Where we work · Brunei
ISO and GRC certification consulting in Brunei
Achieve ISO and GRC certification in Brunei with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Kuala Lumpur office team
- Effivity and Academy included
Sectors that ask for certification in Brunei
Clients include
ISO and GRC certification in Brunei at a glance
Food businesses, downstream oil and gas projects, banks and technology firms in Brunei meet a compact but active set of requirements. The Brunei Darussalam Food Authority licenses and inspects food premises and registers imported food, while the Safety, Health and Environment National Authority enforces the Workplace Safety and Health Act, Chapter 277. Cyber Security Brunei oversees owners of critical information infrastructure under the Cybersecurity Act, Chapter 272, and the Authority for Info-communications Technology Industry administers the Personal Data Protection Order, 2025. The Brunei Darussalam Central Bank issues technology risk and operational risk guidelines to financial institutions. Demand centres on downstream petrochemicals, food and halal food manufacturing, ICT, finance, tourism services and logistics, with BEDB industrial sites such as Sungai Liang Industrial Park. The national standards centre, PSABD, develops Brunei's own standards but APAC lists it as an Affiliate, so certificates usually carry accreditation from bodies in other economies. Certificates come from accredited certification bodies, never from Sterling. Sterling's Kuala Lumpur office serves Brunei clients on site and remotely, bringing 8,100+ client engagements in 60+ countries, 20+ years of practice, and Effivity and Sterling Academy with every engagement.
ISO and GRC standards Sterling delivers in Brunei
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Brunei (8)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Personal Data Protection Order, 2025 Authority for Info-communications Technology Industry of Brunei Darussalam (AITI), which the Order makes responsible for its administration and which administers and enforces it as AITI's own site states | The Order governs how private organisations collect, use and disclose personal data. Its obligations cover accountability, consent and purpose, access and correction, care of data (accuracy, protection, retention and transfer outside Brunei Darussalam) and notification of data breaches. Individuals acting in a personal or domestic capacity, employees acting in the course of employment and public agencies are outside Parts 3 to 7, and a data processor working under a written contract carries fewer obligations. The Order's commencement clause lets the Minister appoint dates by notification in the Gazette, so confirm with AITI which provisions apply to your organisation. It cites no ISO standard. | |
| Brunei Darussalam Food Authority (BDFA), a statutory body established on 1 January 2021 as the regulatory and competent authority for food safety and quality food safety, food imports and exports | Brunei Darussalam Food Authority Order, 2020, the Public Health (Food) Act (Chapter 182) and the Public Health (Food) Regulations. BDFA inspects food premises, issues food licences and permits, requires food handlers to complete a food handlers course, registers imported processed food before it can enter, and issues export health certificates after inspection and testing; where a standard is not set in the Act and Regulations, the Codex Alimentarius international standards apply. The sale of fresh fish and fisheries products stays under the Ministry of Primary Resources and Tourism. BDFA's pages name no HACCP or ISO 22000 certificate requirement. | |
| Safety, Health and Environment National Authority (SHENA), established under the Safety, Health and Environment National Authority Act, Chapter 227 workplace safety and health, environment and radiation | Workplace Safety and Health Act, Chapter 277 (with the Workplace Safety and Health Order, 2009 and regulations on risk management, incident reporting, general provisions, construction, major accident hazards, first aid and safety and health committees) and the Radiation Protection Act, Chapter 228. SHENA publishes a Code of Practice on Workplace Safety and Health Management System and one on Risk Management, and runs a registration scheme for Workplace Safety and Health Auditors whose approval criteria list an ISO 45001:2018 lead auditor course among other qualifications. | ISO 45001 |
| Cyber Security Brunei (CSB), which provides cyber security services in Brunei Darussalam and publishes the Code of Practice for Critical Information Infrastructure; the Act provides for a Commissioner of Cybersecurity cybersecurity and critical information infrastructure | Cybersecurity Act, Chapter 272 (Revised Edition 2024), an Act to require or authorise measures to prevent, manage and respond to cybersecurity threats and incidents and to regulate owners of critical information infrastructure. Its essential-service sectors include energy, infocommunications, healthcare, banking and finance, aviation and water. Owners of designated infrastructure report cybersecurity incidents, are audited by an auditor approved or appointed by the Commissioner, and run a yearly cybersecurity risk assessment. CSB's Code of Practice for CII, Version 2.0, adds clauses on the secure use of artificial intelligence and on secure-by-design systems. | |
