awesome-corporate-standards

June 29, 2026 · View on GitHub

Awesome PRs Welcome License: MIT Languages GitHub Stars

A curated list of international standards, frameworks, and certification bodies for organizations and businesses — not for individuals.

Scope: This list covers standards that certify or regulate organizations, companies, and processes — not personal/professional certifications like AWS Certified, PMP, or CISSP. For those, see awesome-certifications.

~ ~ ~

Translations

~ ~ ~

Contents

~ ~ ~

Certification Bodies & Standard Organizations

Who writes the rules? This section explains the main bodies that develop and publish international standards.

BodyFull NameScopeRegion
ISOInternational Organization for StandardizationCross-industry: quality, security, environment, safety, energy, and moreInternational
IECInternational Electrotechnical CommissionElectrical, electronic, and related technologiesInternational
ITUInternational Telecommunication UnionTelecommunications and ICTInternational (UN agency)
IEEEInstitute of Electrical and Electronics EngineersEngineering, computing, telecommunicationsInternational
NISTNational Institute of Standards and TechnologyCybersecurity, metrology, technologyUSA
ANSIAmerican National Standards InstituteVoluntary consensus standardsUSA
BSIBritish Standards InstitutionMulti-sectorUK
DINDeutsches Institut für NormungMulti-sectorGermany
UNIEnte Italiano di NormazioneMulti-sector, also publishes UNI PdR (practice references)Italy
AFNORAssociation Française de NormalisationMulti-sectorFrance
CENEuropean Committee for StandardizationEuropean harmonized standards (EN)Europe
CENELECEuropean Committee for Electrotechnical StandardizationElectrotechnical standardsEurope
AICPAAmerican Institute of Certified Public AccountantsAuditing, trust services (SOC)USA
PCI SSCPayment Card Industry Security Standards CouncilPayment securityInternational

~ ~ ~

Quality Management

Standards that certify an organization's ability to consistently deliver products and services that meet customer and regulatory requirements.

  • ISO 9001 — The world's most adopted quality management system (QMS) standard. Applies to any organization, any size, any industry. Certification demonstrates consistent quality processes and continuous improvement culture.
  • ISO 9000 — Vocabulary and fundamental concepts for the ISO 9000 family.
  • ISO 9004 — Guidance for sustained organizational success beyond ISO 9001.
  • CMMI — Capability Maturity Model Integration. Process improvement framework for software and services organizations, with maturity levels 1–5.
  • Six Sigma — Data-driven methodology for eliminating defects in processes (DMAIC/DMADV). Organizations can achieve Belt-level certification.
  • IATF 16949 — Quality management for the automotive supply chain (see also Automotive).

~ ~ ~

Information Security

Standards that certify an organization's information security management system (ISMS) and practices.

  • ISO/IEC 27001 — The global benchmark for Information Security Management Systems (ISMS). Defines requirements for establishing, implementing, maintaining, and improving information security across people, processes, and technology. Uses a risk-based approach with 93 controls in Annex A (ISO 27002).
  • ISO/IEC 27002 — Code of practice for information security controls. Companion to 27001, not independently certifiable.
  • ISO/IEC 27017 — Information security controls for cloud services.
  • ISO/IEC 27018 — Protection of personally identifiable information (PII) in public clouds.
  • ISO/IEC 27701 — Extension to 27001/27002 for privacy information management (PIMS). Bridges ISMS and GDPR compliance.
  • SOC 2 — Service Organization Control 2, issued by AICPA. Audits trust service criteria: Security, Availability, Confidentiality, Processing Integrity, Privacy. Type I = point in time, Type II = over a period.
  • SOC 3 — Public-facing summary report of SOC 2 findings.
  • NIST CSF — NIST Cybersecurity Framework. Voluntary framework for managing and reducing cybersecurity risk. Not a certification per se but widely adopted as a compliance reference.
  • NIST SP 800-53 — Security and privacy controls for federal information systems (USA), widely referenced globally.
  • CIS Controls — Center for Internet Security. Prioritized set of safeguards to mitigate the most common cyberattacks.

~ ~ ~

Environmental Management

Standards certifying an organization's environmental impact management and sustainability practices.

  • ISO 14001 — Environmental Management System (EMS). Certifies that an organization systematically controls its environmental impact and pursues continuous improvement.
  • ISO 14004 — General guidelines for EMS implementation.
  • ISO 14040/14044 — Life Cycle Assessment (LCA) methodology.
  • ISO 50001 — Energy Management Systems (EnMS). Helps organizations improve energy performance, efficiency, and consumption.
  • EMAS — Eco-Management and Audit Scheme. EU voluntary instrument for organizations to evaluate, report, and improve their environmental performance. More demanding than ISO 14001.
  • GHG Protocol — Greenhouse Gas Protocol. The most widely used international accounting standard for GHG emissions (Scope 1, 2, 3).

~ ~ ~

Health & Safety

Standards certifying occupational health, safety, and well-being management systems.

  • ISO 45001 — Occupational Health and Safety Management System (OHSMS). Replaced OHSAS 18001 in 2018. Certifies that an organization proactively manages workplace hazards and risks.
  • OHSAS 18001 — Predecessor to ISO 45001. Officially withdrawn in 2021; organizations should have migrated.
  • ISO 45003 — Psychological health and safety at work. Guidance on managing psychosocial risks.

~ ~ ~

Privacy & Data Protection

Frameworks and standards governing how organizations handle personal data.

  • GDPR — General Data Protection Regulation. EU regulation (2016/679). Not an ISO standard — it is binding law for any organization processing EU residents' data. No single "GDPR certification" exists, but ISO 27701 bridges it.
  • ISO/IEC 27701 — See Information Security. The closest certifiable standard to GDPR compliance.
  • CCPA — California Consumer Privacy Act. US state law regulating data privacy for California residents.
  • HIPAA — Health Insurance Portability and Accountability Act. US federal law governing health information privacy and security.
  • ePrivacy Directive — EU directive on privacy in electronic communications. Companion to GDPR.
  • ISO 29100 — Privacy framework. Foundational concepts and terminology for privacy standards family.

~ ~ ~

Financial & Accounting

Standards and frameworks governing financial reporting, controls, and auditing.

  • SOX — Sarbanes-Oxley Act. US federal law mandating financial reporting controls and auditor independence for public companies.
  • IFRS — International Financial Reporting Standards. Accounting standards adopted in 140+ countries.
  • GAAP — Generally Accepted Accounting Principles. US accounting standard.
  • PCI DSS — Payment Card Industry Data Security Standard. Mandatory for any organization that stores, processes, or transmits cardholder data. Currently PCI DSS v4.0.
  • ISAE 3402 / SSAE 18 — Assurance reports on controls at service organizations. International equivalent of SOC 1.

~ ~ ~

Sector Specific

Automotive

  • IATF 16949 — Quality management system for automotive production and relevant service part organizations. Replaces ISO/TS 16949. Required by most OEMs (Toyota, VW, GM, Ford, etc.).
  • VDA 6.x — German Automotive Industry Association quality standards series.
  • ASPICE — Automotive SPICE. Process assessment model for automotive software development.
  • ISO 26262 — Functional safety for road vehicles (E/E systems).
  • ISO/SAE 21434 — Cybersecurity engineering for road vehicles.

Medical Devices

  • ISO 13485 — Quality management system for medical devices. Required for market access in EU, Canada, and others.
  • MDR / IVDR — EU Medical Device Regulation (2017/745) and In Vitro Diagnostic Regulation (2017/746).
  • FDA 21 CFR Part 820 — US FDA Quality System Regulation for medical device manufacturers.
  • IEC 62304 — Medical device software lifecycle processes.
  • ISO 14971 — Risk management for medical devices.

Food Safety

  • ISO 22000 — Food Safety Management System (FSMS). Applies across the entire food chain.
  • HACCP — Hazard Analysis Critical Control Points. Systematic preventive approach to food safety.
  • FSSC 22000 — Food Safety System Certification. Builds on ISO 22000, recognized by GFSI.
  • BRC Global Standards — British Retail Consortium standards for food safety and packaging.
  • IFS Food — International Featured Standard. European food retail standard.

Aerospace

  • AS9100 — Quality Management System for Aviation, Space, and Defense organizations.
  • DO-178C — Software Considerations in Airborne Systems and Equipment Certification.
  • DO-254 — Design Assurance Guidance for Airborne Electronic Hardware.

Software & IT Services

  • ISO/IEC 20000-1 — IT Service Management System (ITSM). The certifiable standard underlying ITIL practices.
  • ITIL 4 — IT Infrastructure Library. Best practice framework for IT service management. Organizations adopt it; individuals get certified in it.
  • ISO/IEC 25010 — Systems and software quality models (SQuaRE series).
  • ISO/IEC 12207 — Software lifecycle processes.
  • ISO/IEC 15408 — Common Criteria for Information Technology Security Evaluation.

~ ~ ~

Governance, Risk & Compliance (GRC)

Frameworks helping organizations manage governance, enterprise risk, and regulatory compliance holistically.

  • COBIT 2019 — Control Objectives for Information and Related Technologies. Framework for IT governance and management by ISACA.
  • COSO ERM — Committee of Sponsoring Organizations. Enterprise Risk Management integrated framework.
  • ISO 31000 — Risk Management. Principles, framework, and process for any organization. Not directly certifiable but widely referenced.
  • OCEG GRC Capability Model — Open Compliance and Ethics Group. The "Red Book" GRC framework.
  • Basel III — International regulatory framework for banks (capital requirements, stress testing).
  • Solvency II — EU regulatory framework for insurance companies.

~ ~ ~

Gender Equality & Social Responsibility

  • UNI PdR 125:2022 — Italian practice reference for gender equality certification in organizations. Basis for the Italian Gender Equality Certification ("Certificazione della Parità di Genere").
  • ISO 30415 — Human resource management — Diversity and inclusion.
  • SA8000 — Social Accountability International standard. Certifies ethical working conditions: no child labor, forced labor, discrimination; freedom of association.
  • B Corp Certification — Issued by B Lab. Certifies companies that meet high standards of social and environmental performance, accountability, and transparency.
  • ISO 26000 — Guidance on social responsibility. Not certifiable — provides guidance only.

~ ~ ~

~ ~ ~

Contributing

Contributions welcome! Please read CONTRIBUTING.md before submitting a PR.

Rules:

  • Only standards that certify or apply to organizations, not individuals
  • Include a brief description explaining what the standard certifies and why it matters
  • Link to the official issuing body, not third-party summaries
  • If adding a sector-specific standard, place it in the correct subsection

~ ~ ~

License

MIT

Copyright (c) 2026 Openapi®