Where we work · India
ISO and GRC certification consulting in India
Achieve ISO and GRC certification in India with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 23 standards, one team
- Accredited certification route
- Mumbai office team
- Effivity and Academy included
Sectors that ask for certification in India
Clients include
ISO and GRC certification in India at a glance
India's demand for certification and compliance is driven by regulators as much as by any single law. SEBI's Cybersecurity and Cyber Resilience Framework states that ISO 27001 certification shall be mandatory for market infrastructure institutions and Qualified REs. The Reserve Bank of India issues IT governance, IT outsourcing and payment aggregator directions that reach banks, NBFCs and their providers, while IRDAI's guidelines let insurers accept ISO27001-certified vendors. The Digital Personal Data Protection Act, 2023 and the CERT-In Directions add data protection and incident duties. That keeps IT services, BPO and contact centres, banking and payments, insurance, pharmaceuticals and medical devices, export manufacturing, food processing and government suppliers working on ISO and GRC programmes. Certificates come from certification bodies accredited by the National Accreditation Board for Certification Bodies (NABCB), and laboratories are accredited by NABL. Sterling brings 20+ years and 8,100+ client engagements in 60+ countries to this work. Sterling's Navi Mumbai office delivers across India, with Effivity and Sterling Academy included with the engagement. Sterling does not certify; the local route and questions follow.
ISO and GRC standards Sterling delivers in India
Each page covers who needs the standard in India, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in India (12)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025 Data Protection Board of India (Ministry of Electronics and Information Technology owns the law) | Applies to Data Fiduciaries and Data Processors handling digital personal data. The Rules introduce a period for phased compliance; Significant Data Fiduciaries must conduct independent audits and impact assessments. The law requires security safeguards but does not cite any standard or create a certificate. Source is the Press Information Bureau backgrounder on the notified Rules. | |
| CERT-In Directions under section 70B(6) of the Information Technology Act, 2000 Indian Computer Emergency Response Team (CERT-In), MeitY | Apply to service providers, intermediaries, data centres, body corporate and Government organisations: clock synchronisation to NIC or NPL NTP servers (or traceable sources), reporting of listed cyber incidents to CERT-In within 6 hours of noticing them, and retention of ICT system logs for a rolling period of 180 days. No standard or certification is cited. | |
| Securities and Exchange Board of India (SEBI) SEBI-regulated entities — market infrastructure institutions (MIIs) and other regulated entities | Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities, Circular No. SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113 dated 20 August 2024 — states that ISO 27001 certification shall be mandatory for MIIs and Qualified REs, with evidence of certification submitted along with the cyber audit report; it states that standards such as ISO 27000 series, CIS v8 and NIST 800-53 were referred to while formulating the framework. Later SEBI circulars (2025) extended implementation and issued technical clarifications — check them for current timelines. | ISO/IEC 27001 |
| Reserve Bank of India (RBI) Commercial banks, Top/Upper/Middle Layer NBFCs, credit information companies and All India Financial Institutions | Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices (RBI/2023-24/107, 7 November 2023) — board-approved IT, information security and business continuity policies, an Information Security Committee and CISO, and a business continuity and disaster recovery chapter; no ISO standard is cited. | |
| Reserve Bank of India (RBI) IT service providers to RBI-regulated entities (banks, NBFCs and others) | Master Direction on Outsourcing of Information Technology Services (RBI/2023-24/102, 10 April 2023) — due diligence on a provider's security and internal control, audit coverage, business continuity management and disaster recovery; contracts to cover compliance with the IT Act 2000 and standards to protect customer data; pooled (shared) audits by an independent third-party auditor are allowed; no ISO standard or SOC report is cited. | |
| Reserve Bank of India (RBI) Payment aggregators and their merchants | Master Direction on Regulation of Payment Aggregator (PA), RBI/DPSS/2025-26/141 dated 15 September 2025 — PAs shall ensure merchants' infrastructure is compliant with security standards like PCI-DSS and PCI-SSF as applicable; data security standards like PCI-DSS shall be implemented; reports to the IT Committee include PCI-DSS Attestation of Compliance (AOC) and Report of Compliance (ROC). | PCI DSS |
| Insurance Regulatory and Development Authority of India (IRDAI) Insurers and insurance intermediaries, and their vendors and cloud providers | IRDAI Information and Cyber Security Guidelines, 2023 (Ver 1.0, April 2023) — a vendor certified under ISO27001 whose services are within the certificate's scope / statement of applicability may be accepted in place of periodic audits by the organisation (with a self-certificate and a copy of the certificate); recommends cloud service providers who are BS25999 or ISO 22301 certified. | ISO/IEC 27001, ISO 22301 |
| Central Drugs Standard Control Organisation (CDSCO), Medical Devices Division Medical device manufacturers and importers | Medical Devices Rules, 2017 (MDR-2017), per the CDSCO FAQ (CDSCO/FAQ/MD/01/2024) — manufacturers comply with the Quality Management System requirements of the Fifth Schedule; only Notified Bodies registered with CDSCO audit Class A and Class B manufacturing sites; importers submit a quality certificate conforming to the QMS per the Fourth Schedule. The FAQ does not name ISO 13485. | |
| FSSAI, BEE, PNGRB, CDSCO, BIS, DGFT, DGQA, DGCA and others Food businesses, energy, petroleum and natural gas, export and consumer affairs regulators | NABCB lists these among regulators and government bodies relying on NABCB accreditation, and APEDA and FSSC 22000 among scheme owners recognising it; the page does not state the scheme each relies on it for. | |
| Bureau of Energy Efficiency (BEE) Energy-intensive designated consumers | Energy Conservation Act, 2001 — designated consumers report energy consumption and are set energy consumption norms under the Perform Achieve Trade (PAT) scheme; ISO 50001 is not cited on the page. | |
| Ministry of Electronics and Information Technology (MeitY), IndiaAI Mission Developers and deployers of artificial intelligence | India AI Governance Guidelines (unveiled 5 November 2025) — seven guiding principles (sutras), recommendations across six pillars of AI governance and practical guidelines for industry; MeitY states a focus on using existing legislation wherever possible; no ISO standard is cited in the release. | |
| Securities and Exchange Board of India (SEBI) Top 1000 listed companies by market capitalisation | Business Responsibility and Sustainability Report (BRSR), Circular SEBI/HO/CFD/CMD-2/P/CIR/2021/562 dated 10 May 2021 — disclosures against the nine principles of the National Guidelines on Responsible Business Conduct; mandatory for the top 1000 listed companies from FY 2022-23; the circular does not cite ISO standards. |
Accreditation and recognition
- National Accreditation Board for Certification Bodies (NABCB): National accreditation body for certification, inspection and validation/verification bodies; a constituent board of the Quality Council of India; accredits management-system certification bodies to ISO/IEC 17021-1.
- National Accreditation Board for Testing and Calibration Laboratories (NABL): National accreditation body for testing and calibration laboratories (ISO/IEC 17025), medical laboratories (ISO 15189), proficiency testing providers (ISO/IEC 17043) and reference material producers (ISO 17034); a constituent board of the Quality Council of India.
- Bureau of Indian Standards (BIS): National standards body; adopts ISO standards as Indian Standards (IS/ISO) and operates its own management system certification.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Cities
Tenders and procurement
- Government e-Marketplace (GeM) — General Financial Rules, 2017, Rule 149 (Department of Expenditure, Ministry of Finance; GeM SPV): Procurement of goods and services by Ministries or Departments is mandatory for items available on GeM; the credentials of suppliers on GeM are certified by GeM SPV. The rule does not list ISO certificates; any certificate requirement is set in the individual bid.
- Registration of Suppliers — General Financial Rules, 2017, Rule 150 (Department of Expenditure, Ministry of Finance): Credentials, manufacturing capability, quality control systems, past performance, after-sales service, financial background etc. of suppliers should be carefully verified before registration; registration is for a fixed period depending on the goods. No ISO certificate is named.
Economic zones
- GIFT IFSC (International Financial Services Centre, GIFT City, Gandhinagar): banking, capital markets, insurance
- SEEPZ Special Economic Zone (Santacruz Electronics Export Processing Zone), Mumbai: electronics manufacturing for export
- Software Technology Parks of India (STPI) — STP scheme: software and IT services exports, electronics system design and manufacturing incubation
Sterling in India
Sterling delivers in India from its Mumbai office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in India, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions Indian clients ask
Are certification audits in India conducted in English?
Usually yes. English is the normal language of business documentation and certification audits in India, even though Hindi and English are the Union government's official languages. Shop-floor interviews may need Hindi or the state language. Agree the audit language, any interpreter and the language of controlled documents with the certification body at application, so the audit team and your people understand each other.
Which accreditation should a certification body hold for India?
Choose a certification body accredited by the National Accreditation Board for Certification Bodies (NABCB), India's accreditation body for management-system certifiers working to ISO/IEC 17021-1. NABCB says it sits within the IAF, ILAC and APAC recognition arrangements, which gives its accreditation international standing. BIS also certifies several systems, but it is a certification body rather than an accreditation body, so ask who accredited your certifier.
Is ISO 27001 mandatory for any Indian regulated entities?
For some entities, yes. SEBI's CSCRF circular of 20 August 2024 states that ISO 27001 certification shall be mandatory for market infrastructure institutions and Qualified REs. IRDAI's 2023 guidelines instead let insurers accept an ISO27001-certified vendor in place of periodic audits, and RBI's IT governance and outsourcing directions name no ISO standard. Later SEBI circulars changed timelines, so confirm the current position with the regulator.
Do Indian government tenders require ISO certificates?
Not as a general rule. Rule 149 of the General Financial Rules, 2017 makes GeM mandatory for items available on it but lists no ISO certificates, so any certificate requirement sits in the individual bid. Rule 150 on supplier registration asks that quality control systems and other credentials be carefully verified. Read the eligibility clause of each tender to see what it asks for.
Does the DPDP Act come with a certificate?
No. The Digital Personal Data Protection Act, 2023 requires security safeguards but cites no standard and creates no certificate. What you hold is your own evidence of compliance. Significant Data Fiduciaries have a further duty: they must conduct independent audits and impact assessments. Ask your counsel whether your organisation could fall into that category.
Can audits be scheduled around Diwali and other festivals?
Yes, with forward planning. National holidays and state-specific festival holidays, among them Diwali, Holi, Eid and regional new-year festivals, affect audit scheduling, and because dates follow lunar calendars they vary by state. Tell the certification body which states your sites operate in when you apply, so audit dates avoid local closures instead of relying on one fixed calendar.
Cities Sterling covers in India
Each city page sets out the industries, zones and standards that matter locally.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025 — static.pib.gov.in (accessed 5 Oct 2026)
- CERT-In Directions under section 70B(6) of the Information Technology Act, 2000 — cert-in.org.in (accessed 5 Oct 2026)
- Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities, Circular No. SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113 dated 20 August 2024 — sebi.gov.in (accessed 5 Oct 2026)
- Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices (RBI/2023-24/107, 7 November 2023) — rbi.org.in (accessed 5 Oct 2026)
- Master Direction on Outsourcing of Information Technology Services (RBI/2023-24/102, 10 April 2023) — rbi.org.in (accessed 5 Oct 2026)
- Master Direction on Regulation of Payment Aggregator (PA), RBI/DPSS/2025-26/141 dated 15 September 2025 — rbi.org.in (accessed 5 Oct 2026)
- IRDAI Information and Cyber Security Guidelines, 2023 (Ver 1.0, April 2023) — irdai.gov.in (accessed 5 Oct 2026)
- Medical Devices Rules, 2017 (MDR-2017), per the CDSCO FAQ (CDSCO/FAQ/MD/01/2024) — cdsco.gov.in (accessed 5 Oct 2026)
- NABCB lists these among regulators and government bodies relying on NABCB accreditation, and APEDA and FSSC 22000 among scheme owners recognising it; the page does not state the scheme each relies on it for — nabcb.qci.org.in (accessed 5 Oct 2026)
- Energy Conservation Act, 2001 — beeindia.gov.in (accessed 5 Oct 2026)
- India AI Governance Guidelines (unveiled 5 November 2025) — pib.gov.in (accessed 5 Oct 2026)
- Business Responsibility and Sustainability Report (BRSR), Circular SEBI/HO/CFD/CMD-2/P/CIR/2021/562 dated 10 May 2021 — sebi.gov.in (accessed 5 Oct 2026)
- National Accreditation Board for Certification Bodies (NABCB) — nabcb.qci.org.in (accessed 5 Oct 2026)
- National Accreditation Board for Testing and Calibration Laboratories (NABL) — nabl-india.org (accessed 5 Oct 2026)
- Bureau of Indian Standards (BIS) — bis.gov.in (accessed 5 Oct 2026)
- Government e-Marketplace (GeM) — General Financial Rules, 2017, Rule 149 — doe.gov.in (accessed 5 Oct 2026)
- Registration of Suppliers — General Financial Rules, 2017, Rule 150 — doe.gov.in (accessed 5 Oct 2026)
- GIFT IFSC (International Financial Services Centre, GIFT City, Gandhinagar) — ifsca.gov.in (accessed 5 Oct 2026)
- SEEPZ Special Economic Zone (Santacruz Electronics Export Processing Zone), Mumbai — seepz.gov.in (accessed 5 Oct 2026)
- Software Technology Parks of India (STPI) — STP scheme — stpi.in (accessed 5 Oct 2026)
Talk to a consultant
Plan your certification with the Navi Mumbai team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
india@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice