Where we work · India and South Asia
ISO and GRC consulting in India and South Asia, led by ISO consultants based in Navi Mumbai.
Sterling's regional headquarters in Navi Mumbai supports organisations across India and South Asia with ISO certification, cybersecurity, data protection and sustainability reporting programmes. Our expert and experienced consultants work with your team from gap analysis to the certification audit, with India's accreditation boards and regulators in view from the first workshop. We ensure successful certification for our clients.
- A regional headquarters in CBD Belapur, Navi Mumbai, part of a group implementing management systems since 2003
- Programmes that account for India's own rules: the DPDP Act, CERT-In directions and the RBI and SEBI frameworks where they apply
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify; an accredited body audits and decides
- Certificates buyers acceptA system certified by a body whose accreditation you have checked against what your customers and tenders ask for.
- Indian rules built inDPDP Act, CERT-In and sector duties mapped into the same system rather than run as separate projects.
- One programme, several sitesPlants, offices and delivery centres in different states under one engagement team and one Effivity workspace.
- Evidence that keeps runningRecords produced by daily work, so surveillance audits, client due diligence and regulator requests draw on one source.
Countries
Each country page sets out the regulators, the accreditation route and every standard Sterling delivers there.
Offices
Sterling in India and South Asia: one regional headquarters, one engagement team.
Our regional headquarters in Navi Mumbai leads engagements across India and the wider region, with consultants travelling to your sites whenever observation or in-person work is needed.
- Navi Mumbai (regional headquarters)304, A-wing, 3rd floor, Shree Nand Dham, Sector 11, opposite Raheja Arcade, CBD Belapur, Navi Mumbai 400 614 · +91 98217 80035 · india@sterling-grc.com
For sites elsewhere in South Asia, the Navi Mumbai team leads the programme and agrees the on-site plan with you in the proposal. Every other Sterling office, including the global headquarters in New York, is listed under All offices and contact details.
Standards in demand
The standards and frameworks organisations in India ask us about.
Most programmes start with a certifiable ISO standard that customers or tenders ask for, then add the Indian rules that apply to the business: the DPDP Act for personal data, the RBI and SEBI frameworks for regulated financial entities and SEBI BRSR for listed companies. ISO 22000, ISO/IEC 42001, SOC 2 and PCI DSS programmes are led from the same office.
- ISO 9001Quality management
- ISO/IEC 27001Information security
- ISO 14001Environmental management
- ISO 45001Occupational safety
- ISO/IEC 17025Laboratory competence
- DPDP ActData protection
- RBI and SEBI cybersecurity frameworks (India)Financial regulation
- SEBI BRSR (India)Sustainability reporting
- All standards & frameworksThe full catalogue, with sector schemes
Bodies and regulators
Who accredits, who certifies and who regulates in India and South Asia.
Sterling does not certify or accredit. In India, certification bodies are accredited by NABCB and laboratories by NABL, both constituent boards of the Quality Council of India (QCI). Data protection, cyber incident reporting and financial-sector rules are separate legal duties with no certificate attached.
