a single 10.1 titled 'Continual improvement'; 10.2 keeps nonconformity and corrective action, and there is no 10.3. The substance carries over: continually improve the suitability, adequacy and effectiveness of the QMS; use the results of monitoring, measurement, analysis and evaluation and of management review to determine opportunities and act on them; and make sure the actions cover improving processes, products and services, addressing future needs and expectations, and correcting, preventing or reducing undesired effects. What changes is every cross-reference to '10.3' in manuals, procedures, audit checklists and training.

Keeping the ISMS getting better — more suitable to the organisation, more adequate for its risks, more effective in practice — as a standing habit rather than a reaction to audits.

When something goes wrong, contain it, fix it, find the real cause, and stop it coming back — then check the fix actually worked.

When something goes wrong environmentally, controlling the immediate problem, finding the real cause, fixing it so it does not recur, and proving the fix worked.

Reporting, investigating and properly fixing incidents and nonconformities by tackling the root cause, not just the symptom.

Keep making the food-safety system better over time, using the evidence the system produces.

When something goes wrong, contain it, fix it, find the real cause, and stop it coming back — then check the fix actually worked. In the 2026 edition this is the last clause of the standard — there is no 10.3.

When something fails to meet an ISMS requirement — a control not applied, a policy breached, an audit finding, an incident revealing a gap — reacting to it, dealing with the consequences, finding and removing the cause, checking the fix worked and changing the ISMS if needed, with the records to show it.

One documented problem-solving process (with defined approaches for different issue types and scales) covering containment through verified effectiveness and systemic prevention — using the customer's format where they prescribe one.

Error-proofing is a documented, planned discipline: opportunities identified in the FMEA process, devices tested per the control plan with failures triggering reaction plans, and challenge parts controlled like gauges.

Where you have warranty obligations: a documented warranty management process including claim analysis and NTF (no trouble found) decisions agreed with the customer; returned parts and field failures get analysed with results reported and corrective action triggered.

Keep making the QMS itself better — suitability, adequacy, effectiveness — using what analysis and management review reveal as needs or opportunities.

Steadily raising the suitability, adequacy and effectiveness of the EMS over time to keep enhancing your environmental performance.

Steadily improving the suitability, adequacy and effectiveness of the safety system over time, with workers involved.

Make sure the food-safety management system as a whole stays current - leadership ensures it evolves with the business and its risks.

A documented continual improvement process: identification of methodology, objectives, measurement, effectiveness — with manufacturing process improvement focused on variation and waste reduction, acting once processes are already capable and stable.

Setting out what your organisation expects on information security in a short top-level policy and a set of topic-specific policies — signed off by management, made available and explained to the people they bind, accepted by them, and kept up to date as things change.

Deciding who is responsible for what in information security — top management, the security lead, asset owners, risk owners and every user — and giving those roles to specific people on purpose, so nothing important belongs to nobody.

Splitting conflicting duties and areas of responsibility between different people so that no one person can carry out, hide or approve their own fraud, misuse or error — with compensating checks where the organisation is too small to split them.

Making every manager, not only top management, answerable for the people who report to them applying the information security policies and procedures in their daily work — and for supporting them with time, training, a clear route to report concerns and a good example.

Knowing in advance which authorities you may need to notify or call on — regulators, law enforcement, emergency services — keeping their details and reporting channels current, and deciding who contacts them, when and how.

Keeping in touch with security forums, professional bodies and specialist groups so the people responsible for security stay current, hear about threats and vulnerabilities early, and have somewhere to turn for advice when something goes wrong.

New in 2022: gathering and analysing information about the threats relevant to your organisation and turning it into intelligence you act on — in risk assessments, technical defences, testing and awareness — instead of collecting alerts nobody reads.

Building information security into every project from the start — identifying security requirements and risks early, treating them through the project life cycle and checking them before go-live — whatever kind of project it is, not only IT ones.

Knowing what information you hold and which assets support it — systems, software, devices, services, facilities — with a named owner for each, recorded in an inventory accurate enough to base risk, access and protection decisions on.

Writing down and putting into practice what people may and may not do with the organisation's information and assets, and how each type of information must be handled, so expected behaviour is clear to employees, contractors and other users.

Making sure employees, contractors and other parties hand back every organisational asset they hold — devices, access cards, tokens, documents, and the organisation's information on their own devices — when their employment, contract or agreement changes or ends.

Sorting information into a small number of levels according to how much protection it needs — judged on confidentiality, integrity, availability and what clients, regulators and the law require — so people know which rules apply to which information.

Marking information with its classification — on documents, emails, files, media and systems — following defined procedures, so anyone handling it can see at a glance which rules apply and tools can act on the label automatically.

Setting rules, procedures or agreements for moving information — inside the organisation and to and from other parties — by every route it travels: email, file-sharing, messaging apps, portals, removable media, courier and conversation.

Setting and applying rules for who may reach which information and assets, through systems and through doors, based on what the business needs and what security requires — so access follows need-to-know and least privilege rather than convenience.

Controlling identities — the accounts that represent people, systems and services — from creation to removal, so each one is unique, traceable to an accountable person, and disabled or deleted as soon as it is no longer needed.

Controlling how passwords, PINs, tokens, keys and other secrets are issued, delivered, reset and protected, and telling people clearly how to look after their own, so authentication information proves identity instead of becoming the weak point.

Granting, reviewing, changing and removing people's access to information and systems in line with the access control policy — approved by the right owner, checked regularly, adjusted when roles change and taken away promptly when no longer needed.

Managing the information security risk that comes with every supplier whose product or service touches your information — from the managed IT provider with domain-admin rights to the shredding company and the payroll bureau — through a defined process that runs from selection to exit.

Writing the security requirements that matter for each supplier into the agreement itself — what information is involved, how it must be protected, whether work may be subcontracted, how incidents are reported, your right to audit, and what happens to your information when the relationship ends.

Extending supplier risk management down the ICT supply chain — the hardware, software, cloud components and sub-suppliers behind your direct suppliers — so that a weakness in a component or a subcontractor two layers down does not become your incident.

Keeping watch on suppliers after the contract is signed — checking they deliver the security they promised, reviewing their reports and incidents, and managing changes to their services, locations or subcontractors so the risk you accepted at selection is still the risk you carry.

New in 2022: deciding how your organisation acquires, uses, manages and leaves cloud services — from Microsoft 365 and Google Workspace to the hosted ERP and the file-sharing tool someone in sales signed up for — according to your own security requirements, not the provider's defaults.

Getting ready for incidents before they happen: a documented incident management process, defined roles and contacts, a way for anyone to report, competent people to respond, and the regulatory notification steps already worked out — so the first hour is spent responding, not organising.

Looking at each reported security event, deciding whether it is an incident, and giving it a category and priority against agreed criteria, so that a phishing email someone deleted and a confirmed data leak are not handled the same way.

Responding to incidents according to documented procedures — containing the damage, preserving evidence, escalating, communicating with the right people inside and outside, recovering, and closing each incident formally — so the response is controlled rather than improvised.

Using what incidents teach you — root causes, recurring patterns, costs and weaknesses in the response — to strengthen controls, update the risk assessment and the incident plan, and improve awareness, so the same incident does not happen twice.

Having procedures to identify, collect, acquire and preserve evidence of security events in a way that keeps it usable — for disciplinary action, insurance claims, regulatory notifications or court — with a documented chain of custody from the moment it is taken.

Planning how information security is kept at an appropriate level when the business is disrupted — a power outage, flood, pandemic or cyber attack — so that continuity workarounds do not quietly switch off the controls that protect information.

New in 2022: making sure the ICT systems the business depends on can be recovered within the times the business needs — planned from a business impact analysis, built into the infrastructure, and proven by testing rather than assumed from a backup report.

Identifying the laws, regulations and contract terms that bear on your information security, writing them down with your approach to meeting each one, and keeping that list current — including the less obvious ones such as rules on cryptography and on cross-border data.

Protecting intellectual property — your own and other people's — with procedures that keep software properly licensed and used within its terms, respect copyright in documents, images and code, and stop proprietary information being copied or used without permission.

Protecting records against loss, destruction and falsification, and against access or release without authority, for as long as they must be kept, and disposing of them properly afterwards, in line with legal, regulatory, contractual and business requirements.

Identifying and meeting the privacy and personal-information protection requirements that apply to your organisation under law, regulation and contract — POPIA in South Africa, GDPR where it applies — and showing how the ISMS supports them.

Having the organisation's approach to information security — its policies, processes, people and technology — reviewed by someone independent of the area, at planned intervals and after significant changes, so management hears an unbiased view of whether it works.

Checking regularly that the organisation actually follows its own information security policy, topic-specific policies, rules and standards — managers reviewing their own areas, technical checks of systems — and correcting what the checks find.

Writing down the procedures for operating information processing facilities — from server and network administration to backups, scheduled jobs and recovery — and making them available to the people who need them, so critical operations do not live in one person's head.

Checking that the people you trust with information are who they say they are and suitable for the role — background verification before they start and on an ongoing basis afterwards, proportionate to what they will access and the risk, and done lawfully.

Writing information security into employment contracts and contractor terms, so that everyone knows — and has agreed in writing — what they must protect, which rules they follow, what continues after they leave and what happens if they break the rules.

Making sure everyone, from the shop floor to the boardroom, knows the security rules that apply to them, why they matter and how to report a problem — through an ongoing awareness programme plus role-specific training kept current as threats and policies change.

Having a formal, known and fair process for dealing with people who break information security policy — so that violations get a consistent, proportionate response, the deterrent works, and any action taken stands up when it is challenged.

Making sure the security duties that outlive a job — confidentiality, intellectual property, care of personal information — are defined, communicated to the person leaving or moving, and enforced, and that internal moves do not leave old access and obligations behind.

Working out where confidentiality or non-disclosure agreements are needed — with staff, contractors, suppliers, consultants, visitors and customers — writing them to fit what you actually need protected, getting them signed, and reviewing them as relationships and information change.

Protecting the information people use and keep when they work away from your premises — at home, on the road, at a client site or in a coffee shop — with a clear policy, secured devices and connections, and habits that travel with them.

Giving everyone a simple, known route to report anything that looks wrong — a suspicious email, a lost laptop, a door left open, a weakness they spotted — quickly and without fear, so the organisation hears about problems while they are still small.

Drawing clear boundaries around the places that hold information and the equipment that handles it — site, building, secure rooms — and making each boundary strong enough for what sits inside, with no gaps through windows, ceilings or doors left open.

Controlling who gets into secure areas and how — access cards, keys, visitor sign-in, escorts and controlled delivery points — so that only authorised people enter, entry is recorded, and access ends when it is no longer needed.

Designing the physical security of the specific offices, rooms and facilities where sensitive work happens — where they sit, how they are built, what can be seen or heard from outside — so the information inside cannot easily be seen, overheard or reached.

New in 2022: keeping a continuous watch over your premises for unauthorised physical access — through alarms, CCTV, guards or a monitored response service — and making sure someone sees the alert, acts on it, and can look back afterwards at what happened.

Designing protection against the physical and environmental events that can destroy or disable information assets — fire, flood, lightning, storms, power surges, civil unrest, theft and accidents — based on an assessment of what your sites actually face.

Setting the rules for how people behave inside secure areas — who may be there, what they may bring and do, how third parties are supervised and how empty areas are checked — so the protection of the room is not undone by the people working in it.

Setting and enforcing rules that stop papers, removable media and unlocked screens from exposing information when nobody is watching — desks cleared, documents locked away, printouts collected and screens locked whenever people step away.

Placing and protecting equipment so it is safe from physical and environmental harm and from unauthorised access or viewing — servers, network gear, shop-floor PCs and printers sited where heat, dust, water, impact and prying eyes cannot reach them.

Protecting laptops, phones, media, documents and other assets once they leave your sites — taken home, carried on business trips, left at a customer, sent for repair — with authorisation, tracking and handling rules suited to the risks outside your walls.

Managing storage media through their whole life — buying, issuing, using, moving, storing and disposing of USB drives, external disks, memory cards and backup media — under your classification and handling rules, so the information on them stays protected.

Protecting information processing facilities against failures and disruptions in the utilities they depend on — electricity, telecommunications, water, cooling and ventilation — through backup supply, monitoring and testing sized to how long you must keep running.

Protecting the power and data cables that feed your systems from interception, interference, damage and theft — routed, separated, labelled and enclosed so that a cut or a tap neither takes systems down nor leaks information.

Maintaining IT and supporting equipment properly — on the manufacturer's schedule, by authorised people, with records — so it stays available and reliable, and so the maintenance itself does not expose the information the equipment holds.

Making sure that any equipment with storage in it — laptops, servers, phones, printers, network devices — has its sensitive data and licensed software removed or destroyed before it is thrown away, returned, sold or handed to someone else.

Protecting the information that sits on, passes through or can be reached from laptops, desktops, phones and tablets — company-issued or personally owned — so that a lost device, an unlocked screen or an unmanaged phone does not become the route into your data.

Restricting and controlling administrator-level access — domain and cloud global admins, database owners, firewall and ERP superusers — so that the accounts that can change everything are few, separately authenticated, granted only when needed, and watched.

Enforcing your access rules inside systems and applications so that people can reach only the information their role needs — set through permissions on file shares, SharePoint and Drive sites, application roles and sharing links rather than left to trust.

Controlling who can read and change source code, development tools and software libraries, so that code cannot be altered without authority, intellectual property does not walk out of the door, and secrets embedded in code are not exposed.

Making sure the way people and systems prove who they are is strong enough for what they are accessing — multi-factor authentication where the risk calls for it, log-on processes that resist guessing and phishing, and sessions that end when they should.

Monitoring how much processing, storage, network, licence and cloud capacity you use and planning ahead, so that systems do not slow down, fill up or fall over — and so that security functions such as logging and backup do not quietly stop.

Defending systems and information against viruses, ransomware and other malicious code through layered technical measures — endpoint protection, email and web filtering, control over what software can run — backed by users who recognise and report what gets through.

Finding out about weaknesses in the software, systems and devices you use, judging how exposed you are, and fixing or containing them in time — by patching, changing configuration or adding compensating controls — before someone else uses them against you.

New in 2022: setting secure, documented configurations for hardware, software, cloud services and networks, applying them consistently, keeping them under change control and checking regularly that nothing has drifted — so systems stay as hardened as you intended.

New in 2022: deleting information from systems, devices, storage media and cloud services once it is no longer needed, using methods that suit its sensitivity, so that old data cannot be leaked or stolen and is not kept longer than the law allows.

New in 2022: hiding, substituting or pseudonymising sensitive data, especially personal information, so that people and systems that do not need the real values — testers, analysts, support staff, reporting tools — work with masked versions instead.

New in 2022: identifying the channels through which sensitive information could leave the organisation — email, cloud uploads, removable media, printing, messaging apps — and applying measures to detect and stop unauthorised disclosure, whether accidental or deliberate.

Keeping copies of information, software and systems that you can actually restore — taken on a schedule set by how much you can afford to lose, stored where the incident cannot reach them, and tested so the first restore is not the one that matters.

Building enough duplication into systems, networks, power and service providers that the failure of one component does not take down a service the business needs, with the level of redundancy set by agreed availability requirements rather than habit.

Recording activities, exceptions, faults and security events on your systems, protecting those records from tampering and loss, keeping them long enough and analysing them — so you can detect incidents and reconstruct what happened.

New in 2022: watching networks, systems and applications for behaviour that departs from normal, and acting on what you find — so that an intrusion, a compromised account or a misbehaving system is noticed and evaluated as a possible incident, not discovered months later.

Synchronising the clocks of servers, network devices, endpoints and applications to an approved, reliable time source, so that logs from different systems can be lined up and trusted when you need to reconstruct an incident.

Restricting and controlling the tools that can bypass normal system and application controls — PowerShell, remote administration kits, registry and disk editors, database consoles, PLC programming software — so only authorised people can run them and every use leaves a trace.

Controlling what software gets installed on live systems — servers, laptops, shop-floor PCs — so that only approved, licensed and supported software from trusted sources goes on, installed by authorised people in a way you can trace and roll back.

Securing, managing and controlling your networks and network devices — firewalls, switches, routers, wireless — so that the information moving across them and the systems connected to them are protected, including the plant-floor equipment that often shares the office network.

Identifying the security features, service levels and requirements you need from every network service — internet links, managed firewalls, VPN, SD-WAN, DNS, managed Wi-Fi — whether bought in or run in-house, then putting them in place and checking they are delivered.

Splitting the network into zones by trust level, function or user group — office, servers, guest, plant floor, CCTV and building systems — and controlling what can pass between them, so a compromise in one zone does not reach everything else.

New in 2022: managing which external websites people can reach from your devices, so that known malicious, phishing and high-risk sites are blocked before a click turns into an infection — on the office network, on laptops working from home and on managed phones.

Setting and applying rules for using encryption and other cryptography properly — what must be encrypted at rest and in transit, with which methods — and managing keys and certificates through their whole life so the protection holds and nothing becomes unrecoverable.

Establishing and applying rules for building software and systems securely, from requirements through design, coding, testing and release, so security is designed in rather than bolted on — including scripts, low-code apps and anything others develop for you.

Working out, writing down and approving the security requirements an application must meet before you build or buy it — authentication, access roles, logging, data protection, transaction integrity — so that selection and acceptance are judged against them.

Setting down the security principles your organisation applies when designing, building or significantly changing information systems — least privilege, defence in depth, secure defaults, segregation, zero trust — and showing they are used in real design decisions.

New in 2022: applying secure coding practices to any code your organisation writes — validating input, handling secrets and errors safely, reviewing code and using vetted libraries — so software does not ship with common, preventable vulnerabilities.

Defining and running security tests during development and before accepting any new or changed system into production, to confirm the agreed security requirements work and that no obvious vulnerabilities go live.

Directing, monitoring and reviewing the work when someone else develops software or systems for you — a web agency, an ERP partner, an app developer, a machine builder — so their output meets your security requirements and you keep control of the code and data.

Keeping development, test and live production environments apart and secured, so untested changes, test tools and developers' access do not reach the systems and data the business runs on — whether that means a full development pipeline or simply an ERP test company and a staging website.

Putting changes to information systems and processing facilities — servers, applications, networks, cloud settings, firewalls — through a controlled process of request, risk assessment, approval, testing, implementation and review, so changes do not quietly break security or availability.

Choosing, protecting and managing the data used for testing — preferably synthetic or masked, with live copies only under approval, protection and prompt deletion — so test environments do not become an unprotected copy of your live personal and confidential information.

Planning and agreeing audit tests and other assurance activities on live systems — penetration tests, vulnerability scans, auditors' system queries — with the right management, so the testing itself does not disrupt operations or expose information.

ISO 9001:2015 already had a short informative Annex A on its structure and terminology, and an Annex B listing the other ISO/TC 176 standards. The published 2026 edition replaces both with one much larger informative Annex A: word-level clarifications (A.2), a note on applicability (A.3), and then a section for every clause from 4 to 10 explaining intent, each pointing to the ISO 10000-series guidance standards where they exist. It adds no requirements — the text says so — and there are no worked examples. You cannot receive a finding 'against Annex A', but it will shape how certification auditors read the requirements they do audit against, which makes it the highest-leverage reading in the new edition.