ISO and GRC consulting in Middle East and Africa, ISO consultants for the Middle East and Africa, based in Dubai and Johannesburg

No general law requires it. The UAE Ministry of Finance's Federal Supplier Register asks for a trade licence, a VAT or tax registration certificate and the owner's passport copy, not an ISO certificate. Demand comes instead from customers, main contractors, tenders and parent groups, and from sector frameworks such as DESC's cloud standard, which is certified under the ISO/IEC 27001 scheme. We confirm what your customers and regulators actually ask for during the discovery call.

Any certificate your customers recognise, issued by a certification body accredited for your scope. In the Gulf that usually means EIAC, GAC or SAAC; bodies accredited elsewhere may also be accepted. EIAC and GAC both accredit management system certification bodies to ISO/IEC 17021-1 and publish directories. Because Global ACI replaced the IAF and ILAC arrangements on 1 January 2026, check the accreditation body's current status and ask your key customers before you appoint a certification body.

No. Sterling is the consultant: we build the controls, the governance and the evidence. An accredited certification body audits ISO standards and decides on certification. NCA ECC compliance is evaluated by the National Cybersecurity Authority through self-assessment, compliance reports or field visits, and SAMA CSF is maturity-rated for regulated entities rather than certified. Keeping the consultant separate from the certification body and the regulator protects the credibility of the result.

It can carry much of the work, but it does not replace them. No official mapping from these frameworks to ISO/IEC 27001 has been published, so we map each control set onto your information security management system and close the gaps each one leaves. One risk assessment, one set of policies and one evidence trail then serve the certification audit and the regulator's assessment together.

Not always. Article 2 of Federal Decree by Law No. 45 of 2021 excludes free-zone companies that have their own data protection legislation, such as entities in the DIFC, which has its own Data Protection Law. A group with mainland and free-zone entities may therefore work to two privacy regimes. We map which law applies to each entity and build one privacy programme that meets both, with the Arabic text of the federal law as the reference.

Yes. Johannesburg is our regional headquarters for Africa, and programmes there follow the same method as in the Gulf. For South African organisations, POPIA sits alongside ISO/IEC 27001: the Act sets eight conditions for lawful processing and is enforced by the Information Regulator, with no certificate of its own. Work in other African countries is scoped country by country, with site visits planned from the nearest office.

Yes, where the certification body agrees to a multi-site scope. One engagement team runs the programme, every site works in one Effivity workspace, and each country's regulatory layer is added where it applies: NCA ECC and the Saudi PDPL for Saudi entities, the UAE IA Standard, DESC ISR and the UAE PDPL in the Emirates. The gap analysis sets out which sites need on-site work and which can be supported remotely.