Where we work · Israel
ISO and GRC certification consulting in Israel
Achieve ISO and GRC certification in Israel with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Dubai office team
- Effivity and Academy included
Sectors that ask for certification in Israel
Clients include
ISO and GRC certification in Israel at a glance
Israel's privacy regime changed with Amendment No. 13 to the Protection of Privacy Law, 5741-1981, which the Privacy Protection Authority's guide says takes effect on 14 August 2025, and the Authority supervises it alongside the Privacy Protection Regulations (Data Security), 5777-2017. Around that sit sector rules: the Supervisor of Banks' Cyber Defense Management directive for banking corporations, the Ministry of Health's Medical Equipment Division, whose declaration route asks for a manufacturer quality management system certificate such as ISO 13485, and the National Food Services, which controls imported food. The Israel Laboratory Accreditation Authority, ISRAC, accredits laboratories and inspection bodies, while certificates for management systems usually carry accreditation from a body within the international mutual recognition arrangements (Global ACI — Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Certificates come from accredited certification bodies, never from Sterling. Demand comes from software and cyber companies, medical device and pharmaceutical makers, food exporters, banks and insurers. Sterling's Dubai office serves clients in Israel on-site where the work needs it and remotely otherwise, bringing 20+ years, 8,100+ client engagements in 60+ countries, and Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Israel
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Israel (12)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Protection of Privacy Law, 5741-1981, as amended (including Amendment No. 13) Privacy Protection Authority, led by a Head of the Authority appointed by the government; the Law defines the Head of the Authority as 'an individual appointed by the government to lead the Privacy Protection Authority' and makes the Head responsible for supervising the database provisions | The Law defines a database as a collection of personal data processed by digital means, excluding a collection kept for personal, non-business use and a small name-address-contact collection of 100,000 or fewer people with no other personal details. A database must be registered where its main purpose is supplying personal data to others for business or consideration, including direct mailing, and it covers more than 10,000 people, and public bodies must register too, except for databases holding only their employees' data; processing an unregistered database that must be registered is prohibited. Databases that need no registration must still be notified to the Authority where data of special sensitivity covers more than 100,000 people. The Authority's guide lists the special-sensitivity categories as including health, genetic and biometric data, origin, criminal history, salary and financial activity, and location and communications data from licensed providers. The Law requires data security officers for certain controllers and processors and data protection officers for listed categories; the guide says data protection officers are required for public bodies and for certain private entities such as banks, insurers, hospitals and health funds where processing carries high privacy risk, and information security officers for controllers of five or more databases that must be registered or notified, public bodies, banks, insurers and credit rating companies. Every person may access personal data about them in a database and may ask for inaccurate, incomplete, unclear or outdated data to be corrected or deleted. The Amendment gives the Authority administrative enforcement tools and lets it ask the administrative court for an order to stop processing in a database. The Authority's guide states that the Amendment anchors its independence in law. | |
| Protection of Privacy Regulations (Data Security), 5777-2017 Privacy Protection Authority; the Regulations are made by the Minister of Justice under the Law | Databases fall into basic, medium or high security levels set by schedules, with a separate category for a database managed by an individual. The medium level covers, among others, databases whose main purpose is collecting data for transfer to third parties, databases controlled by a public body and databases holding sensitive categories such as medical, genetic, criminal record, biometric and financial information; the high level covers medium-category databases with data on 100,000 or more people, or public-body databases with more than 100 authorised users. Obligations fall on the database controller and, under Regulation 19, extend largely to managers and processors. The Regulations do not name an ISO or NIST framework; Regulation 20(b) refers generically to an official, Israeli or international standard as defined in the Standards Law, 5713-1953, and to guidance approved by the Registrar. | |
| Privacy Protection Authority Guidance No. 1/2024 on the role of the board of directors under the Data Security Regulations Privacy Protection Authority | The guidance applies to companies where processing personal data is central to the activity or creates increased privacy risk. It says the board should ensure a policy exists for complying with the Regulations, including prompt reporting of data security breaches to the Authority, and should generally discuss the database definitions document, the main principles of the data security procedure, risk assessment and penetration test results with corrective actions, data breaches, and periodic compliance audit reports. The board may assign these duties to another internal body but must keep supervising them and document its reasoning. | |
| EU adequacy decision for Israel (Decision 2011/61/EU) European Commission (the decision concerns transfers from the EU to Israel; Israel's own supervisor is the Privacy Protection Authority) | The decision's title limits the adequacy finding to automated processing of personal data. It matters to organisations that receive personal data from the EU; EUR-Lex shows the decision dated 31 January 2011. | |
| Supervisor of Banks, Bank of Israel Banking corporations | Proper Conduct of Banking Business Directive on Cyber Defense Management (Directive 361): original directive issued 16 March 2015 (Circular 2457), current version updated 30 September 2021 (Circular 2669). It applies to banking corporations under the Banking (Licensing) Law, 5741-1981, and to controlled corporations treated as banking corporations. The board approves the cyber defence strategy, risk framework and policy; a Chief Cyber Defense Officer is required; cyber risks and controls are assessed at least once a year; a continuous monitoring function and an incident log are required; and internal audit audits the cyber defence programme. The directive does not name ISO/IEC 27001 or any other standard; it cross-refers to the Supervisor's directives on risk management, operational risk management, business continuity management, information technology management and internal audit. | |
| Medical Equipment Division (AMAR), Ministry of Health Medical devices | Procedure for registering medical equipment via the declaration route, no. REG-2023/04, dated 3 September 2023, issued under the Medical Equipment Law, 5772-2012 and the Medical Equipment Regulations (Registration of Medical Equipment in the Register and Its Renewal), 5773-2013. The route is open to class I devices and low-risk in-vitro diagnostic laboratory products that are registered or approved and marketed in a recognised country. The declaration annex states that the device is made under adequate manufacturing conditions meeting the requirements of ISO 13485, and the submission must include a valid manufacturer quality management system certificate, such as ISO 13485. | ISO 13485 |
| Institute for Standardization and Control of Pharmaceuticals (ISCP), Jerusalem Pharmaceuticals | PIC/S lists the Institute for Standardization and Control of Pharmaceuticals as Israel's participating authority in the Pharmaceutical Inspection Co-operation Scheme, with the entry 'Accession to PIC Scheme January 2009'. PIC/S is a good manufacturing practice inspection scheme; the entry does not cite ISO standards. | |
| National Food Services, Ministry of Health Food imports and food control | The National Food Services page describes the control of imported food: importers obtain a registration certificate, regular food needs confirmation of the importer declaration and sensitive food needs early import approval, and food is examined at the port and in some cases at storage. The Public Health Protection Regulations (Food) (Declaration of Sensitive Food), 5780-2019 took effect on 10 December 2019. The page covers imports only; it does not describe export procedures and does not cite HACCP, ISO 22000 or FSSC 22000. | |
| Capital Market, Insurance and Savings Authority, Ministry of Finance Insurance, pension and provident funds | The Authority's page describes it as overseeing financial services in the insurance, pension and provident fund markets, regulating supervised entities, auditing their business activities and reviewing their relationships with customers. The page does not mention cyber or information technology directives or any ISO standard. | |