| Country | Accreditation body and recognition | Regulators and schemes that ask for certification |
|---|---|---|
| India: management system certification | NABCB, an autonomous body set up by the Ministry of Commerce and Industry, accredits certification bodies to ISO/IEC 17021-1 and publishes a directory of accredited bodies. Global ACI recognition not confirmed; see the note below | ISO 9001, ISO 14001, ISO 45001 and ISO/IEC 27001 are voluntary and asked for by customers. Check any certificate in NABCB's directory or on IAF CertSearch |
| India: testing and calibration laboratories | NABL, the National Accreditation Board for Testing and Calibration Laboratories, accredits laboratories to ISO/IEC 17025. Global ACI recognition not confirmed | NABL asks applicants to take part successfully in at least one proficiency testing programme before accreditation is granted |
| India: cyber incidents | No accreditation route: these are directions, not a certificate | CERT-In directions of 28 April 2022 under section 70B(6) of the Information Technology Act, 2000: reportable incidents within six hours of noticing them, and ICT system logs kept for a rolling 180 days within India |
| India: personal data | No certification exists under the Act; the Data Protection Board of India inquires and penalises | Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025: main duties from May 2027, breach details to the Board within 72 hours, and a yearly DPIA and audit for Significant Data Fiduciaries |
| India: banking, payments and listed companies | No certification; SEBI cyber audits are carried out by a CERT-In empanelled IS auditing organisation, and BRSR Core by an independent assurance or assessment provider | RBI 2026 cybersecurity directions for commercial banks and NBFCs, and RBI Master Directions for non-bank payment system operators; SEBI CSCRF of 20 August 2024; SEBI BRSR for the top 1,000 listed companies |
Global ACI replaced the IAF MLA and the ILAC MRA on 1 January 2026. NABCB states IAF, ILAC and APAC membership and signatory status on its own site, but neither NABCB nor NABL appeared on Global ACI's list of recognised accreditation bodies when we checked, so confirm each board's current standing before you rely on it. For sites in other South Asian countries, we confirm the accreditation body and the local rules during scoping.
How we deliver
One method, delivered where you are.
Engagements in India and South Asia follow the staged method Sterling uses in every region, led from the Navi Mumbai office.
- One engagement team accountable across every country you operate in, with local consultants where the work is
- Remote and on site: workshops, document reviews and coaching remotely; site work where observation or in-person work is necessary, with short travel from the regional offices
- One Effivity workspace for every site, included with the engagement at no additional cost
- One certification body for multi-site programmes where the body agrees, with local requirements handled where they arise
- Design™ or Drive™: your team implements with Sterling's structure and coaching, or Sterling consultants take on the agreed consulting and documentation work
Indian programmes often cover several plants or offices in different states, with customers who run their own supplier audits. We plan scope, sampling and site visits around that, keep the DPDP Act, CERT-In directions and any RBI or SEBI obligations on the same risk register as the ISO requirements, and prepare your team for the certification body's readiness review and certification audit. Where a SEBI-regulated entity needs its cyber audit, or a listed company needs BRSR Core assurance or assessment, you appoint the independent auditor or provider; Sterling prepares the controls and the evidence they will test.
Effivity · included with the engagement
Your system runs in software from the first workshop.
Effivity is the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures it within the agreed scope, so evidence accumulates as people do their work and the certification auditor reviews a live system rather than a binder. Sterling consulting clients get their subscription included with the engagement, at no additional cost.
ISO & GRC softwareSterling Academy · included with the engagement
Your people learn the standard, not just the forms.
E-learning with practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online, with progress by department for the certification audit. Sterling consulting clients get preferential course access and special pricing, including complimentary awareness training for their people as part of the engagement.
Contact us about Academy accessStandards
Most requested in India and South Asia
- ISO 9001ISO 9001 certification consulting: a quality management system built with your people, evidence prepared and support until an accredited body certifies you.
- ISO/IEC 27001ISO/IEC 27001 certification consulting: an ISMS built with your people, evidence prepared, and support through Stage 1, Stage 2 and surveillance audits.
- ISO 14001ISO 14001 certification consulting: aspects, impacts and compliance obligations controlled, with support until an accredited body certifies you.
- ISO 45001ISO 45001 certification consulting to prevent work-related injury and ill health, with an OH&S system built with your people and audit-ready, in 60+ countries.
- ISO 22301ISO 22301 certification consulting to keep delivering through disruption: impact analysis, continuity plans and exercises, prepared for an accredited audit.
- ISO 13485ISO 13485 certification consulting for medical device makers: design controls, risk, traceability and complaints, prepared for an accredited audit.
- SOC 2SOC 2 Readiness and compliance consulting: controls mapped to the Trust Services Criteria and evidence prepared for the CPA firm's SOC 2 attestation report.
- ISO/IEC 27701ISO/IEC 27701 certification consulting: privacy management for controllers and processors of PII, built on your ISMS and prepared for an accredited audit.
Where we work
Your business
crosses borders.
Your programme can too.
A Sterling lead in your working hours, wherever you operate. Multi-site programmes run with one engagement team, one Effivity workspace and one certification body, with local requirements and customer expectations handled where they arise.
Global headquarters in New York; regional headquarters in Dubai, Navi Mumbai, Manila, London, Enschede and Johannesburg; offices in 21 countries.
All offices and contact detailsClient experience in India and South Asia
Client letters on file, available on request.
Signed client letters are available on request. The client feedback wall lists every letter by standard. Ask for references in your sector and country before you decide.
- 60+countries where Sterling has delivered certification
- 21countries with a Sterling office, eight regions, one coordinated team
- 2003the year the group began implementing ISO management systems; the same method, refined, since
- 8,100+client engagements across the group, from single-site SMEs to multinationals
FAQs
Questions clients in India and South Asia ask before they engage us.
The specific answers for your organisation come from the discovery call. These are the general ones.
Where is Sterling's office in India?
Sterling's regional headquarters for India and South Asia is at 304, A-wing, Shree Nand Dham, Sector 11, CBD Belapur, Navi Mumbai 400 614. You can reach the team on +91 98217 80035 or at india@sterling-grc.com. Consultants run workshops and document reviews remotely and travel to your sites when observation or in-person work is needed, so the office location does not limit where in India we work.
Who accredits certification bodies in India?
NABCB accredits management system certification bodies in India, assessing them against ISO/IEC 17021-1. It is a constituent board of the Quality Council of India, set up as an autonomous body by the Ministry of Commerce and Industry, and it publishes a directory of the bodies it accredits. Laboratories are accredited separately, by NABL. Before you choose a certification body, check its accreditation and scope for your standard, and verify issued certificates on IAF CertSearch.
How does the DPDP Act fit with an ISO/IEC 27001 programme?
The two work together but do different jobs. The Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 are law: the main duties apply from May 2027, no certificate proves compliance and the Data Protection Board of India inquires and penalises. ISO/IEC 27001 is a certifiable standard whose controls are commonly aligned in practice with the Act's safeguards, one-year log retention and 72-hour breach reporting. We build both into one system.
Do CERT-In's directions affect our information security programme?
Yes, they add duties your programme should cover. CERT-In's directions of 28 April 2022 apply to service providers, intermediaries, data centres, body corporate and government organisations. They require reportable cyber incidents to be reported within six hours of noticing them and the logs of all ICT systems to be kept for a rolling 180 days within India, with clocks synchronised to approved time sources. We write these into your incident procedure and logging controls.
We are regulated by RBI or SEBI. Can Sterling help?
Yes, with the controls, governance and evidence; compliance is assessed by the regulator and its auditors, not by Sterling. RBI's 2026 directions for commercial banks and NBFCs, issued on 31 July 2026, cover board oversight, baseline cybersecurity, information systems audit and incident reporting within six hours. SEBI's Cybersecurity and Cyber Resilience Framework of 20 August 2024 applies to its regulated entities, with cyber audits by a CERT-In empanelled IS auditing organisation.
Can Sterling provide assurance on our BRSR Core disclosures?
No. SEBI requires BRSR Core assurance or assessment by an independent provider, and its circular of 28 March 2025 bars that provider and its associates from offering consulting services to the listed entity or its group. Sterling helps you prepare: data collection across the nine principles, the BRSR Core indicators, value-chain information where you choose to disclose it, and evidence your provider can test. BRSR is mandatory for the top 1,000 listed companies by market capitalisation.
Do you support sites elsewhere in South Asia?
Programmes that include sites in other South Asian countries are led from Navi Mumbai under the same engagement team, with remote work and on-site visits planned in the proposal. During scoping we confirm the accreditation body, the certification body's coverage and the local regulations for each country, because the bodies and rules on this page are India's. Multi-country groups can keep every site in one Effivity workspace and, where the certification body agrees, one certification programme.
Keep exploring
More places we work
Offices and regions
Talk to a consultant
Plan your certification in India and South Asia with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice