What company-level IT certifications are worth looking at beyond ISO 9001 and 27001?

ISO/IEC 20000 is a useful one to investigate for IT service management. For continuity, look at ISO 22301. ISO/IEC 27018 covers protection of personal data in public cloud services, though it is a code of practice rather than a standalone management system certification like ISO/IEC 27001.

There can be overlap with an existing 27001 program, but don't assume the extra work is just a small set of controls. Check the scope and requirements for each, along with the audit effort.

For the UK, Cyber Essentials and Cyber Essentials Plus are worth a look. They focus on basic cybersecurity controls, with Plus adding independent technical verification. They might be more relevant than another broad standard if UK customers are asking for them.

SOC 2 Type 2 comes up a lot when customers want evidence of controls operating over a period of time. It's an attestation report, not a certification, so it belongs in a slightly different bucket from ISO 27001. The scope, criteria, and period covered matter when comparing what each gives a customer.

Industry and location can narrow the list fast. CMMC may be relevant for US defense contracts, while TISAX is used in the automotive industry. Neither is a generic substitute for every other security requirement, so check the specific contract or customer expectations first.

CMMC can also involve substantial work on both controls and documentation. Budget for that before treating it as a quick addition.

Before collecting badges, decide who needs assurance and what they need covered. A data center customer, a software buyer, and a defense contractor may ask for very different evidence. Each additional assessment takes time and money, even when some controls overlap.