| Israel National Cyber Directorate (INCD) National cyber policy and incident response | The Directorate wrote Israel's national cyber security strategy with ministries, industry and academic experts. The strategy states that the Directorate operates the national computer emergency response team, with a 119 helpline, and the national vulnerability disclosure programme. It identifies a regulatory gap in cyber security for essential organisations and proposes a dedicated law that would define essential organisations, require cyber risk management and reporting of certain attacks, and give sectoral regulators enforcement tools; this is a proposal in the strategy, not an enacted law. It plans cyber requirements in government procurement and mentions supply chain security. It does not mention ISO/IEC 27001. | |
| Israel Innovation Authority Technology and research and development funding | The Authority describes itself as an independent statutory authority that promotes innovation as a driver of economic growth. It formulates innovation policy and carries it out through support tracks and funding tools, including research and development grants, a Startup Division, incubators, manufacturing accelerators and financing for research and development collaborations with foreign companies. The page says it replaced the Office of the Chief Scientist under Amendment No. 7 to the Law to Encourage Research, Development and Technological Innovation in Industry, 1984, and it sets no ISO certification conditions. | |
| Standards Institution of Israel (SII) Standardisation | The Institution's site says it operates pursuant to the Standards Law, adopts international and foreign national standards and writes its own for products and services, using standardisation committees with representatives from across the economy, and lists membership of ISO and IEC. This record uses it only as the national standards body. |
Accreditation and recognition
- Israel Laboratory Accreditation Authority (ISRAC): National accreditation body for laboratories — ISRAC's site describes it as a corporation established by the Israel Laboratory Accreditation Authority Law, 1997 and as the official statutory authority for laboratory accreditation in Israel; it accredits testing and calibration laboratories, medical laboratories (ISO 15189), inspection bodies (ISO/IEC 17020) and proficiency testing providers (ISO/IEC 17043), and acts as the designated representative for recognising GLP test facilities.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Mandatory Tenders Law, 5752-1992 and Mandatory Tenders Regulations, 5753-1993 (Government Procurement Administration, Ministry of Finance): The Government Procurement Administration's regulations page lists the Mandatory Tenders Law, 5752-1992 (published 12 March 1992) and the Mandatory Tenders Regulations, 5753-1993 (published 19 May 1993). The page states no ISO or other quality certificate requirement; any such requirement sits in the individual tender document.
Sterling in Israel
Sterling delivers in Israel from its Dubai office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Israel clients ask
Has Amendment No. 13 to Israel's Protection of Privacy Law taken effect, and who supervises it?
The Privacy Protection Authority's guide to Amendment No. 13 states that it takes effect on 14 August 2025, and gov.il's translation of the Law is headed 'Updated After Amendment 13'. The Privacy Protection Authority supervises it, led by a Head of the Authority appointed by the government. Confirm how it applies to your databases with your counsel or the Authority.
Which accreditation body stands behind an ISO certificate for an Israeli company?
Ask the certification body to show its accreditation certificate and scope. Israel's national body, ISRAC, accredits laboratories, inspection bodies and proficiency testing providers, and its published scope list does not include certification bodies, so a management system certificate usually carries accreditation from a body in another economy within the international arrangements. Check that the scope covers your standard and sector.
Do Israeli banks follow specific cyber defence rules?
Yes. The Supervisor of Banks' Directive on Cyber Defense Management applies to banking corporations and controlled corporations treated as banks. It has the board approve a cyber defence strategy and policy, requires a Chief Cyber Defense Officer, an annual cyber risk assessment and continuous monitoring, and it does not name ISO/IEC 27001. Suppliers should expect banks to translate these duties into contract terms.
Does an Israeli medical device maker need ISO 13485 to register a device?
Under the Ministry of Health's declaration route, effectively yes. Class I devices and low-risk in-vitro diagnostic products are registered on the maker's declaration of manufacturing conditions meeting ISO 13485, backed by a valid quality management system certificate. Other device classes follow other procedures, so check which route fits your product with the Medical Equipment Division.
Are certification audits in Israel conducted in English?
