Do I have to buy a copy of the ISO standard?

Technically no!  However, there is an argument, used by auditors that if you don’t have a copy, how can you achieve conformance.  Your “old” copies, checklists and other documents may contain the requirements but unless you can “prove” they are the same (for which you will need a copy of the standard) you are out of luck.  If you own a copy of the 2000 version of the standard your could try arguing that the 2008 version introduced no new requirements but we don’t think it will work.  In practice you need a copy of the standard.  Available at