Editorial and verification policy: primary sources only, dated on the page.

Every standard status, deadline and revision claim we publish is verified against primary sources, including ISO's official catalogue, Global ACI and accreditation-body announcements, and certification-body bulletins, before publication, dated on the page, and reviewed on a regular cycle and whenever a primary source changes. The internet is full of confident claims about standard editions that do not exist; this policy is why none of them will come from us.

For each kind of claim we go to the body that decides it: ISO and IEC for a standard's edition and stage; Global ACI, which replaced the IAF MLA and ILAC MRA on 1 January 2026, and the accreditation bodies for accreditation and transition rules; the scheme owner for a scheme such as SOC 2, PCI DSS or a sector programme; the regulator and the official text for a law or regulation. Secondary sources may point us to a change, but they are never the basis for a published status or date.

Every standard is cited with its edition, such as ISO 9001:2026, and transition periods are given with the date and the authority that set them. Where a page cites a figure, such as a regulatory fine or threshold, the source is recorded with the page.

• Primary sources only for statuses and dates: a claim we cannot trace to ISO, an accreditation authority, a scheme owner or a regulator is not published.
• Every dated page shows its review date, updated at every review even when nothing changed; an undated reference page is asking for trust it has not earned.
• Unpublished standards are always labelled as drafts ("the FDIS indicates"), never stated as fact, and the label changes only when the standard is published.
• Laws are described as laws and attestations as attestations: HIPAA is a law, not an ISO certification, and a SOC 2 report is an attestation, not a certificate.
• Corrections are made openly: when we get something wrong, we fix the page, note the change and thank whoever caught it.

Before publication, each page is checked against the primary sources recorded for it, and against Sterling's own rules for what we may claim: we never claim to certify, and never promise a certification decision, a ranking or automatic compliance. After publication, pages are reviewed on a regular cycle and whenever a primary source changes; a change of edition, stage or transition date is applied to every page it affects. Sterling's management is responsible for this policy and for the accuracy of what is published under Sterling's name.

To report an error, write to hello@sterling-grc.com with the page and the source you are relying on. We check the claim against the primary source and correct the page if we were wrong; corrections are handled under the Complaints and feedback policy. You can see this policy at work on our Standard revisions and transitions page, where confirmed transition dates are listed with their sources.