Is the undertaking ISO 9001-certified?

ISO 9001 versus ISO 27001: which certificate is meant here

The question "is the enterprise ISO 9001-certified" concerns quality management, not information security. For an experienced respondent, this distinction is often the first check: some customer portals copy certification questions from a template and conflate ISO 9001 with ISO 27001, or ask them one after another in the same list. The answer is by definition a fact, not an estimate: the enterprise holds a valid ISO 9001 certificate from an accredited certification body, or it does not. There is no middle ground — "working towards certification" or "operating according to the standard without a certificate" is not a "yes".

If the enterprise is not ISO 9001-certified but is ISO 27001-certified, that is a different answer to a different question: these two must not be merged in the chain file, even if the questions in some lists appear similar to each other. If the enterprise holds neither, then "no" is the correct answer — a follow-up question about internal quality procedures without certification asks for something different and deserves its own source. Uncertainty about what a customer exactly wants to know with a certification question occurs more often with related topics, such as with the question whether the enterprise holds a general liability insurance policy: here too, the answer is a verifiable fact with supporting evidence, not a qualitative explanation.

What the supporting document should show

For a "yes", the chain file should include the certificate itself: name of the certification body, validity date and the certificate number. Without that supporting document, the system cannot represent a "yes", even if the enterprise has been operating according to the standard for years. The provided source on Annex A of ISO/IEC 27001 concerns information security controls and therefore does not support an ISO 9001 answer — precisely separating these two standards is why this question calls for its own, separate source document rather than reusing an existing certificate. If the correct certificate is missing, the answer remains "no" until the supporting document is added, comparable to how also with the establishment address of the company only a source document, not an assumption, leads to a "yes".