Where we work · Central Asia and the Caucasus
ISO and GRC consulting in Central Asia and the Caucasus, served from Dubai
Sterling supports organisations in Kazakhstan, Uzbekistan, Georgia, Armenia, Azerbaijan, Kyrgyzstan, Tajikistan, Turkmenistan and Mongolia with ISO certification, data protection programmes under each country's personal data law, and the quality, environmental, safety and security standards their customers ask for, served from our regional headquarters in Dubai. Expert and experienced consultants take you from gap analysis to a successful audit; an accredited certification body makes the certification decision.
- Served from our regional headquarters in Dubai, on site where the work needs it and remotely otherwise
- Certification standards and national data protection law in one programme: ISO 9001, ISO 14001, ISO 45001, ISO/IEC 27001, ISO 22000 and HACCP
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify; an accredited body audits and decides
- Pass the audit first timeA system your people run, with evidence ready before the certification body arrives.
- Answer buyers and lendersQuality, environmental, safety and security questions answered from one set of evidence.
- Meet the national data lawsEach country's personal data law mapped to the controls you already have.
- One programme, every siteSites across the region and overseas under one engagement team and one workspace.
Countries
Each country page sets out the regulators, the accreditation route and every standard Sterling delivers there.
- Armenia0 standards and frameworks
- Azerbaijan0 standards and frameworks
- Georgia0 standards and frameworks
- Kazakhstan0 standards and frameworks
- Kyrgyzstan0 standards and frameworks
- Mongolia0 standards and frameworks
- Tajikistan0 standards and frameworks
- Turkmenistan0 standards and frameworks
- Uzbekistan0 standards and frameworks
How we serve you
Sterling in Central Asia and the Caucasus: served from Dubai, one engagement team.
Sterling has no office in Central Asia or the Caucasus. Clients in the nine countries are served from our regional headquarters in Dubai, on site where the work needs it and remotely otherwise. Your engagement team brings in consultants from other Sterling offices when your sites or suppliers sit elsewhere.
Every Sterling location is on the All offices page. Enquiries from the region reach the Dubai office first, and a consultant replies within one working day.
Standards in demand
What customers, lenders and regulators in Central Asia and the Caucasus ask for.
Requests come from oil, gas and mining operators and their contractors, metals and energy producers, agri-food processors and exporters, textile and cotton makers, banks, payment firms and fintechs, IT service and outsourcing firms, and logistics operators. Every one of the nine countries has its own personal data law, so data protection runs alongside the management system standards.
Bodies and regulators
Who accredits and which data laws apply in Central Asia and the Caucasus.
Certification in the region runs through accredited certification bodies, while each country's personal data law is enforced by its own authorities and creates no certificate. The table sets out who accredits and which law applies, so you know who assesses you and what you must show.
| Country | Accreditation body and recognition | Regulators and schemes that ask for certification |
|---|---|---|
| Kazakhstan, Uzbekistan and Mongolia | Each has one national accreditation body: the National Accreditation Centre (NCA) in Kazakhstan, the Uzbek Center for Accreditation (O'ZAKK) and the Mongolian National Authority for Accreditation (MNAS). Each is a signatory to the international recognition arrangements; check any body's current scope with the accreditation body | Customers, lenders, exporters and group companies drive most requests for ISO 9001, ISO 14001, ISO 45001 and ISO/IEC 27001. Kazakhstan's Law on Personal Data and their Protection, Uzbekistan's Law on personal data and Mongolia's Law on Personal Data Protection set the data rules |
| Georgia, Armenia and Azerbaijan | The Georgian Accreditation Center (GAC), Armenia's National Accreditation Body (ARMNAB) and the Azerbaijan Accreditation Center (AzAK) accredit certification bodies, laboratories and inspection bodies, and each is a signatory to the international recognition arrangements | Food, beverage, pharmaceutical, mining and financial firms ask for ISO 9001, ISO 22000, HACCP and ISO/IEC 27001. Georgia's Law on Personal Data Protection, Armenia's Law on Protection of Personal Data and Azerbaijan's Law "On Personal Data" apply |
| Kyrgyzstan, Tajikistan and Turkmenistan | The Kyrgyz Accreditation Centre (KCA) accredits laboratories and inspection bodies. In Tajikistan a state accreditation body designated by the Government accredits, and in Turkmenistan the Main State Service «Türkmenstandartlary» carries out state accreditation of testing laboratories. Check with the body named which certificates it recognises | The Kyrgyz Digital Code's personal data chapter, Tajikistan's Law on Personal Data Protection and Turkmenistan's Law on information about private life set the data rules. None of the nine data laws creates a certificate of compliance |
Global ACI replaced the IAF MLA and ILAC MRA on 1 January 2026; confirm any certification body's accreditation and scope on its accreditation body's register before you sign. Sterling does not certify, accredit or assess for any of the bodies or programmes above.
How we deliver
One method, delivered where you are.
The same method we use in 60+ countries, set up for the way organisations in Central Asia and the Caucasus procure: a clear scope, a plan and evidence that answers customers and lenders as well as auditors.
- One engagement team accountable across every country you operate in, with local consultants where the work is
- Remote and on site: workshops, document reviews and coaching remotely; site work where observation or in-person work is necessary
- One Effivity workspace for every site, included with the engagement at no additional cost
- One certification body for multi-site programmes where the body agrees, with local requirements handled where they arise
- Design™ or Drive™: your team implements with Sterling's structure and coaching, or Sterling consultants take on the agreed consulting and documentation work
A typical programme in the region starts with a gap analysis against the standard or law your customer, lender or regulator named, then a plan that maps each requirement to an owner and a date. Where one control set can answer several demands, we build it once: an ISO/IEC 27001 system that also supports the evidence a national personal data law requires, or an ISO 9001 system extended to ISO 14001 and ISO 45001 for industrial sites. Working sessions can run in English. Your engagement team stays with you through internal audit, management review and the certification body's readiness review, and supports you through the certification audit and any findings raised.
Effivity · included with the engagement
Your system runs in software from the first workshop.
Effivity is the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures it within the agreed scope, so evidence accumulates as people do their work and the certification auditor reviews a live system rather than a binder. Sterling consulting clients get their subscription included with the engagement, at no additional cost.
ISO & GRC softwareSterling Academy · included with the engagement
Your people learn the standard, not just the forms.
E-learning with practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online, with progress by department for the certification audit. Sterling consulting clients get preferential course access and special pricing, including complimentary awareness training for their people as part of the engagement.
Contact us about Academy accessWhere we work
Your business
crosses borders.
Your programme can too.
A Sterling lead in your working hours, wherever you operate. Multi-site programmes run with one engagement team, one Effivity workspace and one certification body, with local requirements and customer expectations handled where they arise.
Global headquarters in New York; regional headquarters in Dubai, Navi Mumbai, Manila, London, Enschede and Johannesburg; offices in 21 countries.
All offices and contact detailsClient experience
Client letters on file, available on request.
Signed client letters are available on request, and we can arrange references in your sector before you decide. The client feedback wall lists every letter by standard.
- 60+countries where Sterling has delivered certification
- 21countries with a Sterling office, eight regions, one coordinated team
- 2003the year the group began implementing ISO management systems; the same method, refined, since
- 8,100+client engagements across the group, from single-site SMEs to multinationals
FAQs
Questions clients in Central Asia and the Caucasus ask before they engage us.
The specific answers for your organisation come from the discovery call. These are the general ones.
Does Sterling have an office in Central Asia or the Caucasus?
No. Clients in the nine countries are served from Sterling's regional headquarters in Dubai, at 202, Gym Building, Khalid Bin Walid Road, Bur Dubai, PO Box 27363, Dubai, United Arab Emirates, on +971 50 584 2597 and uae@sterling-grc.com. Your engagement team delivers workshops and reviews remotely and visits your sites where observation or in-person work is needed.
Does Sterling issue the certificate?
No. Sterling does not certify. An independent certification body, accredited by a body such as Kazakhstan's NCA, Uzbekistan's O'ZAKK or the Georgian Accreditation Center, audits your system and decides. We prepare you for that audit and help you choose a body whose accreditation and scope suit your customers, and you can check both with the accreditation body.
Is there a certificate for the personal data laws of the region?
No. None of the nine countries' personal data laws creates a certificate of compliance. You show compliance through your own records: notices, consent and request logs, security measures, transfer arrangements and a breach log. ISO/IEC 27701 or ISO/IEC 27001 certification by an accredited body is an optional way to evidence the systems behind those answers. Confirm legal points with your counsel or the authority.
Which countries does this page cover?
Kazakhstan, Uzbekistan, Georgia, Armenia, Azerbaijan, Kyrgyzstan, Tajikistan, Turkmenistan and Mongolia. Each country has its own page with its accreditation body, data protection law and the standards most requested there, linked from the Countries list on this page.
Keep exploring
More places we work
Offices and regions
Talk to a consultant
Plan your certification in Central Asia and the Caucasus with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+971 50 584 2597 (Dubai, serving Central Asia and the Caucasus) · uae@sterling-grc.com
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice