Where we work · Australia and New Zealand
ISO and GRC consulting in Australia and New Zealand, with ISO consultants Australia and New Zealand organisations can call on
Sterling's office in Australia puts a consultant close to your sites for ISO certification, cyber security and privacy programmes, and Manila is the nearest of Sterling's regional headquarters. One engagement team runs every site in scope on both sides of the Tasman; an independent, accredited certification body audits and decides.
- An office in Australia, with Manila as the nearest regional headquarters, for work across both countries
- Programmes shaped around JASANZ accredited certification and the duties APRA, the OAIC and New Zealand's Privacy Commissioner set
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify; an accredited body audits and decides
- An accredited certificateIssued by a certification body you can check on the JASANZ Register of certified organisations
- Tenders answeredEvidence ready for government prequalification, head contractors and supplier questionnaires
- Regulation mappedAPRA CPS 234, the Essential Eight and both Privacy Acts linked to controls you already run
- One programmeAustralian and New Zealand sites in one scope, one Effivity workspace and one plan
Countries
Each country page sets out the regulators, the accreditation route and every standard Sterling delivers there.
- Australia22 standards and frameworks
- Fiji0 standards and frameworks
- Kiribati0 standards and frameworks
- Marshall Islands0 standards and frameworks
- Micronesia0 standards and frameworks
- Nauru0 standards and frameworks
- New Zealand21 standards and frameworks
- Palau0 standards and frameworks
- Papua New Guinea0 standards and frameworks
- Samoa0 standards and frameworks
- Solomon Islands0 standards and frameworks
- Tonga0 standards and frameworks
- Tuvalu0 standards and frameworks
- Vanuatu0 standards and frameworks
Offices
Sterling in Australia and New Zealand: one office, one engagement team.
Our Australian office serves clients in Australia and New Zealand, and Manila is the nearest of Sterling's regional headquarters for programmes that also reach into Asia. Workshops and reviews run remotely, and consultants travel to sites where observation is needed.
- Sydney, AustraliaSterling office · Darling Park Tower 2, 201 Sussex Street, Sydney · australia@sterling-grc.com
- Manila, PhilippinesNearest regional headquarters · Suite C, 8th Floor, The Valero Tower, 122 Valero St., Salcedo Village, Brgy. Bel-Air, Makati City, Manila · +63 97781 51204 · philippines@sterling-grc.com
Sterling has offices in 21 countries. Every office, with its contact details, is listed on the all offices page.
Standards in demand
The standards Australian and New Zealand buyers ask for.
Quality, information security, environment and health and safety certificates are the ones tenders and supplier questionnaires most often ask to see; NSW Government construction work, for one, calls for a certified quality system. Banks, insurers and super funds work to APRA CPS 234, Commonwealth entities to the Essential Eight, and every organisation covered by either Privacy Act to its principles. Food, laboratory, payment card, AI and SOC 2 programmes follow the same method.
- ISO 9001Quality management
- ISO/IEC 27001Information security
- ISO 14001Environmental management
- ISO 45001Health and safety
- Essential EightAustralian cyber baseline
- APRA CPS 234 and CPS 230Prudential security and operational risk
- Privacy Act 1988 (Australia)Australian Privacy Principles
- Privacy Act 2020 (New Zealand)Information Privacy Principles
- All standards & frameworksThe full catalogue, with sector schemes
Bodies and regulators
Who accredits, who certifies and who regulates in Australia and New Zealand.
Accreditation bodies accredit certification bodies and laboratories; certification bodies audit and certify you; regulators and buyers decide what they expect to see. Sterling does none of the three. We prepare you for all of them.
| Country | Accreditation body and recognition | Regulators and schemes that ask for certification |
|---|---|---|
| Australia | JASANZ, the bi-national accreditation body established by treaty between the Australian and New Zealand governments in 1991. It accredits the organisations that certify management systems and does not certify organisations itself; certificates can be checked on its Register of certified organisations. | NSW Government construction contracts call for a quality management system certified to AS/NZS ISO 9001 by a body registered with JAS-ANZ, with thresholds by contract type. The Security of Critical Infrastructure rules on risk management list AS ISO/IEC 27001, the Essential Eight at Maturity Level One, the NIST Cybersecurity Framework and other frameworks for responsible entities. The OAIC regulates the Privacy Act 1988 and its Notifiable Data Breaches scheme. |
| Australia: banks, insurers and super funds | No certificate applies. APRA sets prudential standards and supervises compliance; an ISO/IEC 27001 certificate can support the evidence but does not replace it. | APRA CPS 234 Information Security, in force since 1 July 2019, for ADIs, general and life insurers, private health insurers and RSE licensees: Board accountability, third-party controls, independent testing, internal audit and notice to APRA within 72 hours of a material incident. CPS 230 Operational Risk Management, which commenced on 1 July 2025, requires entities to meet CPS 234; a single notification to APRA covers an incident notifiable under both. |
| Australia: government and cyber security | No certificate applies. The Essential Eight is assessed against ASD's Essential Eight Maturity Model, by self-assessment or an independent assessor. ASD endorses IRAP assessors to evaluate ICT systems and cloud services. | Under the Protective Security Policy Framework, Maturity Level Two is the mandatory baseline for non-corporate Commonwealth entities. ASD suggests Maturity Level One may suit small and medium enterprises and Maturity Level Two large enterprises. Government buyers may also ask for an IRAP assessment. |
| Australia: laboratories | NATA, the National Association of Testing Authorities, accredits testing and calibration laboratories to ISO/IEC 17025, medical laboratories to ISO 15189, inspection bodies, reference material producers and proficiency testing providers. NATA describes itself as a partner of Global ACI and APAC. | Specifications, contracts and customers set the requirement for accredited results. For inspection bodies, NATA has announced a three-year transition to ISO/IEC 17020:2026 ending around March 2029. |
| New Zealand | JASANZ, the same bi-national body, accredits certification bodies for New Zealand as well as Australia, so one accredited certifier can serve organisations in both countries. | The Office of the Privacy Commissioner regulates the Privacy Act 2020, in force since 1 December 2020: thirteen Information Privacy Principles, with IPP 3A on indirect collection in force from 1 May 2026, notice of serious-harm privacy breaches to the Commissioner and affected people, and a privacy officer in every organisation. No certificate exists for the Act. |
Global ACI replaced the IAF MLA and ILAC MRA on 1 January 2026. At our last check, neither JASANZ nor NATA was shown on the Global ACI list of recognised accreditation bodies. Before relying on a certificate abroad, check the certification body on the JASANZ register and the accreditation body's status on global-aci.org.
How we deliver
One method, delivered where you are.
The same five-stage method we have refined since 2003, delivered for clients across Australia and New Zealand.
- One engagement team accountable across every country you operate in, with local consultants where the work is
- Remote and on site: workshops, document reviews and coaching remotely; site work where observation or in-person work is necessary, with short travel from the regional offices
- One Effivity workspace for every site, included with the engagement at no additional cost
- One certification body for multi-site programmes where the body agrees, with local requirements handled where they arise
- Design™ or Drive™: your team implements with Sterling's structure and coaching, or Sterling consultants take on the agreed consulting and documentation work
A typical engagement starts with a gap analysis against the standard and the rules that apply to you, from the Australian Privacy Principles to APRA or PSPF expectations, then implementation, internal audit and management review before the certification body's Stage 1 readiness review and Stage 2 audit. For groups with sites in Australia and New Zealand, we build one system under central control, keep a legal register per country and write privacy evidence once for both Acts, with the notices and breach steps each one needs. Where the Essential Eight or CPS 234 apply, the ISO/IEC 27001 controls carry the evidence so it is not produced twice. Your people learn through Sterling Academy, and your records live in Effivity.
Effivity · included with the engagement
Your system runs in software from the first workshop.
Effivity is the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures it within the agreed scope, so evidence accumulates as people do their work and the certification auditor reviews a live system rather than a binder. Sterling consulting clients get their subscription included with the engagement, at no additional cost.
ISO & GRC softwareSterling Academy · included with the engagement
Your people learn the standard, not just the forms.
E-learning with practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online, with progress by department for the certification audit. Sterling consulting clients get preferential course access and special pricing, including complimentary awareness training for their people as part of the engagement.
Contact us about Academy accessStandards
Most requested in Australia and New Zealand
- ISO/IEC 27001ISO/IEC 27001 certification consulting: an ISMS built with your people, evidence prepared, and support through Stage 1, Stage 2 and surveillance audits.
- ISO 9001ISO 9001 certification consulting: a quality management system built with your people, evidence prepared and support until an accredited body certifies you.
- ISO 45001ISO 45001 certification consulting to prevent work-related injury and ill health, with an OH&S system built with your people and audit-ready, in 60+ countries.
- ISO 14001ISO 14001 certification consulting: aspects, impacts and compliance obligations controlled, with support until an accredited body certifies you.
- Essential EightEssential Eight compliance and requirements explained: the eight ASD strategies, Maturity Levels Zero to Three, assessment, cost factors and an all-inclusive plan.
- Privacy Act 1988 (Australia)Australian Privacy Act compliance for APP entities: the 13 Australian Privacy Principles, data breach readiness and the 2024 amendments, in one all-inclusive proposal.
- ISO 22301ISO 22301 certification consulting to keep delivering through disruption: impact analysis, continuity plans and exercises, prepared for an accredited audit.
- SOC 2SOC 2 Readiness and compliance consulting: controls mapped to the Trust Services Criteria and evidence prepared for the CPA firm's SOC 2 attestation report.
Where we work
Your business
crosses borders.
Your programme can too.
A Sterling lead in your working hours, wherever you operate. Multi-site programmes run with one engagement team, one Effivity workspace and one certification body, with local requirements and customer expectations handled where they arise.
Global headquarters in New York; regional headquarters in Dubai, Navi Mumbai, Manila, London, Enschede and Johannesburg; offices in 21 countries.
All offices and contact detailsClient experience in Australia and New Zealand
Client letters on file, available on request.
Signed client letters for engagements in Australia and New Zealand are available on request. The client feedback wall lists every letter by standard. Ask for references in your sector before you decide.
- 60+countries where Sterling has delivered certification
- 21countries with a Sterling office, eight regions, one coordinated team
- 2003the year the group began implementing ISO management systems; the same method, refined, since
- 8,100+client engagements across the group, from single-site SMEs to multinationals
FAQs
Questions clients in Australia and New Zealand ask before they engage us.
The specific answers for your organisation come from the discovery call. These are the general ones.
Do you have ISO consultants in Australia and New Zealand?
Yes. Sterling has an office in Australia, and Manila is the nearest of our regional headquarters. Your engagement team runs workshops and document reviews remotely and visits sites where observation is needed. The same consultant stays accountable across every site in your scope, in Australia, New Zealand or further afield, with local consultants where the work is.
Who accredits certification bodies in Australia and New Zealand?
JASANZ, the bi-national accreditation body set up by treaty between the two governments in 1991. It accredits certification bodies and does not certify organisations. Laboratories in Australia are accredited by NATA. Check any certificate on the JASANZ Register of certified organisations, and confirm that the body's accreditation covers your standard and scope before you choose it.
Does ISO/IEC 27001 certification meet APRA CPS 234?
Not on its own. CPS 234 is a prudential standard that APRA supervises; no certificate shows compliance. It asks for Board accountability, controls over assets that third parties manage, testing by functionally independent specialists, internal audit and notice to APRA within 72 hours of a material incident. An ISO/IEC 27001 system gives you the structure and evidence, and we map it to each CPS 234 requirement.
Is the Essential Eight mandatory for our organisation?
For non-corporate Commonwealth entities under the Protective Security Policy Framework, Maturity Level Two is the mandatory baseline. For others it is usually a customer or contract expectation, and the critical infrastructure risk management rules list it at Maturity Level One among the frameworks responsible entities may use. There is no certificate; implementation is assessed against ASD's maturity model.
Can one programme cover sites in Australia and New Zealand?
Yes, where the certification body agrees. Because JASANZ accredits for both countries, one accredited certifier can often audit sites on both sides of the Tasman. The programme runs as one system under central control, with one engagement team and one Effivity workspace. Each country keeps its own legal register, and the certification body sets the audit time and site plan.
Does Sterling certify organisations in Australia or New Zealand?
No. Sterling does not certify or accredit. Our expert and experienced consultants prepare you: gap analysis, implementation, training, internal audit and support through the audits. An independent certification body, accredited by JASANZ or another accreditation body, audits your system and decides whether to issue the certificate. For laboratories, NATA assesses and decides on accreditation.
How do the Australian and New Zealand Privacy Acts differ for a business in both?
Australia's Privacy Act 1988 sets 13 Australian Privacy Principles, regulated by the OAIC, with notice of eligible data breaches to the OAIC and affected individuals. New Zealand's Privacy Act 2020 sets 13 Information Privacy Principles plus IPP 3A, regulated by the Privacy Commissioner, and requires a privacy officer. Both trigger breach notice on serious harm. One programme with country-specific notices usually covers both.
Keep exploring
More places we work
Offices and regions
Talk to a consultant
Plan your certification in Australia and New Zealand with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice