Where we work · Australia
ISO and GRC certification consulting in Australia
Achieve ISO and GRC certification in Australia with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 22 standards, one team
- Accredited certification route
- Sydney office team
- Effivity and Academy included
Sectors that ask for certification in Australia
Clients include
ISO and GRC certification in Australia at a glance
Australian demand for ISO and GRC certification comes from regulators and public buyers more than from any single national law. The Australian Prudential Regulation Authority (APRA) sets CPS 234 on information security and CPS 230 on operational risk, which reaches material service providers. Under the Security of Critical Infrastructure Act 2018, the critical infrastructure risk management program rules list AS ISO/IEC 27001:2015 and the Essential Eight among accepted frameworks, and the Protective Security Policy Framework asks non-corporate Commonwealth entities to reach Essential Eight Maturity Level Two. The Office of the Australian Information Commissioner oversees the Privacy Act 1988 and the Notifiable Data Breaches scheme. NSW Government construction tenders ask for ISO 9001, ISO 45001 and ISO 14001 certificates from JAS-ANZ registered certifiers. Demand is strongest in IT, SaaS and managed services, financial services, government supply and construction, critical infrastructure, healthcare and medical devices, food manufacturing and professional services. Sterling does not certify: certificates come from certification bodies accredited by JASANZ. Sterling's Sydney office brings 20+ years and 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Australia
Each page covers who needs the standard in Australia, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Australia (12)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Privacy Act 1988 — Australian Privacy Principles (APPs) Office of the Australian Information Commissioner (OAIC) | The APPs apply to 'APP entities': Australian Government agencies and private sector and not-for-profit organisations with an annual turnover of more than AUD 3 million (OAIC wording); the definition generally does not include small business operators, registered political parties or state and territory authorities, but some businesses of any size are covered, including private sector health service providers, credit reporting bodies, credit providers, entities that trade in personal information and TFN recipients. APP 11 requires an APP entity to take such steps as are reasonable in the circumstances to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. | |
| Notifiable Data Breaches (NDB) scheme Office of the Australian Information Commissioner (OAIC) | Applies to entities that have an obligation under APP 11 to protect the personal information they hold. When an entity has reasonable grounds to believe an eligible data breach has occurred it must notify affected individuals and give a statement to the Commissioner as soon as practicable; suspected breaches must be assessed. | |
| Australian Prudential Regulation Authority (APRA) APRA-regulated entities (banking, insurance, superannuation, private health insurance) | Prudential Standard CPS 234 Information Security — an APRA-regulated entity must take measures to be resilient against information security incidents (including cyber-attacks) by maintaining an information security capability commensurate with information security vulnerabilities and threats; the page names no external standard. | |
| Australian Prudential Regulation Authority (APRA) APRA-regulated entities and their material service providers | Prudential Standard CPS 230 Operational Risk Management — applies from 1 July 2025 (transition to 1 July 2026 for existing service provider contracts); entities must be able to continue critical operations through a disruption and return to business-as-usual operations promptly, and the requirements extend to material service providers; the page does not mention ISO 22301 or any ISO standard. | |
| Minister for Home Affairs (rule-maker under the Security of Critical Infrastructure Act 2018) Responsible entities for critical infrastructure assets covered by the CIRMP obligation | Security of Critical Infrastructure (Critical infrastructure risk management program) Rules (LIN 23/006) 2023 — all-hazards risk management program; for cyber and information security hazards the entity must comply with a framework in a listed document (Australian Standard AS ISO/IEC 27001:2015; Essential Eight Maturity Model published by ASD, meeting maturity level one; NIST Framework for Improving Critical Infrastructure Cybersecurity; C2M2 at Maturity Indicator Level 1; 2020-21 AESCSF Framework Core at Security Profile 1) or an equivalent framework. As made; check the current compilation before quoting. | ISO/IEC 27001, Essential Eight |
| Australian Government — Protective Security Policy Framework (PSPF) Non-corporate Commonwealth entities | PSPF policy amendment (information security) — all non-corporate Commonwealth entities to implement Essential Eight Maturity Level Two mitigations to achieve a PSPF maturity rating of 'Managing'. | Essential Eight |
| Food Standards Australia New Zealand (FSANZ); enforced by state and territory food authorities Food businesses in high-risk categories (food service to vulnerable people, bivalve molluscs, manufactured and fermented meats, cell-cultured food) | Food Standards Code Standard 3.2.1 Food Safety Programs (Australia only) — based on the HACCP system adopted by the Codex Alimentarius Commission; enables states and territories to require food safety programs based on HACCP concepts, subject to periodic audit by a suitably qualified food safety auditor. | HACCP |
| Therapeutic Goods Administration (TGA) Medical device manufacturers and sponsors | Medical Device Single Audit Program (MDSAP) — TGA assesses MDSAP audit reports and certificates as part of the evidence sponsors and manufacturers need to comply with medical device regulatory requirements; the program is based on ISO 13485; certificates must state the manufacturer was found to comply with the relevant aspects of the Therapeutic Goods (Medical Devices) Regulations 2002. | ISO 13485 |
| Australian Government — Department of Industry, Science and Resources Organisations developing or deploying AI | Voluntary AI Safety Standard — 10 voluntary guardrails across the AI supply chain and lifecycle; refers to AS ISO/IEC 42001:2023 as the international standard on AI management systems; updated guidance released 21 October 2025. | ISO/IEC 42001 |
| Attorney-General's Department Corporations with foreign business dealings | Crimes Legislation Amendment (Combatting Foreign Bribery) Act 2024 — introduced a corporate offence of failing to prevent foreign bribery; the department publishes guidance on adequate procedures to prevent the commission of foreign bribery; the guidance page does not mention ISO 37001. | |
| Clean Energy Regulator Companies that meet the NGER thresholds | National Greenhouse and Energy Reporting (NGER) Scheme — a single national framework for reporting company information about greenhouse gas emissions, energy production and energy consumption; companies that meet certain thresholds must register and report; no ISO standard cited. | |
| Office of the Federal Safety Commissioner Head contractor builders on Australian Government-funded building work | Work Health and Safety Accreditation Scheme — accreditation required for head contractors on Australian Government-funded building work, subject to monetary thresholds and exemptions; the page does not mention ISO 45001. |
Accreditation and recognition
- Joint Accreditation System of Australia and New Zealand (JASANZ): Bi-national accreditation body established by treaty between the Australian and New Zealand governments in 1991; accredits certification bodies, including for management systems (quality, environment, safety, information security, privacy, AI, food safety) and sector schemes.
- National Association of Testing Authorities, Australia (NATA): National accreditation body recognised by government for laboratories, inspection bodies, proficiency testing providers and reference material producers — testing and calibration (ISO/IEC 17025), human pathology (ISO 15189), inspection (ISO/IEC 17020), proficiency testing providers (ISO/IEC 17043), reference material producers (ISO 17034).
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Cities
Tenders and procurement
- Quality management guidelines for construction (NSW Government) (NSW Government (Buy NSW)): Contractors bidding for NSW Government construction contracts above the value threshold in the guidelines must hold an independently certified quality management system compliant with AS/NZS ISO 9001, evidenced by current certification from a certifying body registered with JAS-ANZ; below the threshold, quality management plans and inspection and test plans are required.
- Work Health & Safety management guidelines for construction procurement (Edition 6, December 2019) (NSW Department of Planning, Industry and Environment (published on Buy NSW)): Guidelines aligned to AS/NZS ISO 45001:2018; for contracts above the value threshold in the guidelines, principal contractors must have a certified WHS management system aligned with AS/NZS ISO 45001 (or AS4801) and provide evidence of current JAS-ANZ certification.
- Environmental management guidelines for construction (edition 4) (NSW Government (Buy NSW)): Organisations seeking to undertake major or environmentally sensitive projects for an agency are to have an independently certified environmental management system compliant with AS/NZS ISO 14001:2016; tenders, prequalification applications and expressions of interest for such projects are only accepted from providers with one in place.
Sterling in Australia
Sterling delivers in Australia from its Sydney office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in Australia, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions Australian clients ask
Are certification audits in Australia conducted in English?
Yes. Certification audits, accreditation assessments and attestation fieldwork in Australia are normally conducted in English, and controlled documents are kept in English. Where sites or staff work in other languages, raise it with the certification body when you apply, so the audit language is agreed in advance rather than discovered during planning.
Does the Privacy Act 1988 apply to a small business?
Often not, but it depends on the business. The Australian Privacy Principles apply to APP entities, a definition that generally leaves out small business operators, registered political parties and state and territory authorities. Some businesses are covered whatever their size, including private sector health service providers, credit reporting bodies, credit providers, entities that trade in personal information and TFN recipients. Confirm your position with your counsel or the OAIC.
Which accreditation should the certification body hold for Australia?
For management-system certification, look for accreditation by JASANZ, the bi-national body established by treaty between the Australian and New Zealand governments, or by another accreditation body within the international mutual recognition arrangements. NATA is different: it accredits laboratories, inspection bodies and proficiency testing providers, not management-system certification bodies. Confirm that the accreditation scope covers your standard and sector before you sign.
Do NSW Government construction tenders require certified management systems?
Above the value threshold set in the guidelines, yes. Contractors need an independently certified quality management system to AS/NZS ISO 9001 from a JAS-ANZ registered certifier, and principal contractors need a certified work health and safety system aligned with AS/NZS ISO 45001. Major or environmentally sensitive projects also call for an AS/NZS ISO 14001 environmental system. Below the quality threshold, quality management plans and inspection and test plans are required instead. Check each tender's own wording.
Is the Essential Eight mandatory?
Only in specific settings. The Protective Security Policy Framework requires non-corporate Commonwealth entities to implement Maturity Level Two mitigations to reach a 'Managing' rating. For critical infrastructure, the risk management program rules list the Essential Eight, at maturity level one, as one framework option a responsible entity may use; check the current compilation of those rules. For other organisations it is voluntary.
Can one audit cover sites in several states?
Usually yes. One audit can cover several sites and states when the certification body treats them as a multi-site scope under its sampling rules, so not every site is necessarily visited. Plan the calendar with care: Australia spans several time zones, daylight saving applies only in some states and territories, and public holidays may differ by state, so confirm local dates for each site when scheduling.
Cities Sterling covers in Australia
Each city page sets out the industries, zones and standards that matter locally.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Privacy Act 1988 — Australian Privacy Principles (APPs) — oaic.gov.au (accessed 5 Oct 2026)
- Notifiable Data Breaches (NDB) scheme — oaic.gov.au (accessed 5 Oct 2026)
- Prudential Standard CPS 234 Information Security — apra.gov.au (accessed 5 Oct 2026)
- Prudential Standard CPS 230 Operational Risk Management — apra.gov.au (accessed 5 Oct 2026)
- Security of Critical Infrastructure (Critical infrastructure risk management program) Rules (LIN 23/006) 2023 — legislation.gov.au (accessed 5 Oct 2026)
- PSPF policy amendment (information security) — protectivesecurity.gov.au (accessed 5 Oct 2026)
- Food Standards Code Standard 3.2.1 Food Safety Programs (Australia only) — legislation.gov.au; foodstandards.gov.au (accessed 5 Oct 2026)
- Medical Device Single Audit Program (MDSAP) — tga.gov.au (accessed 5 Oct 2026)
- Voluntary AI Safety Standard — industry.gov.au (accessed 5 Oct 2026)
- Crimes Legislation Amendment (Combatting Foreign Bribery) Act 2024 — ag.gov.au (accessed 5 Oct 2026)
- National Greenhouse and Energy Reporting (NGER) Scheme — cer.gov.au (accessed 5 Oct 2026)
- Work Health and Safety Accreditation Scheme — fsc.gov.au (accessed 5 Oct 2026)
- Joint Accreditation System of Australia and New Zealand (JASANZ) — industry.gov.au; jasanz.org (accessed 5 Oct 2026)
- National Association of Testing Authorities, Australia (NATA) — nata.com.au (accessed 5 Oct 2026)
- Quality management guidelines for construction (NSW Government) — info.buy.nsw.gov.au (accessed 5 Oct 2026)
- Work Health & Safety management guidelines for construction procurement (Edition 6, December 2019) — info.buy.nsw.gov.au (accessed 5 Oct 2026)
- Environmental management guidelines for construction (edition 4) — info.buy.nsw.gov.au (accessed 5 Oct 2026)
Talk to a consultant
Plan your certification with the Sydney team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
australia@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice