Where we work · Malaysia
ISO and GRC certification consulting in Malaysia
Achieve ISO and GRC certification in Malaysia with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 22 standards, one team
- Accredited certification route
- Kuala Lumpur office team
- Effivity and Academy included
Sectors that ask for certification in Malaysia
Clients include
ISO and GRC certification in Malaysia at a glance
Certification demand in Malaysia is driven by specific rules and buyers. Bank Negara Malaysia's Risk Management in Technology policy document shapes information security and continuity work across banks, insurers and payment operators, and the technology firms that serve them. The Cyber Security Act 2024 places designated critical infrastructure entities under the National Cyber Security Agency, and the amended Personal Data Protection Act 2010 puts duties on data users and processors under the Personal Data Protection Commissioner. The Energy Efficiency and Conservation Act 2024 requires covered energy consumers to run an energy management system, while CIDB conditions for government works now point contractors towards quality and anti-bribery certification. Food, beverage and halal producers deal with the Ministry of Health's Food Safety and Quality Programme and JAKIM, and electrical and electronics manufacturers, data centres, oil and gas firms and healthcare suppliers answer to multinational customers. Certificates come from certification bodies accredited by the Department of Standards Malaysia, the national accreditation body; Sterling does not certify. Sterling brings 20+ years and 8,100+ client engagements in 60+ countries, and Sterling's Kuala Lumpur office delivers with Effivity and Sterling Academy included in the engagement.
ISO and GRC standards Sterling delivers in Malaysia
Each page covers who needs the standard in Malaysia, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Malaysia (10)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Personal Data Protection Act 2010 (PDPA), as amended by the Personal Data Protection (Amendment) Act 2024 Personal Data Protection Commissioner (Personal Data Protection Department) | Applies to any person who processes, or has control over or authorises the processing of, personal data in respect of commercial transactions; does not apply to the Federal Government and State Governments. Act A1727 requires data processors to comply with the Security Principle, introduces appointment of data protection officers and personal data breach notification, and adds data portability. The Commissioner has issued guidelines on data breach notification, appointment of a data protection officer and cross-border transfer of personal data, plus DPIA, data protection by design and automated decision-making guidelines. Certain classes of data user must register with the Commissioner. | |
| Personal Data Protection Standard 2015 Personal Data Protection Commissioner | Listed on the Commissioner's portal as the standard setting minimum requirements under the Act's principles; content not reviewed for this record. | |
| Bank Negara Malaysia (BNM) Financial institutions — licensed banks, investment banks and Islamic banks, insurers and takaful operators, prescribed development financial institutions, approved issuers of electronic money, operators of designated payment systems, registered merchant acquirers and intermediary remittance institutions | Policy Document on Risk Management in Technology (RMiT), BNM/RH/PD 028-98 — governance, technology risk, technology operations (including data centre resilience and cloud), cybersecurity, digital services and technology audit requirements. The document refers to 'recognised international standards' (e.g. for cryptographic protocols) but does not name ISO/IEC 27001, ISO 22301 or PCI DSS. | |
| Bank Negara Malaysia (BNM) Financial institutions supervised by BNM | Policy Document on Business Continuity Management (issued 19 December 2022), listed in RMiT as a related policy document; the BCM document itself was not reviewed for this record and is not recorded as citing ISO 22301. | |
| National Cyber Security Agency (NACSA), with appointed NCII sector leads National Critical Information Infrastructure (NCII) entities in 11 sectors: government; banking and finance; transportation; defence and national security; information, communication and digital; healthcare services; water, sewerage and waste management; energy; agriculture and plantation; trade, industry and economy; science, technology and innovation | Cyber Security Act 2024 (Act 854), in operation from 26 August 2024 — functions and duties of NCII sector leads and NCII entities and management of cyber security threats and incidents; NACSA's pages do not cite ISO/IEC 27001. | |
| Energy Commission (Suruhanjaya Tenaga) Energy consumers and buildings within the Act's thresholds (Peninsular Malaysia and the Federal Territory of Labuan) | Energy Efficiency and Conservation Act 2024 (Act 861) and Energy Efficiency and Conservation Regulations 2024, in effect from 1 January 2025 — an energy consumer to whom the Act applies shall develop and implement an energy management system in accordance with the guidelines, appoint a registered energy manager and submit energy efficiency and conservation reports; the Commission has issued Guidelines on Energy Management System. The Act does not name ISO 50001. | |
| Department of Occupational Safety and Health (DOSH / Jabatan Keselamatan dan Kesihatan Pekerjaan) All workplaces | Occupational Safety and Health Act 1994 [Act 514] and regulations under it; DOSH also lists the Factories and Machinery (Repeal) Act 2022 [Act 835]. ISO 45001 is not cited. | |
| Ministry of Health Malaysia — Food Safety and Quality Programme (PKKM) Food manufacturers, caterers and food exporters | HACCP Certification Scheme (launched 19 April 2001) — HACCP system based on Malaysian Standard MS 1480 and prerequisite programmes/GMP on MS 1514, audited by auditors appointed by PKKM; MeSTI certification scheme for small and medium food manufacturers to meet the minimum food safety assurance programme required under PPKM 2009; the ministry also publishes lists of GMP, HACCP and FSMS certification bodies and auditors under Standards Malaysia (JSM). | HACCP |
| Jabatan Kemajuan Islam Malaysia (JAKIM), Bahagian Pengurusan Halal; for the local market, the relevant state Islamic religious department or council (JAIN/MAIN) Food and beverage, consumer goods, cosmetics and personal care, pharmaceuticals, medical devices, OEM contract manufacturing, logistics, food premises and abattoirs seeking the Malaysian halal logo | Malaysian halal certification through the MYeHALAL system under the Manual Prosedur Pensijilan Halal Malaysia (Domestik) 2020; the portal states MS 1500 (Halal Food) is used by JAKIM as the basis for certification. 'Recognised authority refers to JAKIM, JAIN or MAIN, whichever applies.' JAKIM also lists recognised foreign halal certification bodies. | Halal certification |
| Ministry of Science, Technology and Innovation (MOSTI) Developers and users of artificial intelligence | The National Guidelines on AI Governance & Ethics (publication date September 2024, MOSTI-related policy) — guidance, not a certification scheme; ISO/IEC 42001 not recorded as cited. |
Accreditation and recognition
- Department of Standards Malaysia (Standards Malaysia / Jabatan Standard Malaysia, JSM): National accreditation body; voluntary schemes: Laboratory Accreditation Scheme of Malaysia (SAMM, testing and calibration incl. medical testing), Accreditation of Certification Bodies (ACB), Malaysia Inspection Bodies Accreditation Scheme (MIBAS), Malaysia Proficiency Testing Providers Accreditation Scheme (MyPTP), GLP Compliance Programme, Accreditation of Validation & Verification Bodies (AVVB) and Primary Healthcare Laboratory Accreditation Scheme (PHLAS).
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Cities
Tenders and procurement
- Government Works Procurement Certificate (Sijil Perolehan Kerja Kerajaan, SPKK, incl. SPKKA for foreign-equity contractors) (Construction Industry Development Board Malaysia (CIDB), managing SPKK registration on behalf of the Ministry of Finance): CIDB circular signed 1 January 2026 (published as Pekeliling CIDB Bil 1.2026; the scanned header reads 'PEKELILING CIDB - BIL 1/2025') updating SPKK conditions: G2–G7 contractors re-registering need a valid SCORE certificate (minimum G2–G4: 2 stars; G5–G7: 3 stars); 'Contractor Quality Management System (CQMS) diterima sebagai pensijilan alternatif kepada pensijilan kepada ISO 9001'; and 'Perlaksanaan Pensijilan Anti-Bribery Management System (ABMS) kepada semua kontraktor gred G7 bagi permohonan baharu dan pendaftaran semula Sijil Perolehan Kerja Kerajaan akan bermula Januari 2027' (CIDB headline: mandatory MS ISO 37001:2016 certification for G7 contractors).
- Pilot: Ministry of Health certification as a prerequisite for government procurement of cooked food supply and/or food preparation services (Ministry of Health Malaysia — Food Safety and Quality Programme (PKKM), for responsibility centres (PTJ) in the Federal Territories, Selangor, Negeri Sembilan, Melaka and participating ministries): PKKM certification as a pre-condition ('pra-syarat') for food supply/catering contracts in government procurement under the pilot; the specific certificates accepted were not read for this record.
Economic zones
- Iskandar Malaysia (Johor), incl. the Johor-Singapore Special Economic Zone (JS-SEZ): electrical and electronics, petrochemical and geochemical, food and agro-processing, logistics, tourism, creative industries, healthcare services, education services, financial and business services
- Labuan International Business and Financial Centre (Labuan IBFC): international financial services, Islamic banking and finance, insurance and (re)takaful, carbon credit trading
- Kulim Hi-Tech Park (Kedah): high-value manufacturing by local and multinational companies (six dedicated zones)
Sterling in Malaysia
Sterling delivers in Malaysia from its Kuala Lumpur office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in Malaysia, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions Malaysian clients ask
Are certification audits in Malaysia conducted in English or Malay?
Agree the language at the start rather than assume it. Malaysia's official language is Malay, while English runs through most business, so the certification body should confirm at application which language the audit and your controlled documents will use. Where a Malaysian authority's scheme, such as halal or a Ministry of Health food safety programme, publishes its procedures in Malay, keep records an auditor can read in that language.
Does the PDPA apply to government agencies and to data processors?
Not for the Federal Government and State Governments, which the Personal Data Protection Act 2010 does not cover. Data processors are different: Act A1727 requires them to comply with the Security Principle. Whether a particular agency or provider sits inside or outside the Act is a legal question, so confirm it with your counsel or the Commissioner.
Which accreditation should the certification body hold in Malaysia?
Look for accreditation by the Department of Standards Malaysia, the national accreditation body, through its Accreditation of Certification Bodies scheme. Its page lists IAF MLA signatory status for quality, environmental, product, information security, food safety, medical device and occupational health and safety systems, recognised within the international mutual recognition arrangements (Global ACI — Global Accreditation Cooperation Incorporated, formerly the IAF MLA).
Do government construction contracts require ISO certificates?
Not always ISO 9001 itself. A CIDB circular signed on 1 January 2026 updates the Government Works Procurement Certificate conditions: its Contractor Quality Management System is accepted as an alternative to ISO 9001 certification, and anti-bribery certification under MS ISO 37001:2016 becomes mandatory for G7 contractors from January 2027. Check the conditions for your grade with CIDB.
Who issues halal certificates in Malaysia?
It depends on the market. JAKIM, JAIN or MAIN is the recognised authority, whichever applies, and for the local market that means the relevant state Islamic religious department or council. Applications are made through the MYeHALAL system. JAKIM also lists recognised foreign halal certification bodies, which matters if you import halal products.
Can audits be scheduled around Hari Raya and Chinese New Year?
Usually yes, with planning. Hari Raya Aidilfitri, Hari Raya Haji, Chinese New Year, Deepavali and state public holidays can affect audit scheduling, and some states keep a different weekend. Holiday dates move every year, so ask your certification body for its current calendar rather than working from remembered dates, and confirm it before fixing your audit plan.
Cities Sterling covers in Malaysia
Each city page sets out the industries, zones and standards that matter locally.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Personal Data Protection Act 2010 (PDPA), as amended by the Personal Data Protection (Amendment) Act 2024 — pdp.gov.my (accessed 5 Oct 2026)
- Personal Data Protection Standard 2015 — pdp.gov.my (accessed 5 Oct 2026)
- Policy Document on Risk Management in Technology (RMiT), BNM/RH/PD 028-98 — bnm.gov.my (accessed 5 Oct 2026)
- Policy Document on Business Continuity Management (issued 19 December 2022), listed in RMiT as a related policy document; the BCM document itself was not reviewed for this record and is not recorded as citing ISO 22301 — bnm.gov.my (accessed 5 Oct 2026)
- Cyber Security Act 2024 (Act 854), in operation from 26 August 2024 — nacsa.gov.my (accessed 5 Oct 2026)
- Energy Efficiency and Conservation Act 2024 (Act 861) and Energy Efficiency and Conservation Regulations 2024, in effect from 1 January 2025 — st.gov.my (accessed 5 Oct 2026)
- Occupational Safety and Health Act 1994 [Act 514] and regulations under it; DOSH also lists the Factories and Machinery (Repeal) Act 2022 [Act 835]. ISO 45001 is not cited. — dosh.gov.my (accessed 5 Oct 2026)
- HACCP Certification Scheme (launched 19 April 2001) — hq.moh.gov.my (accessed 5 Oct 2026)
- Malaysian halal certification through the MYeHALAL system under the Manual Prosedur Pensijilan Halal Malaysia (Domestik) 2020; the portal states MS 1500 (Halal Food) is used by JAKIM as the basis for certification. 'Recognised authority refers to JAKIM, JAIN or MAIN, whichever applies.' JAKIM also lists recognised foreign halal certification bodies. — halal.gov.my (accessed 5 Oct 2026)
- The National Guidelines on AI Governance & Ethics (publication date September 2024, MOSTI-related policy) — mastic.mosti.gov.my (accessed 5 Oct 2026)
- Department of Standards Malaysia (Standards Malaysia / Jabatan Standard Malaysia, JSM) — jsm.gov.my; iaf.nu (accessed 5 Oct 2026)
- Government Works Procurement Certificate (Sijil Perolehan Kerja Kerajaan, SPKK, incl. SPKKA for foreign-equity contractors) — cidb.gov.my (accessed 5 Oct 2026)
- Pilot: Ministry of Health certification as a prerequisite for government procurement of cooked food supply and/or food preparation services — hq.moh.gov.my (accessed 5 Oct 2026)
- Iskandar Malaysia (Johor), incl. the Johor-Singapore Special Economic Zone (JS-SEZ) — irda.com.my (accessed 5 Oct 2026)
- Labuan International Business and Financial Centre (Labuan IBFC) — labuanfsa.gov.my (accessed 5 Oct 2026)
- Kulim Hi-Tech Park (Kedah) — kulimhitechpark.com (accessed 5 Oct 2026)
Talk to a consultant
Plan your certification with the Kuala Lumpur team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
malaysia@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice