Where we work · Germany
ISO and GRC certification consulting in Germany
Achieve ISO and GRC certification in Germany with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 23 standards, one team
- Accredited certification route
- Frankfurt office team
- Effivity and Academy included
Sectors that ask for certification in Germany
Clients include
ISO and GRC certification in Germany at a glance
Germany's demand for certification and compliance work comes from law, regulators and supply-chain requirements rather than from marketing. The Bundesnetzagentur requires electricity and gas network operators to hold an ISO/IEC 27001 ISMS and its certification under the IT-Sicherheitskatalog; the BSI supervises NIS-2 duties under the BSI-Gesetz; BaFin supervises DORA for financial entities. Private-sector data protection is supervised by the authorities of the federal states under § 40 BDSG. Energy-intensive companies and data-centre operators face the Energieeffizienzgesetz, medical device makers deal with the ZLG, and automotive suppliers meet IATF 16949 through the VDA QMC IATF Oversight Office and TISAX through the ENX Association. Demand is strongest among automotive suppliers, industrial manufacturers, IT and cloud providers, banks and insurers, energy and utilities, medical device firms, food producers and logistics operators. Management-system certificates come from certification bodies accredited by the Deutsche Akkreditierungsstelle (DAkkS); Sterling does not certify. Sterling's Frankfurt office draws on 20+ years and 8,100+ client engagements in 60+ countries, and Effivity and Sterling Academy are included with the engagement.
ISO and GRC standards Sterling delivers in Germany
Each page covers who needs the standard in Germany, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Germany (17)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| EU General Data Protection Regulation (GDPR / DSGVO) Data protection supervisory authorities of the federal states (Länder) for non-public bodies, as set out in § 40 BDSG | Directly applicable EU regulation. Under § 40 BDSG the authorities competent under state law supervise the application of data protection rules at non-public bodies; where a controller or processor has several establishments in Germany, the competent authority is determined by the main-establishment rule of the GDPR. | |
| Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) Supervisory authorities of the federal states for non-public bodies (§ 40 BDSG) | Supplements the GDPR in Germany. § 38 BDSG: controllers and processors appoint a data protection officer where they 'in der Regel mindestens 20 Personen ständig mit der automatisierten Verarbeitung personenbezogener Daten beschäftigen', and regardless of headcount where processing is subject to a data protection impact assessment or personal data are processed commercially for transfer or market or opinion research. | |
| Bundesnetzagentur (BNetzA) Electricity and gas network operators | IT-Sicherheitskatalog für Strom- und Gasnetze — core requirement is an ISMS 'gemäß DIN EN ISO/IEC 27001 und dessen Zertifizierung'; BNetzA developed the certificate with DAkkS and accredited bodies are listed in the DAkkS database; no exemptions by operator size. BNetzA states the catalogues under the former § 11 Abs. 1a and 1b EnWG continue to apply to existing addressees until a new catalogue is published following the NIS-2 implementation act. | ISO/IEC 27001 |
| Bundesamt für Sicherheit in der Informationstechnik (BSI) Particularly important and important entities under NIS-2 (besonders wichtige und wichtige Einrichtungen) | BSI-Gesetz (BSIG) as amended by the Gesetz zur Umsetzung der NIS-2-Richtlinie und zur Regelung wesentlicher Grundzüge des Informationssicherheitsmanagements in der Bundesverwaltung (BGBl. 2025 I Nr. 301). § 30 BSIG requires appropriate, proportionate and effective technical and organisational measures that 'sollen den Stand der Technik einhalten, die einschlägigen europäischen und internationalen Normen berücksichtigen'; § 33 BSIG requires registration with the BSI. The BSI one-pager 'ISO/IEC 27001 im Kontext NIS-2/BSIG' states a certification can cover a large part of the § 30 measures but does not automatically meet all BSIG requirements. | |
| Bundesamt für Sicherheit in der Informationstechnik (BSI) Operators of critical facilities (Betreiber kritischer Anlagen) | § 39 BSIG — operators must prove implementation of the risk-management measures to the BSI 'durch Sicherheitsaudits, Prüfungen oder Zertifizierungen' and submit the results, including security deficiencies found; no specific standard is named. | |
| Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin) Financial entities (banks, insurers, investment firms and others under BaFin supervision) and their ICT third-party service providers | Digital Operational Resilience Act (DORA) — ICT risk management, ICT third-party risk management, incident reporting, register of information and testing; BaFin supervises application. No certification standard is named on the BaFin page. | |
| Bundesamt für Sicherheit in der Informationstechnik (BSI) Cloud service providers and their customers | Cloud Computing Compliance Criteria Catalogue (Kriterienkatalog C5) — first published by the BSI in 2016; fulfilment of the criteria can be attested by auditors (Wirtschaftsprüfer) engaged directly by the cloud provider. | |
| Zentralstelle der Länder für Gesundheitsschutz bei Arzneimitteln und Medizinprodukten (ZLG) Medical device and IVD manufacturers and the bodies that assess them | Medizinprodukterecht-Durchführungsgesetz (MPDG), which implements and supplements Regulation (EU) 2017/745 on medical devices; ZLG designates, recognises and monitors certification bodies, notified bodies and test laboratories for medical devices and in-vitro diagnostics. | |
| Competent official food control authorities (not named on the LMHV page) Food businesses (manufacture, handling and placing on the market of food) | Lebensmittelhygiene-Verordnung (LMHV) — regulates specific food hygiene questions and implements EU food hygiene law, applying the definitions of Regulation (EC) No 852/2004 on the hygiene of foodstuffs. The HACCP-principles duty sits in Regulation (EC) No 852/2004 itself (see the HACCP record, to verify on EUR-Lex). | HACCP |
| Federal law — Energieeffizienzgesetz (EnEfG) Companies with high energy consumption and operators of data centres | § 8 EnEfG: companies with an average annual total final energy consumption over the last three completed calendar years of 'mehr als 7,5 Gigawattstunden' must set up an energy or environmental management system; § 3 EnEfG defines an Energiemanagementsystem as a system meeting DIN EN ISO 50001 (December 2018 edition) and an Umweltmanagementsystem as a system under Regulation (EC) No 1221/2009 (EMAS). § 12 EnEfG requires data-centre operators to set up an energy or environmental management system, with validation or certification required for the data centres the section specifies. | ISO 50001, emas |
| Federal law — Arbeitsschutzgesetz (ArbSchG) All employers | § 3 ArbSchG: employers take the necessary occupational safety measures, check their effectiveness and, for planning and implementation, provide a suitable organisation and the necessary means; § 5 ArbSchG: assessment of the hazards connected with the work (Gefährdungsbeurteilung). No management-system standard is named. | |
| Bundesnetzagentur (BNetzA) Providers and deployers of AI systems | EU AI Regulation (KI-Verordnung) — the Bundesnetzagentur states it takes a central role in implementing the regulation in Germany and runs a KI-Service Desk for companies, authorities and organisations. | |
| Federal law — Hinweisgeberschutzgesetz (HinSchG) Employers (Beschäftigungsgeber) | § 12 HinSchG: employers must set up and operate at least one internal reporting office; the duty applies to employers 'mit jeweils in der Regel mindestens 50 Beschäftigten', and to certain financial-sector firms regardless of headcount. | |
| Federal law — Gesetz über Ordnungswidrigkeiten (OWiG) All businesses — supervision duty of owners and management | § 130 OWiG: an owner of a business who intentionally or negligently omits the supervisory measures required to prevent breaches of duties that carry a penalty or fine commits an administrative offence, where such a breach occurs that proper supervision would have prevented or made significantly more difficult; supervisory measures include the appointment, careful selection and monitoring of supervisory persons. | |
| VDA Qualitäts Management Center (VDA QMC) — IATF Oversight Office Automotive suppliers (quality management) | IATF 16949, published by the International Automotive Task Force; VDA QMC runs an IATF Oversight Office that witnesses IATF 16949 audits to monitor the approved certification bodies. IATF OEM members include BMW Group, Mercedes-Benz AG and Volkswagen Group. | IATF 16949 |
| ENX Association (scheme operator) with the VDA (publisher of the ISA catalogue) Automotive industry information security (OEMs, suppliers, engineering and service partners) | TISAX — based on the Information Security Assessment (ISA) catalogue maintained by the ENX Association and published by the VDA; third-party audits by TISAX audit providers, with results (TISAX labels) shared through the ENX exchange mechanism. | TISAX |
| Federal law — Strafgesetzbuch (StGB) All businesses — commercial bribery | § 299 StGB — Bestechlichkeit und Bestechung im geschäftlichen Verkehr (bribery and corruption in commercial practice) by employees or agents of a company. |
Accreditation and recognition
- Deutsche Akkreditierungsstelle (DAkkS): National accreditation body of the Federal Republic of Germany; accredits, among others, management-system certification bodies (DIN EN ISO/IEC 17021-1) and testing and calibration laboratories (DIN EN ISO/IEC 17025).
- Bundesamt für Sicherheit in der Informationstechnik (BSI): Not an accreditation body — issues ISO 27001 certificates on the basis of IT-Grundschutz after review by a BSI-certified ISO 27001 Grundschutz auditor; also certifies those auditors.
- Zentralstelle der Länder für Gesundheitsschutz bei Arzneimitteln und Medizinprodukten (ZLG): Designating authority for notified bodies, certification bodies and test laboratories for medical devices and in-vitro diagnostics.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Cities
Tenders and procurement
- Vergabeverordnung (VgV) — public contracts above the EU thresholds (Federal Government (federal ordinance; applied by all public contracting authorities)): § 49 VgV: where a contracting authority asks for certificates from independent bodies as proof of quality assurance standards, it refers to quality assurance systems that meet the relevant European standards and are certified by accredited bodies, and accepts equivalent certificates from accredited bodies in other states. For environmental management it refers to EMAS, other systems recognised under Regulation (EC) No 1221/2009, or other environmental management standards based on the relevant European or international standards and certified by accredited bodies. The ordinance does not make certificates mandatory; each tender sets its own criteria.
- Sektorenverordnung (SektVO) — contracts in transport, drinking water, postal services and energy supply (Federal Government (federal ordinance; applied by sector contracting entities)): § 49 SektVO mirrors § 49 VgV: where the contracting entity asks for certificates from independent bodies as proof of quality assurance or environmental management standards, the certificates are to come from accredited bodies, with equivalents accepted.
Economic zones
- Freihafen (Freizone) Bremerhaven: container and vehicle handling, stevedoring, shipping and forwarding, mineral oil storage and trade, cold storage, ship repair
- Freihafen Cuxhaven: storage and handling of frozen fishery products
Sterling in Germany
Sterling delivers in Germany from its Frankfurt office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in Germany, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions German clients ask
Are certification audits in Germany conducted in German or English?
Either can be used. German is the official language, and English is common in international groups and technology firms, so agree the audit language and the language of controlled documents with the certification body or assessor when you apply. Follow any language requirement in customer contracts, tenders or regulator correspondence, because BSI, BaFin, Bundesnetzagentur and the state data protection authorities all work in German.
Which accreditation should our certification body hold in Germany?
Look for the Deutsche Akkreditierungsstelle (DAkkS), Germany's national accreditation body, which accredits management-system certification bodies under DIN EN ISO/IEC 17021-1. DAkkS takes part, through its European co-operation for Accreditation membership, in the multilateral agreements between accreditation organisations, which is what gives its accreditation international recognition. For ISO/IEC 27001 there is a second German route: the BSI issues certificates on the basis of IT-Grundschutz after review by a BSI-certified auditor.
Do German public tenders require ISO certificates?
Not as a blanket rule. § 49 of the Vergabeverordnung does not make certificates mandatory, and each tender sets its own criteria. Where an authority does ask for certificates from independent bodies as proof of quality assurance, it refers to systems certified by accredited bodies and accepts equivalent certificates from accredited bodies in other states. The Sektorenverordnung mirrors this for transport, drinking water, postal and energy supply contracts. Always read the tender's own wording.
Which data protection authority supervises our company?
In most cases the data protection authority of the federal state where you are based. Under § 40 BDSG the authorities competent under state law supervise how non-public bodies apply data protection rules. If your company or group has several establishments in Germany, the GDPR's main-establishment rule decides which authority is competent. Confirm the position for your structure with your counsel or the authorities.
Does ISO 27001 certification satisfy NIS-2 in Germany?
Not automatically. The BSI's one-pager on ISO/IEC 27001 in the context of NIS-2 and the BSIG says a certificate can cover a large part of the § 30 measures but does not by itself meet every BSIG requirement. Operators of critical facilities have a separate duty under § 39 BSIG: they prove implementation through security audits, examinations or certifications, with no standard named. Check your own obligations with counsel or the BSI.
Must we have an energy management system?
Possibly, depending on size and activity. § 8 EnEfG requires an energy or environmental management system from companies whose average annual total final energy consumption over the last three completed calendar years exceeds 7.5 gigawatt hours. § 3 defines the energy route as a system meeting DIN EN ISO 50001 and the environmental route as EMAS. § 12 separately covers data-centre operators. Confirm your position with counsel.
Cities Sterling covers in Germany
Each city page sets out the industries, zones and standards that matter locally.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- EU General Data Protection Regulation (GDPR / DSGVO) — gesetze-im-internet.de (accessed 5 Oct 2026)
- Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) — gesetze-im-internet.de (accessed 5 Oct 2026)
- IT-Sicherheitskatalog für Strom- und Gasnetze — bundesnetzagentur.de (accessed 5 Oct 2026)
- BSI-Gesetz (BSIG) as amended by the Gesetz zur Umsetzung der NIS-2-Richtlinie und zur Regelung wesentlicher Grundzüge des Informationssicherheitsmanagements in der Bundesverwaltung (BGBl. 2025 I Nr. 301). § 30 BSIG requires appropriate, proportionate and effective technical and organisational measures that 'sollen den Stand der Technik einhalten, die einschlägigen europäischen und internationalen Normen berücksichtigen'; § 33 BSIG requires registration with the BSI. The BSI one-pager 'ISO/IEC 27001 im Kontext NIS-2/BSIG' states a certification can cover a large part of the § 30 measures but does not automatically meet all BSIG requirements. — gesetze-im-internet.de (accessed 5 Oct 2026)
- § 39 BSIG — gesetze-im-internet.de (accessed 5 Oct 2026)
- Digital Operational Resilience Act (DORA) — bafin.de (accessed 5 Oct 2026)
- Cloud Computing Compliance Criteria Catalogue (Kriterienkatalog C5) — bsi.bund.de (accessed 5 Oct 2026)
- Medizinprodukterecht-Durchführungsgesetz (MPDG), which implements and supplements Regulation (EU) 2017/745 on medical devices; ZLG designates, recognises and monitors certification bodies, notified bodies and test laboratories for medical devices and in-vitro diagnostics. — zlg.de (accessed 5 Oct 2026)
- Lebensmittelhygiene-Verordnung (LMHV) — gesetze-im-internet.de (accessed 5 Oct 2026)
- § 8 EnEfG: companies with an average annual total final energy consumption over the last three completed calendar years of 'mehr als 7,5 Gigawattstunden' must set up an energy or environmental management system; § 3 EnEfG defines an Energiemanagementsystem as a system meeting DIN EN ISO 50001 (December 2018 edition) and an Umweltmanagementsystem as a system under Regulation (EC) No 1221/2009 (EMAS). § 12 EnEfG requires data-centre operators to set up an energy or environmental management system, with validation or certification required for the data centres the section specifies. — gesetze-im-internet.de (accessed 5 Oct 2026)
- § 3 ArbSchG: employers take the necessary occupational safety measures, check their effectiveness and, for planning and implementation, provide a suitable organisation and the necessary means; § 5 ArbSchG: assessment of the hazards connected with the work (Gefährdungsbeurteilung). No management-system standard is named. — gesetze-im-internet.de (accessed 5 Oct 2026)
- EU AI Regulation (KI-Verordnung) — bundesnetzagentur.de (accessed 5 Oct 2026)
- § 12 HinSchG: employers must set up and operate at least one internal reporting office; the duty applies to employers 'mit jeweils in der Regel mindestens 50 Beschäftigten', and to certain financial-sector firms regardless of headcount. — gesetze-im-internet.de (accessed 5 Oct 2026)
- § 130 OWiG: an owner of a business who intentionally or negligently omits the supervisory measures required to prevent breaches of duties that carry a penalty or fine commits an administrative offence, where such a breach occurs that proper supervision would have prevented or made significantly more difficult; supervisory measures include the appointment, careful selection and monitoring of supervisory persons. — gesetze-im-internet.de (accessed 5 Oct 2026)
- IATF 16949, published by the International Automotive Task Force; VDA QMC runs an IATF Oversight Office that witnesses IATF 16949 audits to monitor the approved certification bodies. IATF OEM members include BMW Group, Mercedes-Benz AG and Volkswagen Group. — vda-qmc.de (accessed 5 Oct 2026)
- TISAX — enx.com (accessed 5 Oct 2026)
- § 299 StGB — gesetze-im-internet.de (accessed 5 Oct 2026)
- Deutsche Akkreditierungsstelle (DAkkS) — dakks.de (accessed 5 Oct 2026)
- Bundesamt für Sicherheit in der Informationstechnik (BSI) — bsi.bund.de (accessed 5 Oct 2026)
- Zentralstelle der Länder für Gesundheitsschutz bei Arzneimitteln und Medizinprodukten (ZLG) — zlg.de (accessed 5 Oct 2026)
- Vergabeverordnung (VgV) — public contracts above the EU thresholds — gesetze-im-internet.de (accessed 5 Oct 2026)
- Sektorenverordnung (SektVO) — contracts in transport, drinking water, postal services and energy supply — gesetze-im-internet.de (accessed 5 Oct 2026)
- Freihafen (Freizone) Bremerhaven — zoll.de (accessed 5 Oct 2026)
- Freihafen Cuxhaven — zoll.de (accessed 5 Oct 2026)
Talk to a consultant
Plan your certification with the Frankfurt team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
germany@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice