GRC insights: practical guides for ISO, privacy and compliance teams

Each guide takes one practical problem, such as a customer security questionnaire, an expired certificate or a new regulatory register, and explains what the standard or regulation expects, where organisations usually go wrong and what good evidence looks like.

The guides are written for quality, security and compliance leads rather than specialists in the standard. Where a guide refers to a clause or requirement, check it against the current edition of the standard or the regulation itself, and talk to a Sterling consultant if you want to apply it to your own scope.

• The 2026 ISO Certification Plan: 10 Steps from Zero to CertificateA ten-step plan for ISO certification in 2026, from gap assessment to an accredited certificate, with links to guides for India, the Philippines and UAE.
• ISO 9001:2026 and ISO 14001:2026: The 12-Month Transition CalendarA 12-month calendar for moving from ISO 9001:2015 and ISO 14001:2015 to the 2026 editions, with key dates and questions for your certification body.
• How to Choose an ISO Consultant in 2026: A Scored ChecklistScore any ISO consultant on ten questions, from accreditation to the quotation, with warning signs and guides for India, the Philippines and UAE.
• ISO Certification Scams to Avoid in 2026Seven scam patterns in ISO certification and how to verify a certificate and certification body before you pay.
• Supplier security review: what customers ask, and how your ISO/IEC 27001 ISMS answers itHow to answer customer security questionnaires with evidence your ISMS already holds.
• ISO 27001 2013 certificate expired? What to do now the transition has closedThe route back to a valid certificate once the 2013 edition has lapsed.
• PCI DSS payment page scripts: requirements 6.4.3 and 11.6.1 explainedWhat the two payment page requirements ask of merchants and service providers.
• Data subject access request process: how to meet the GDPR deadline every timeA repeatable process for receiving, verifying and answering access requests on time.
• HIPAA security risk analysis: doing it properlyHow to run a risk analysis that stands up to scrutiny, not a tick-box exercise.
• Integrated management system audit: running ISO 9001, ISO 14001 and ISO 45001 audits togetherPlanning one audit programme across quality, environment and safety.
• Ransomware recovery plan: how to build one with ISO 22301Turning business continuity planning into a tested recovery plan for ransomware.
• ISO climate change amendment: what the 2024 changes mean for ISO 14001 and other management systemsWhat the climate change wording adds to context and interested parties.
• NIS2 supply chain security: what essential and important entities must do about their suppliersThe supplier controls in-scope entities are expected to put in place.
• DORA register of information: how to build it, reconcile it and keep it currentBuilding the register of ICT third-party arrangements and keeping it accurate.
• Double materiality assessment: a practical method under ESRS, from value chain map to management sign-offA step-by-step method for impact and financial materiality under ESRS.
• Risk appetite statement and risk criteria: setting them with ISO 31000Writing a board-owned appetite statement and turning it into usable risk criteria.

This is a selection. The full list of insight guides, including standard comparisons and case studies, is in the menu under Resources.