Often partly, but the certification body and client agree the language at application. Hebrew is the binding text of Israeli laws and regulations, gov.il publishes English translations, and the privacy Law lets a person receive access to their data in Hebrew, Arabic or English. Say early which records exist in which language and whether an interpreter will be needed.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Protection of Privacy Law, 5741-1981, as amended (including Amendment No. 13) — gov.il (accessed 17 Oct 2026)
- Protection of Privacy Regulations (Data Security), 5777-2017 — gov.il (accessed 17 Oct 2026)
- Privacy Protection Authority Guidance No. 1/2024 on the role of the board of directors under the Data Security Regulations — gov.il (accessed 17 Oct 2026)
- EU adequacy decision for Israel (Decision 2011/61/EU) — eur-lex.europa.eu (accessed 17 Oct 2026)
- Proper Conduct of Banking Business Directive on Cyber Defense Management (Directive 361): original directive issued 16 March 2015 (Circular 2457), current version updated 30 September 2021 (Circular 2669). It applies to banking corporations under the Banking (Licensing) Law, 5741-1981, and to controlled corporations treated as banking corporations. The board approves the cyber defence strategy, risk framework and policy; a Chief Cyber Defense Officer is required; cyber risks and controls are assessed at least once a year; a continuous monitoring function and an incident log are required; and internal audit audits the cyber defence programme. The directive does not name ISO/IEC 27001 or any other standard; it cross-refers to the Supervisor's directives on risk management, operational risk management, business continuity management, information technology management and internal audit. — boi.org.il (accessed 17 Oct 2026)
- Procedure for registering medical equipment via the declaration route, no. REG-2023/04, dated 3 September 2023, issued under the Medical Equipment Law, 5772-2012 and the Medical Equipment Regulations (Registration of Medical Equipment in the Register and Its Renewal), 5773-2013. The route is open to class I devices and low-risk in-vitro diagnostic laboratory products that are registered or approved and marketed in a recognised country. The declaration annex states that the device is made under adequate manufacturing conditions meeting the requirements of ISO 13485, and the submission must include a valid manufacturer quality management system certificate, such as ISO 13485. — gov.il (accessed 17 Oct 2026)
- PIC/S lists the Institute for Standardization and Control of Pharmaceuticals as Israel's participating authority in the Pharmaceutical Inspection Co-operation Scheme, with the entry 'Accession to PIC Scheme January 2009'. PIC/S is a good manufacturing practice inspection scheme; the entry does not cite ISO standards. — picscheme.org (accessed 17 Oct 2026)
- The National Food Services page describes the control of imported food: importers obtain a registration certificate, regular food needs confirmation of the importer declaration and sensitive food needs early import approval, and food is examined at the port and in some cases at storage. The Public Health Protection Regulations (Food) (Declaration of Sensitive Food), 5780-2019 took effect on 10 December 2019. The page covers imports only; it does not describe export procedures and does not cite HACCP, ISO 22000 or FSSC 22000. — gov.il (accessed 17 Oct 2026)
- The Authority's page describes it as overseeing financial services in the insurance, pension and provident fund markets, regulating supervised entities, auditing their business activities and reviewing their relationships with customers. The page does not mention cyber or information technology directives or any ISO standard. — gov.il (accessed 17 Oct 2026)
- The Directorate wrote Israel's national cyber security strategy with ministries, industry and academic experts. The strategy states that the Directorate operates the national computer emergency response team, with a 119 helpline, and the national vulnerability disclosure programme. It identifies a regulatory gap in cyber security for essential organisations and proposes a dedicated law that would define essential organisations, require cyber risk management and reporting of certain attacks, and give sectoral regulators enforcement tools; this is a proposal in the strategy, not an enacted law. It plans cyber requirements in government procurement and mentions supply chain security. It does not mention ISO/IEC 27001. — gov.il (accessed 17 Oct 2026)
- The Authority describes itself as an independent statutory authority that promotes innovation as a driver of economic growth. It formulates innovation policy and carries it out through support tracks and funding tools, including research and development grants, a Startup Division, incubators, manufacturing accelerators and financing for research and development collaborations with foreign companies. The page says it replaced the Office of the Chief Scientist under Amendment No. 7 to the Law to Encourage Research, Development and Technological Innovation in Industry, 1984, and it sets no ISO certification conditions. — innovationisrael.org.il (accessed 17 Oct 2026)
- The Institution's site says it operates pursuant to the Standards Law, adopts international and foreign national standards and writes its own for products and services, using standardisation committees with representatives from across the economy, and lists membership of ISO and IEC. This record uses it only as the national standards body. — sii.org.il (accessed 17 Oct 2026)
- Israel Laboratory Accreditation Authority (ISRAC) — israc.gov.il; ilac.org; iaf.nu (accessed 17 Oct 2026)
- Mandatory Tenders Law, 5752-1992 and Mandatory Tenders Regulations, 5753-1993 — mr.gov.il (accessed 17 Oct 2026)
Talk to a consultant
Plan your certification with the Dubai team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
uae@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice