SCS 9001: Frequently Asked Questions (FAQs)

SCS 9001 certification is achieved through an audit and resulting assessment by an accredited SCS 9001 Certification Body (CB). CBs are highly trained and must pass rigorous testing prior to being approved to conduct audits.

Further, the audit results delivered by all CBs are reviewed quarterly to ensure that consistent results are delivered across all certifications. Where anomalies are detected, CBs are directed to areas for their own improvement and must provide corrective action to maintain their accreditation.

A full SCS 9001 certification is projected to take 2 – 4 business days. The timeframe will vary based on several factors, including but not limited to the size of the organization, complexity of its operations, existing quality management systems in place, scope of registration, complexity of the supply chain, and the amount of dedicated internal and external resources available in support of the certification effort.

Estimates are regularly updated based on empirical evidence collected during certifications. Contact TIA for your specific questions.

A newly completed certification last for 3 years.  Surveillance audits are typically performed annually and have a duration of 1/3 of the original audit time.  Surveillance audits are annual checks using a subset of the certification process to ensure an organization has remained consistent with the requirements of SCS 9001.  A 3-year recertification is  projected to take approximately 2/3 of the initial audit days.   This aligns with ISO 9001.

TIA has created an audit assessment tool to help organizations project their certification duration and costs.  Contact TIA for availability.

SCS 9001 will be a valuable addition to existing quality and security management systems with a focus on securing the network operator’s supply chain. Organizations who are certified are expected to be viewed favorably by their customers as preferred vendors.

SCS 9001 is applicable to anyone participating in the ICT industry and is not limited to traditional telecommunications suppliers. SCS 9001 is equally powerful to those companies operating cable networks, satellite systems, hosted data centers, global cloud platforms and contact centers, as examples.

Any organization that operates a network and those vendors providing products and services used in those networks will benefit from SCS 9001.

Organizations of any size will benefit from SCS 9001.

Large organizations can be geographically distributed with many people and processes supporting a complex infrastructure.  Existing processes may be insufficient to address new security challenges.  Smaller, new entrants can be immature when it comes to quality and security practices and have limited capacity to develop internal processes to address security needs.  SCS 9001 will help in both cases and everything in between.

Yes. Organizations can certify individual lines of business and/or products if desired. It is our expectation, as supply chain processes are often standardized, that in many cases a single certification will suffice.

As a comprehensive management system, organizations making an investment in SCS9001 certification should account for the following:

• TIA QuEST Forum Participation Fees: based on the size (annual revenue) of an organization, this is an annual fee to be a Participant in the TIA QuEST Forum.  TIA QuEST Forum Participants receive discounts on documents, have access to benchmarking data for all standards, and can participate in all working groups, including future work on the SCS 9001 Supply Chain Security Working Group standard.

Details on the benefit of Participation are detailed at: Telecommunications Industry Association Membership | TIAOnline.org.

• SCS9001 Surveillance Audit: the annual Surveillance Audit cost, paid directly to the CB.
• SCS 9001 Certification Fee: a fee paid for each certification and 3-year recertification.
• SCS 9001 Administrative Fee: an annual fee paid by non-participants to cover the overhead and costs of managing and maintaining their performance data.
• SCS9001 Handbook purchase(s): the Handbook describes the SCS9001 requirements and performance data.  Volume discounts are available and preferred pricing is offered to Participants.
• Training: there are numerous training courses available, both live-instructor led, in-person, remote and computer based in meeting the needs of organizations desiring SCS 9001 certification, as well as those desiring to become a Certification Body.
• Performance Data Reports (PDRs): these reports provide the quarterly results of all certified organizations and how their submitted (anonymous) measurement data compares to other organizations and industry averages.

No!  ISO 27001 is an important standard that focuses on Information Security.  It has a large number of requirements and controls addressing that purpose.   In some ways, SCS 9001 can be viewed as a superset of ISO 27001.   SCS 9001 provides many similar controls but goes much further in assessing the operational practices of organizations and their supply chains.

A comparison of SCS 9001 and ISO 27001 is available at:  SCS-9001-Comparison.pdf (tiaonline.org).

This question deals with different conformity assessment models.  A conformity assessment is the manner in which an organization applies and potentially certifies to a standard.  Conformity assessment is defined in ISO/IEC 170001 as the "demonstration that specified requirements relating to a product, process, system, person or body are fulfilled".

When it comes to conformity assessment, the following are defined:

• First Party: an organization assesses itself, sometimes providing a self-attestation of compliance and possibly producing evidence of security practices in meeting customer requests.
• Second Party: an organization directly assesses its vendors for compliance with its security requirements.
• Third Party: an independent organization (such as TIA’s Certification Bodies) conduct an audit of an organization seeking certification.

TIA supports all conformity assessment models but is an advocate of Third Party (independent certifications) due to the importance of solving today’s security challenges.