ISO and GRC standards for government and public sector: where to start: video

Agencies and the suppliers that serve them

In the public sector there are two audiences. Agencies certify the services citizens rely on; suppliers certify because a contract, a tender or a national baseline asks them to. The standards most often involved are ISO 9001 for service quality, ISO/IEC 27001 for information security, ISO 37001 for anti-bribery and ISO 22301 for business continuity, with national schemes such as Cyber Essentials for UK government contracts, NCA ECC for Saudi government entities and the UAE IA Standard for UAE critical entities, and ISO 37000 as governance guidance.

The film is a primer for agency heads and supplier bid teams alike. Which mix applies depends on the country, the mandate and the contracts held.

What drives the request, and the first step

The drivers come from published guidelines, procurement notes and regulators. In the Philippines, the Performance-Based Bonus guidelines have listed a continuing ISO quality management certification of at least one critical frontline service or core process among the accountabilities of departments, agencies, state universities and colleges and GOCCs; the current fiscal year's circular is the reference. In the United Kingdom, central government contracts involving citizens' personal data or systems handling official data call for Cyber Essentials. Other countries set their own national baselines for government entities and critical sectors.

The practical starting point is one service or one contract: a frontline service citizens use, documented, measured and certified, then extended to the next; or the certificates and records that answer the security, quality and integrity questions in a bid. Anti-bribery controls and continuity planning are added where procurement integrity and critical services demand them. Select the Standard™ helps a public body or a bidder see which standards its buyers usually name.

For quality, information security, anti-bribery and continuity, Sterling builds one practical system with your people, in one proposal that includes Effivity, Sterling Academy access and internal auditor training as applicable. Certification decisions sit with an accredited body.