Government and public sector · ISO and GRC consulting
ISO certification for government and public sector bodies and the suppliers that serve them.
Agencies certify the services citizens rely on; suppliers certify because the contract, the tender or a national baseline asks them to. Sterling's expert and experienced consultants build one practical system with your people for quality, information security, anti-bribery and continuity, and stay with you through the audit. We ensure successful certification for our clients.
- One system for service quality, citizen data, procurement integrity and continuity, scoped to the service or contract that needs it first
- Consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify; an accredited body audits and decides
- A certified frontline serviceOne process citizens use, documented, measured and certified, ready to extend to the next.
- Tender-ready evidenceCertificates and records that answer the security, quality and integrity questions in a bid.
- Procurement you can defendBribery risks assessed, controls in place and decisions traceable when oversight bodies ask.
- Services that keep runningCritical services analysed, recovery planned and exercised before a disruption tests them.
What the public sector is asked for
The standards agencies adopt and their buyers write into contracts.
Public bodies usually start with ISO 9001 for a service citizens use, then add information security, anti-bribery or continuity as risk and mandate require. Suppliers are asked for what the contract names: ISO/IEC 27001 for data, ISO 37001 for integrity, and a national baseline where the government customer is in the UK, Saudi Arabia or the UAE.
- ISO 9001Service quality
- ISO/IEC 27001Information security
- ISO 37001Anti-bribery
- ISO 22301Business continuity
- Cyber EssentialsUK government contracts
- NCA ECCSaudi government entities
- UAE IA StandardUAE critical entities
- ISO 37000Governance guidance
- All standards & frameworksThe full catalogue, with sector schemes
Why now
Why public bodies and their suppliers are acting now.
Each driver below comes from a published guideline, procurement note or regulator page. The mix that applies to you depends on your country, your mandate and the contracts you hold.
- Performance-Based Bonus, PhilippinesThe Performance-Based Bonus guidelines for fiscal year 2023 list a continuing ISO QMS certification, or an equivalent, of at least one critical frontline service or core process among the accountabilities of departments and agencies, state universities and colleges, and GOCCs. Check the circular for the current fiscal year.
- UK central government contractsPPN 014 applies to central government departments, their executive agencies, non-departmental public bodies and NHS bodies. Where a contract involves citizens' personal data or systems handling OFFICIAL data, suppliers need a Cyber Essentials certificate, or equivalent controls, renewed every year.
- Saudi government entities and affiliatesThe NCA's Essential Cybersecurity Controls cover government agencies in the Kingdom and their affiliated companies inside and outside it. The NCA evaluates compliance through self-assessment, its compliance tool and field audit visits; there is no certificate to substitute.
- UAE critical entities and their suppliersTDRA designates critical entities under the UAE CIIP Policy to implement the UAE Information Assurance Regulation, and organisations holding information for them may be bound by contract. ISO/IEC 27001 certification supports that evidence but does not replace compliance.
- Integrity in procurementISO 37001 covers bribery in the public, private and not-for-profit sectors, including bribery of the organisation and dealings with public officials. The 2025 edition is current, and certificates to the 2016 edition lapse on 28 February 2027.
- A new ISO 9001 editionISO 9001:2026 was published on 16 September 2026. Agencies starting now build to it from day one; certified bodies plan their transition on the timetable their certification body confirms, expected to run to 30 September 2029.
Scope and evidence
What auditors look for in a public body or a government supplier.
Auditors test how the service is actually delivered, how citizen data is protected and how public money moves. These are the areas that decide most public-sector audits.
| Requirement area | What it looks like in the public sector | Evidence auditors ask for |
|---|---|---|
| Frontline service quality | Permits, licences, registrations, payments, admissions or case handling, with published service standards and processing times | Process maps, service standards, performance against targets, complaints and feedback records, corrective actions |
| Citizen and case data | Personal records, case files and shared-service systems, with access limited to the officers who need it | ISMS scope, risk assessment, Statement of Applicability, access reviews, supplier agreements, incident log |
| Procurement and integrity | Bid evaluation, contract award, inspections, gifts and hospitality, and contact with bidders and public officials | Bribery risk assessment, due diligence on business associates, gifts register, segregation of duties, approval thresholds |
| Continuity of public services | Services that must run through outages, floods, system failures or loss of a site | Business impact analysis, recovery objectives, continuity plans, exercise reports and lessons learned |
| National cyber baselines | Cyber Essentials for UK contracts, NCA ECC in Saudi Arabia, the UAE IA Regulation for designated entities | Control-by-control gap assessment, remediation records, self-assessment, annual renewal evidence |
| Leadership and oversight | Heads of agency and boards of GOCCs or suppliers directing, reviewing and deciding on the system | Management review minutes, internal audit reports, objectives, findings closed with evidence |
Scope is the decision that sets cost and timing. An agency can certify one critical frontline service first and extend later; a supplier usually scopes to the legal entity and services named in the contract. ISO 37000 is guidance for governing bodies, not a certifiable standard.
The engagement
What happens between the first call and the certificate.
Shown for ISO 9001 at an agency's first frontline service. The same six steps apply to ISO/IEC 27001, ISO 37001 and ISO 22301; for NCA ECC or the UAE IA Regulation, steps 5 and 6 become the authority's own evaluation.
- 01Define what the certificate needs to cover.Confirm activities, sites, headcount, customer expectations and the intended certification scope.
- 02Gap analysis: review the current system against the requirements.The gap analysis identifies what is missing, preserves effective practice and agrees actions, owners, dates and resources.
- 03Implement and collect meaningful evidence.Put controls into use, train the relevant people and keep the records that show how the system operates.
- 04Audit, review and address the findings.Internal audit and management review evaluate implementation; findings are raised by us first and closed with evidence.
- 05Complete the independent assessment.The certification body's Stage 1 readiness review, then the Stage 2 audit; respond to any findings and await its decision.
- 06Maintain the system after certification.Monitoring, internal audits, reviews and improvement continue, alongside the body's surveillance audits and three-yearly recertification.
What you receive
Everything a working, certifiable system needs. Nothing to purchase separately.
- Scope and gap analysis reportThe scope of the certificate and every shortfall against the standard, with an owner and a date.
- Implementation planMilestones, responsibilities, the weekly session calendar and the target audit window.
- The documented management systemPolicies, processes, procedures, forms and records on Sterling's template sets, tailored to your operation.
- Effivity workspace, configuredDocuments, registers, audits, actions, training records and management review in one place, included at no additional cost.
- Trained peopleAwareness e-learning for everyone, practitioner courses for the people who run the system, internal auditor training for your audit team, as applicable to your standard, with Certificates of Completion.
- Internal audit and management reviewProgramme, checklists, report, corrective actions closed with evidence, and a management review record with decisions.
- Certification readinessCertification bodies compared and their accreditation checked, Stage 1 and Stage 2 preparation, and support until the certificate is issued.
- The Sustain™ calendarThe year after certification planned: surveillance dates, internal audits, refreshers, new-hire training and any transition to a revised edition.
Effivity · included with the engagement
Your system runs in software from the first workshop.
Effivity is the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures it within the agreed scope, so evidence accumulates as people do their work and the certification auditor reviews a live system rather than a binder. Sterling consulting clients get their subscription included with the engagement, at no additional cost.
ISO & GRC softwareSterling Academy · included with the engagement
Your people learn the standard, not just the forms.
E-learning with practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online, with progress by department for the certification audit. Sterling consulting clients get preferential course access and special pricing, including complimentary awareness training for their people as part of the engagement.
Contact us about Academy accessStandards
Standards for Government and public sector
- ISO 9001ISO 9001 certification consulting: a quality management system built with your people, evidence prepared and support until an accredited body certifies you.
- ISO/IEC 27001ISO/IEC 27001 certification consulting: an ISMS built with your people, evidence prepared, and support through Stage 1, Stage 2 and surveillance audits.
- ISO 37000ISO 37000 governance guidance and requirements explained: the 11 principles for boards, no certificate, and how Sterling helps you apply it and prove alignment.
- Cyber EssentialsCyber Essentials certification consulting: the five technical controls in place for your verified self-assessment, and Cyber Essentials Plus audit-ready.
- ISO 37001ISO 37001 certification consulting: proportionate anti-bribery controls to prevent, detect and respond, built with your teams and ready for an accredited audit.
- ISO 22301ISO 22301 certification consulting to keep delivering through disruption: impact analysis, continuity plans and exercises, prepared for an accredited audit.
Public-sector client experience
Client letters on file, available on request.
Signed client letters are available on request. The client feedback wall lists every letter by standard; ask for references that match your organisation and standard before you decide.
- 60+countries where Sterling has delivered certification
- 21countries with a Sterling office, eight regions, one coordinated team
- 2003the year the group began implementing ISO management systems; the same method, refined, since
- 8,100+client engagements across the group, from single-site SMEs to multinationals
FAQs
Questions public bodies and their suppliers ask before they engage us.
The specific answers for your organisation come from the discovery call. These are the general ones.
Which ISO standard should a government agency start with?
Most agencies start with ISO 9001 for one critical frontline service, because it improves the service citizens see and, in the Philippines, relates directly to the Performance-Based Bonus accountabilities. Agencies holding large volumes of personal data then add ISO/IEC 27001, and those with significant procurement or inspection powers add ISO 37001. We usually integrate them into one system so the same internal audit and management review cover all of them.
Does the Performance-Based Bonus require ISO 9001 certification?
The fiscal year 2023 guidelines list a continuing ISO QMS certification, or an equivalent certification, of at least one critical frontline service or core process among agency accountabilities for departments and agencies, state universities and colleges, and GOCCs. The accountabilities change between fiscal years, so check the circular that applies to your cycle. We scope the certificate so it matches what the circular asks you to show.
Can Sterling certify our agency or company?
No. Sterling does not certify. Our consultants guide the system into place with your people, run the internal audit and prepare you for the independent assessment; an accredited certification body carries out Stage 1 and Stage 2 and decides whether to certify. We compare certification bodies for you and help you check their accreditation, so the certificate is recognised by the buyer, oversight body or tender committee that will rely on it.
We supply UK government. Do we need Cyber Essentials?
Often, yes. PPN 014 applies to central government departments, their executive agencies, non-departmental public bodies and NHS bodies, and asks for a Cyber Essentials certificate, or equivalent controls, where a contract involves citizens' personal data or systems handling OFFICIAL data. Evidence is needed when data is passed to the supplier and must be renewed annually. We check the contract, remediate the five controls and prepare the assessment.
Is ISO/IEC 27001 enough for NCA ECC or the UAE IA Regulation?
Not on its own. Neither NCA ECC nor the UAE IA Regulation has a certificate that replaces compliance: the NCA evaluates Saudi entities directly, and in the UAE the designating authority assesses. An ISO/IEC 27001 system gives you the risk process, controls and evidence that much of the work rests on, so we build the two together and close the national controls the ISMS does not reach.
How long does certification take for a public body?
For one frontline service, ISO 9001 typically takes 3 to 6 months; ISO/IEC 27001 and ISO 37001 typically take 4 to 8 months. The drivers are the maturity of your processes, the scope, the number of sites and people, and how quickly decisions are made. Budget cycles and tender dates often fix the target, so we plan backwards from them and agree the audit window early.
Does ISO 37001 apply to a public body that awards contracts?
Yes. ISO 37001 covers bribery in the public, private and not-for-profit sectors, including bribery of the organisation and its personnel, not only bribery by it. For an agency that awards contracts, grants permits or inspects, the bribery risk assessment usually centres on procurement, licensing and enforcement, and the controls cover gifts, conflicts of interest, approvals and due diligence on business associates.
Talk to a consultant
Plan certification for your public-sector operation with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice