Where we work · North America
ISO and GRC consulting in North America, with ISO consultants based in New York
Sterling supports organisations across the United States and Canada with ISO certification, SOC 2 readiness, HIPAA and CMMC programmes, led from our global headquarters in New York. Expert and experienced consultants take you from gap analysis to a successful audit; an accredited certification body, the service auditor or the relevant assessor makes the decision.
- Global headquarters in New York, with a second United States office and an office in Canada
- Certification standards and US frameworks in one programme: ISO 9001, ISO/IEC 27001, SOC 2, HIPAA and CMMC 2.0
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify; an accredited body audits and decides
- Pass the audit first timeA system your people run, with evidence ready before the certification body arrives.
- Answer customer questionnairesSecurity, quality and privacy questions answered from one set of evidence.
- Meet US and Canadian rulesHIPAA, CMMC, FDA and Health Canada expectations mapped to the controls you already have.
- One programme, every siteUS, Canadian and overseas sites under one engagement team and one workspace.
Countries
Each country page sets out the regulators, the accreditation route and every standard Sterling delivers there.
Offices
Sterling in North America: three offices, one engagement team.
Our global headquarters is in New York, and the group has a second office in the United States and an office in Canada. Your engagement team works from the region and brings in consultants from other Sterling offices when your sites or suppliers sit outside North America.
- New York, United States · global headquarters616 Corporate Way, Suite 2 #5231, Valley Cottage, New York 10989 · +1 201 263 4443 · usa@sterling-grc.com
- Sheridan, Wyoming, United StatesSterling office · 1309 Coffee Avenue STE, Sheridan, Wyoming · usa@sterling-grc.com
- Toronto, CanadaSterling office · First Canadian Place, 100 King Street West, Toronto · canada@sterling-grc.com
Every other Sterling location is on the All offices page. Enquiries from anywhere in the region reach the New York office first, and a consultant replies within one working day.
Standards in demand
What North American customers, agencies and auditors ask for.
In the United States and Canada the request usually arrives in a customer questionnaire, a supplier agreement or a contract clause rather than a law. Technology and service companies are asked for ISO/IEC 27001 or a SOC 2 report; manufacturers for ISO 9001, now in its 2026 edition; health data handlers for HIPAA safeguards; defence suppliers for CMMC and NIST SP 800-171; device makers for ISO 13485.
Bodies and regulators
Who accredits, who certifies and who regulates in North America.
Certification in North America runs through accredited certification bodies, but many of the requirements buyers face come from regulators and federal programmes that do not issue certificates at all. The table separates the two, so you know who assesses you and who can inspect you.
| Country | Accreditation body and recognition | Regulators and schemes that ask for certification |
|---|---|---|
| United States: management systems | ANAB, the ANSI National Accreditation Board, a wholly owned subsidiary of the American National Standards Institute, accredits certification bodies, including those that certify ISO 37001 anti-bribery management systems. Check any body's current recognition on the Global ACI register | Customers, tenders and group companies drive most requests for ISO 9001, ISO/IEC 27001, ISO 14001 and ISO 45001. FDA's Quality Management System Regulation, effective 2 February 2026, incorporates ISO 13485:2016 by reference; compliance with ISO 13485 alone does not fully satisfy it |
| United States: laboratories and inspection | ANAB and A2LA, the American Association for Laboratory Accreditation, accredit ISO/IEC 17025 laboratories. A2LA also accredits inspection bodies to ISO/IEC 17020, including the third-party assessment organisations FedRAMP recognises | FedRAMP requires a FedRAMP-recognised independent assessor for Class B, C and D certification of cloud services used by federal agencies, and its assessors must be accredited by A2LA |
| United States: health, financial and service data | No accreditation route. HHS does not require entities to certify HIPAA compliance; SOC 2 examinations are performed by licensed CPA firms under AICPA professional standards | HHS Office for Civil Rights enforces the HIPAA Privacy, Security, Breach Notification and Enforcement Rules. The FTC Safeguards Rule (16 CFR Part 314) applies to financial institutions under FTC jurisdiction. FDA inspects food facilities under FSMA |
| United States: defence supply chain | The Cyber AB is the accreditation body for the CMMC ecosystem; Level 2 certification assessments are performed by an authorised or accredited C3PAO | The Department of War (DoD in the regulations) began CMMC Phase 1 on 10 November 2025 with Level 1 and Level 2 self-assessments. Phase 2 was suspended on 13 July 2026, and NIST SP 800-171 Rev 2 is enforced through self-assessments and select government-led assessments |
| Canada | The Standards Council of Canada (SCC) accredits certification bodies and proficiency testing providers, and reported its first ISO/IEC 42001 accreditation in 2025. Check current recognition on the Global ACI register | Health Canada requires manufacturers of class II, III and IV medical devices sold in Canada to hold MDSAP certification, an audit programme based on ISO 13485. The Office of the Privacy Commissioner oversees compliance with PIPEDA, including breach reporting |
Global ACI replaced the IAF MLA and ILAC MRA on 1 January 2026; confirm any certification body's accreditation and scope on its accreditation body's register before you sign. Sterling does not certify, accredit or assess for any of the bodies or programmes above.
How we deliver
One method, delivered where you are.
The same method we use in 60+ countries, set up for the way North American organisations procure: a clear scope, a fixed plan and evidence that answers customers as well as auditors.
- One engagement team accountable across every country you operate in, with local consultants where the work is
- Remote and on site: workshops, document reviews and coaching remotely; site work where observation or in-person work is necessary, with short travel from the regional offices
- One Effivity workspace for every site, included with the engagement at no additional cost
- One certification body for multi-site programmes where the body agrees, with local requirements handled where they arise
- Design™ or Drive™: your team implements with Sterling's structure and coaching, or Sterling consultants take on the agreed consulting and documentation work
A typical North American programme starts with a gap analysis against the standard or framework your customer named, then a plan that maps each requirement to an owner and a date. Where one control set can answer several demands, we build it once: an ISO/IEC 27001 system that also feeds a SOC 2 examination and HIPAA safeguards, or an ISO 9001 system extended to ISO 13485 for device work. Your engagement team stays with you through internal audit, management review and the certification body's readiness review, and supports you through the certification audit and any findings raised.
Effivity · included with the engagement
Your system runs in software from the first workshop.
Effivity is the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures it within the agreed scope, so evidence accumulates as people do their work and the certification auditor reviews a live system rather than a binder. Sterling consulting clients get their subscription included with the engagement, at no additional cost.
ISO & GRC softwareSterling Academy · included with the engagement
Your people learn the standard, not just the forms.
E-learning with practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online, with progress by department for the certification audit. Sterling consulting clients get preferential course access and special pricing, including complimentary awareness training for their people as part of the engagement.
Contact us about Academy accessStandards
Most requested in North America
- SOC 2SOC 2 Readiness and compliance consulting: controls mapped to the Trust Services Criteria and evidence prepared for the CPA firm's SOC 2 attestation report.
- ISO/IEC 27001ISO/IEC 27001 certification consulting: an ISMS built with your people, evidence prepared, and support through Stage 1, Stage 2 and surveillance audits.
- HIPAAHIPAA compliance consulting for US covered entities and business associates: a documented programme protecting PHI.
- PCI DSSPCI DSS compliance consulting for merchants and service providers: scope, the twelve requirements and evidence prepared for your annual validation by a QSA.
- ISO 9001ISO 9001 certification consulting: a quality management system built with your people, evidence prepared and support until an accredited body certifies you.
- SOC 1 (ISAE 3402 / SSAE 18)SOC 1 compliance consulting for service organisations: controls over client financial reporting readied for the service auditor's SOC 1 attestation report.
- CCPA / CPRACCPA compliance and requirements under the CPRA: notices, consumer rights, opt-outs, risk assessments, cybersecurity audits and ADMT, in an all-inclusive programme.
- ISO/IEC 42001ISO/IEC 42001 certification consulting for AI governance: risks and impacts assessed, treated and evidenced, then supported through the certification audit.
Where we work
Your business
crosses borders.
Your programme can too.
A Sterling lead in your working hours, wherever you operate. Multi-site programmes run with one engagement team, one Effivity workspace and one certification body, with local requirements and customer expectations handled where they arise.
Global headquarters in New York; regional headquarters in Dubai, Navi Mumbai, Manila, London, Enschede and Johannesburg; offices in 21 countries.
All offices and contact detailsClient experience in North America
Client letters on file, available on request.
Signed client letters are available on request, and we can arrange references in your sector before you decide. The client feedback wall lists every letter by standard.
- 60+countries where Sterling has delivered certification
- 21countries with a Sterling office, eight regions, one coordinated team
- 2003the year the group began implementing ISO management systems; the same method, refined, since
- 8,100+client engagements across the group, from single-site SMEs to multinationals
FAQs
Questions clients in North America ask before they engage us.
The specific answers for your organisation come from the discovery call. These are the general ones.
Do you have ISO consultants in North America?
Yes. Sterling's global headquarters is at 616 Corporate Way, Valley Cottage, New York, on +1 201 263 4443 and usa@sterling-grc.com, and the group has a second United States office and an office in Canada. Your engagement team works in your time zone, delivers workshops and reviews remotely, and visits your sites where observation or in-person work is needed.
Does Sterling issue the certificate?
No. Sterling does not certify. An independent certification body, accredited in the United States by a body such as ANAB and in Canada by the Standards Council of Canada, audits your system and decides. We prepare you for that audit and help you choose a body whose accreditation and scope suit your customers, and you can check both on the accreditation body's register.
Can you prepare us for a SOC 2 report?
Yes. SOC 2 is an examination, not a certificate: the service auditor, a CPA firm, examines your controls under AICPA professional standards and issues the report. Sterling prepares you for it, defining the scope and trust services criteria, drafting the system description, closing control gaps and organising evidence, so the examiner finds a system that already runs. We do not perform the examination.
Is there a HIPAA certification?
No. HHS does not require covered entities or business associates to certify compliance, and the HHS Office for Civil Rights enforces the rules. What customers and auditors look for is a current Security Rule risk analysis, safeguards that match it, signed business associate agreements, trained staff and breach procedures. Sterling helps you build and evidence each of these, often alongside ISO/IEC 27001 or SOC 2.
What does CMMC require from defence suppliers right now?
Phase 1 began on 10 November 2025: applicable solicitations can require a Level 1 or Level 2 self-assessment as a condition of award. The Department of War suspended Phase 2 on 13 July 2026 and continues to enforce NIST SP 800-171 Rev 2 through self-assessments and select government-led assessments. Sterling helps you implement the controls and prepare evidence now, so a C3PAO assessment is manageable when it is required.
We make medical devices for the US and Canada. What do we need?
In the United States, FDA's Quality Management System Regulation took effect on 2 February 2026 and incorporates ISO 13485:2016 by reference, although compliance with ISO 13485 alone does not fully satisfy it. In Canada, Health Canada requires manufacturers of class II, III and IV devices to hold MDSAP certification. Sterling builds one ISO 13485 system designed to meet both expectations.
Can one programme cover our US, Canadian and overseas sites?
Yes. Multi-site programmes run with one engagement team, one Effivity workspace and one certification body where the body agrees, with local requirements handled where they arise. With offices in 21 countries, we bring in local consultants for sites in Europe, the Middle East, South Asia, Asia Pacific or Africa while your North American lead stays accountable for the whole programme.
Talk to a consultant
Plan your certification in North America with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice