Comment by duckmysick

It's there in the The Model Services Contract, under Core Terms:

> Quality Plans

> 6.1 The Supplier shall develop, within [insert number] Working Days of the Effective Date, quality plans that ensure that all aspects of the Services are the subject of quality management systems and are consistent with BS EN ISO 9001 or any equivalent standard which is generally recognised as having replaced it ("Quality Plans").

The Short Form Contract also have optional ISO 27001 or Cyber Essentials (which is, uh, an adventure on its own). But there's also an option for no certification required. It depends on the contract.

But yes, you're right. Dealing with requirements takes time and experience and you likely need a dedicated person (or team) to deal with it.