| Brunei Darussalam Central Bank (BDCB) banking, money changing, remittance and payments | Guidelines on Technology Risk Management for money changer and money remittance businesses and pawnbrokers (Guideline No. TRS/G-5/2024/1, issued under section 32 of the Brunei Darussalam Central Bank Order, 2010, effective 1 November 2024), which it says are to be read with the Notice on Early Detection of Cyber Intrusion and Incident Reporting and the Guidelines on IT Third Party Risk Management; and, for banks, the Guidelines on Operational Risk Management (Guidelines No. BU/G-1/2022/22, issued under section 126 of the Banking Order, 2006), which cover business continuity planning and information and communication technology. Neither guideline names an ISO standard. | |
| Brunei Darussalam Medicines Control Authority (BDMCA), acting through the Department of Pharmaceutical Services in the Ministry of Health medicines and pharmaceutical products | Medicines Order, 2007 and its regulations: medicinal products manufactured, sold, supplied or imported must be registered before marketing, and the Department licenses importers, wholesalers and manufacturers or assemblers of medicinal products. The pages name no ISO 13485 requirement. | |
| Department of Civil Aviation (DCA) civil aviation and continuing airworthiness | Brunei Aviation Requirements (BARs) published by DCA, which include BAR 8 (Part M and CAMO, continuing airworthiness) and BAR 19 (safety management). DCA's listing does not show whether any BAR names AS9100. | |
| Anti-Corruption Bureau (ACB) anti-corruption | Prevention of Corruption Act, Chapter 131 (Revised Edition 2019), which punishes corrupt transactions with agents among other offences; the Bureau publishes the Act and good-practice material on handling gifts in the public service. The Act names no ISO standard. |
Accreditation and recognition
- Pusat Standard dan Akreditasi Brunei Darussalam (PSABD), Ministry of Finance and Economy: National standards and accreditation centre, which develops Piawai Brunei Darussalam (PBD) national standards; APAC lists it as an Affiliate.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Tenders, quotations and expressions of interest published by ministries and agencies (the issuing ministry, department or statutory body): Ministries and agencies publish tender, quotation and expression-of-interest notices on their own sites, for example the Ministry of Finance, the Ministry of Health, SHENA, BEDB and the Department of Civil Aviation. Each notice and its documents set the qualification criteria. No general rule requiring ISO certification across all tenders is recorded.
Economic zones
- Sungai Liang Industrial Park (SPARK): industrial and manufacturing tenants
- Anggerek Desa Technology Park: info-communication technology
Sterling in Brunei
Sterling delivers in Brunei from its Kuala Lumpur office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Brunei clients ask
Who regulates food safety in Brunei?
The Brunei Darussalam Food Authority does. It is a statutory body, established on 1 January 2021, that acts as the regulatory and competent authority for food safety and quality. It inspects food premises, issues licences and permits, registers imported processed food and issues export health certificates after inspection and testing. Fresh fish and fisheries products stay under the Ministry of Primary Resources and Tourism, so check which agency covers your product.
Which authority administers Brunei's Personal Data Protection Order, 2025?
AITI, the Authority for Info-communications Technology Industry of Brunei Darussalam. The Order makes the Authority responsible for its administration, and AITI's data protection site describes it as the body that administers and enforces the Order. The Order is aimed at private organisations; public agencies fall outside its main obligations. Its commencement clause lets dates be appointed by Gazette notification, so ask AITI which provisions apply to you now.
What does the Cybersecurity Act, Chapter 272 ask of critical information infrastructure owners?
They report cybersecurity incidents, arrange periodic audits by an auditor approved or appointed by the Commissioner, and carry out a cybersecurity risk assessment every year. The Act regulates owners of designated critical information infrastructure in essential sectors such as energy, infocommunications, healthcare, banking and finance, aviation and water. Cyber Security Brunei publishes a Code of Practice for these owners; read the Act itself or take legal advice on designation.
Does Brunei have an accreditation body whose certificates are recognised internationally?
Not as a national accreditation signatory. APAC lists Pusat Standard dan Akreditasi Brunei Darussalam (PSABD) in the Ministry of Finance and Economy as an Affiliate, and says Affiliates are not APAC MRA signatories. Certification bodies working in Brunei usually hold accreditation from bodies in other economies within the international arrangements, and the buyer or regulator decides which accreditation it accepts.
In what language are certification audits run in Brunei?
Usually in English, with Malay used for interviews where staff prefer it. Agencies such as the Food Authority, Cyber Security Brunei and the Anti-Corruption Bureau publish in both languages, and the data protection Order appears in an English text. Raise language and interpreter needs with the certification body at application.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Personal Data Protection Order, 2025 — pdp.aiti.gov.bn (accessed 18 Oct 2026)
- Brunei Darussalam Food Authority Order, 2020, the Public Health (Food) Act (Chapter 182) and the Public Health (Food) Regulations. BDFA inspects food premises, issues food licences and permits, requires food handlers to complete a food handlers course, registers imported processed food before it can enter, and issues export health certificates after inspection and testing; where a standard is not set in the Act and Regulations, the Codex Alimentarius international standards apply. The sale of fresh fish and fisheries products stays under the Ministry of Primary Resources and Tourism. BDFA's pages name no HACCP or ISO 22000 certificate requirement. — bdfa.gov.bn (accessed 18 Oct 2026)
- Workplace Safety and Health Act, Chapter 277 (with the Workplace Safety and Health Order, 2009 and regulations on risk management, incident reporting, general provisions, construction, major accident hazards, first aid and safety and health committees) and the Radiation Protection Act, Chapter 228. SHENA publishes a Code of Practice on Workplace Safety and Health Management System and one on Risk Management, and runs a registration scheme for Workplace Safety and Health Auditors whose approval criteria list an ISO 45001:2018 lead auditor course among other qualifications. — shena.gov.bn (accessed 18 Oct 2026)
- Cybersecurity Act, Chapter 272 (Revised Edition 2024), an Act to require or authorise measures to prevent, manage and respond to cybersecurity threats and incidents and to regulate owners of critical information infrastructure. Its essential-service sectors include energy, infocommunications, healthcare, banking and finance, aviation and water. Owners of designated infrastructure report cybersecurity incidents, are audited by an auditor approved or appointed by the Commissioner, and run a yearly cybersecurity risk assessment. CSB's Code of Practice for CII, Version 2.0, adds clauses on the secure use of artificial intelligence and on secure-by-design systems. — csb.gov.bn (accessed 18 Oct 2026)
- Guidelines on Technology Risk Management for money changer and money remittance businesses and pawnbrokers (Guideline No. TRS/G-5/2024/1, issued under section 32 of the Brunei Darussalam Central Bank Order, 2010, effective 1 November 2024), which it says are to be read with the Notice on Early Detection of Cyber Intrusion and Incident Reporting and the Guidelines on IT Third Party Risk Management; and, for banks, the Guidelines on Operational Risk Management (Guidelines No. BU/G-1/2022/22, issued under section 126 of the Banking Order, 2006), which cover business continuity planning and information and communication technology. Neither guideline names an ISO standard. — cms.bdcb.gov.bn (accessed 18 Oct 2026)
- Medicines Order, 2007 and its regulations: medicinal products manufactured, sold, supplied or imported must be registered before marketing, and the Department licenses importers, wholesalers and manufacturers or assemblers of medicinal products. The pages name no ISO 13485 requirement. — moh.gov.bn (accessed 18 Oct 2026)
- Brunei Aviation Requirements (BARs) published by DCA, which include BAR 8 (Part M and CAMO, continuing airworthiness) and BAR 19 (safety management). DCA's listing does not show whether any BAR names AS9100. — dca.gov.bn (accessed 18 Oct 2026)
- Prevention of Corruption Act, Chapter 131 (Revised Edition 2019), which punishes corrupt transactions with agents among other offences; the Bureau publishes the Act and good-practice material on handling gifts in the public service. The Act names no ISO standard. — acb.gov.bn (accessed 18 Oct 2026)
- Pusat Standard dan Akreditasi Brunei Darussalam (PSABD), Ministry of Finance and Economy — apac-accreditation.org; mof.gov.bn (accessed 18 Oct 2026)
- Tenders, quotations and expressions of interest published by ministries and agencies — mof.gov.bn; moh.gov.bn; bedb.gov.bn; dca.gov.bn (accessed 18 Oct 2026)
- Sungai Liang Industrial Park (SPARK) — bedb.gov.bn; invest.gov.bn (accessed 18 Oct 2026)
- Anggerek Desa Technology Park — invest.gov.bn; bedb.gov.bn (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Kuala Lumpur team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
malaysia@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice