Where we work · Oman
ISO and GRC certification consulting in Oman
Achieve ISO and GRC certification in Oman with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Dubai office team
- Effivity and Academy included
Sectors that ask for certification in Oman
Clients include
ISO and GRC certification in Oman at a glance
Oman's demand for certification and compliance is shaped by a short list of public bodies and a growing law. The Personal Data Protection Law, issued under Royal Decree 6/2022, is administered by the Ministry of Transport, Communications and Information Technology, whose department decides permit applications for health, biometric, genetic and criminal conviction data; Royal Decree 68/2026 has amended some of its provisions. The same ministry's guidance covers government cybersecurity governance and IT service continuity, the Telecommunications Regulatory Authority sets licence conditions for operators, and the Ministry of Health's Drug Safety Center asks medical device manufacturers for their quality management system certificates. Accreditation runs through the Oman Accreditation Centre under the Ministry of Commerce, Industry and Investment Promotion and the GCC Accreditation Center, while the Public Authority for Special Economic Zones and Free Zones oversees Duqm, Sohar, Salalah and Al Mazunah. Certificates come from accredited certification bodies, never from Sterling. Sterling serves Omani clients from its Dubai office, backed by 20+ years of work and 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Oman
Each page covers who needs the standard in Oman, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Oman (8)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Personal Data Protection Law (PDPL) Ministry of Transport, Communications and Information Technology (MTCIT), through its Personal Data Protection Department | General personal data law for the Sultanate. The ministry's own page states that its Personal Data Protection Department receives complaints, decides permit applications, carries out enforcement and raises awareness. Controllers must obtain the data subject's consent, establish protection policies and keep processing records. Entities processing genetic, biometric, health or criminal conviction data need a ministry permit before processing begins, and controllers must appoint a data protection officer who is the ministry's contact point. The page also lists a project to accredit external auditors in personal data protection, without describing its framework. Read the amendment of 2026 against the earlier text before relying on either. | |
| Ministry of Transport, Communications and Information Technology (MTCIT) Omani government entities and the suppliers that connect to them | Cybersecurity Governance Guideline — supports government entities in implementing cybersecurity governance, with a national framework for managing cybersecurity at organisational level; the page does not mention ISO/IEC 27001. | |
| Telecommunications Regulatory Authority (TRA) Telecommunications licensees | Rules and Conditions of the Class II Licence for Additional Public Telecommunication Services (issued under Royal Decree No. 30/2002) — licensees must submit an Emergency Plan to the Authority and meet quality of service requirements; the document does not cite ISO standards. | |
| Ministry of Health — Drug Safety Center Medical device manufacturers registering with the Ministry of Health | Guideline on Requirements of Medical Device Manufacturer Registration in Sultanate of Oman — manufacturers give details of the quality management system used and its certificates, with ISO 13485 named as the example, plus the certificate document and recent audit reports. | ISO 13485 |
| Environment Authority (established by Royal Decree No. 106/2020) Industrial and mining projects needing an environmental permit | Environmental Permit for Class A Activities — the service page asks for an environmental impact assessment study, with industrial projects needing approval of the Ministry of Commerce, Industry and Investment Promotion and mining projects that of the Ministry of Energy and Minerals; the page does not mention ISO 14001. | |
| Ministry of Transport, Communications and Information Technology (MTCIT) Government IT services and their providers | IT Service Continuity Framework (version 1.0, updated 2018) — a national guide for government entities covering continuity plans, critical service identification, downtime impact, recovery strategies, training and testing; it makes no explicit reference to ISO 22301. | |
| Ministry of Commerce, Industry and Investment Promotion (MOCIIP) — Directorate General for Standards and Metrology Producers, exporters and conformity assessment bodies | National quality infrastructure — national standards, adoption of unified GCC standards, registration of testing and calibration laboratories, licensing of conformity assessment bodies and electronic certificates of conformity, as the ministry reports it; it describes infrastructure rather than any mandatory management-system certificate. | |
| State Audit Institution Public bodies and the suppliers that deal with them | A supervisory body whose stated vision is to protect public funds and promote integrity and accountability; it runs a complaints and reporting window and a financial disclosure programme for officials. Its home page does not cite ISO 37001 or ISO 37301. |
Accreditation and recognition
- Oman Accreditation Centre (OMAC): National accreditation centre operating under the Ministry of Commerce, Industry and Investment Promotion; the ministry reports that it registered conformity assessment bodies in the first half of 2026 and conducted accreditation processes aligned with ISO/IEC 17025; the ministry built it with the Gulf Accreditation Centre, and an Arab Accreditation Cooperation official described its accession to a multilateral recognition arrangement at a ministry symposium.
- GCC Accreditation Center (GAC): Regional accreditation centre; ILAC MRA signatory for testing and calibration (ISO/IEC 17025), inspection (ISO/IEC 17020) and medical testing (ISO 15189), with Oman among its listed economies; its services page lists accreditation to ISO/IEC 17021-1 for management-system certification bodies, ISO/IEC 17065 and ISO/IEC 17024; it opened a branch in Oman on 9 June 2024.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Economic zones
- Sohar Free Zone: renewable-energy manufacturing, industrial manufacturing
- Salalah Free Zone: medical and pharmaceutical industries
- Special Economic Zone at Duqm (SEZAD): food and fisheries, renewable energy, tourism and leisure
- Al Mazunah Free Zone:
- Industrial estates run by Madayn (including Knowledge Oasis Muscat): heavy and medium industrial operations
- Muscat Airport Free Zone and Khazaen Economic City:
Sterling in Oman
Sterling delivers in Oman from its Dubai office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in Oman, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions Omani clients ask
Which ministry administers Oman's Personal Data Protection Law?
The Ministry of Transport, Communications and Information Technology. Its Personal Data Protection Department receives complaints, decides permit applications and carries out enforcement. The law was issued by Royal Decree 6/2022, its executive regulation by Ministerial Decision 34/2024, and Royal Decree 68/2026 has since amended some provisions. Read the current consolidated text with your counsel before relying on any one version.
Do we need a ministry permit to process health or biometric data in Oman?
The ministry's page says entities processing genetic, biometric, health or criminal conviction data need a ministry permit before processing starts. Every controller must still obtain consent, keep processing records and appoint a data protection officer. Whether your processing falls within the permit rule depends on the facts, so confirm it with your counsel or with the ministry.
Who accredits certification and testing bodies in Oman?
Two bodies matter. The Oman Accreditation Centre sits under the Ministry of Commerce, Industry and Investment Promotion and has described accreditation work to ISO/IEC 17025. The GCC Accreditation Center, which opened an Oman branch in June 2024, is an ILAC MRA signatory for testing, calibration, inspection and medical testing. Ask your certification body for its accreditation scope.
Where is Sterling's team based for Omani clients?
From its Dubai office. Sterling serves Omani clients from there, attending on site where the work needs it and working remotely otherwise. Effivity and Sterling Academy are included with the engagement, so the client's team is trained and supported in the same programme. Sterling does not certify; the certificate comes from an accredited certification body.
Which free zones and industrial estates operate in Oman?
The Public Authority for Special Economic Zones and Free Zones, created by Royal Decree 105/2020, oversees the Special Economic Zone at Duqm and the Al Mazunah, Salalah and Sohar free zones, with Muscat Airport Free Zone and Khazaen Economic City alongside. Madayn runs the industrial estates, including Knowledge Oasis Muscat. Sector mixes differ, so ask each zone authority about its own permits.
Cities Sterling covers in Oman
Each city page sets out the industries, zones and standards that matter locally.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Personal Data Protection Law (PDPL) — mtcit.gov.om (accessed 7 Oct 2026)
- Cybersecurity Governance Guideline — mtcit.gov.om (accessed 7 Oct 2026)
- Rules and Conditions of the Class II Licence for Additional Public Telecommunication Services (issued under Royal Decree No. 30/2002) — tra.gov.om (accessed 7 Oct 2026)
- Guideline on Requirements of Medical Device Manufacturer Registration in Sultanate of Oman — moh.gov.om (accessed 7 Oct 2026)
- Environmental Permit for Class A Activities — ea.gov.om (accessed 7 Oct 2026)
- IT Service Continuity Framework (version 1.0, updated 2018) — mtcit.gov.om (accessed 7 Oct 2026)
- National quality infrastructure — tejarah.gov.om (accessed 7 Oct 2026)
- A supervisory body whose stated vision is to protect public funds and promote integrity and accountability; it runs a complaints and reporting window and a financial disclosure programme for officials. Its home page does not cite ISO 37001 or ISO 37301 — sai.gov.om (accessed 7 Oct 2026)
- Oman Accreditation Centre (OMAC) — tejarah.gov.om; ilac.org (accessed 7 Oct 2026)
- GCC Accreditation Center (GAC) — gac.org.sa; ilac.org (accessed 7 Oct 2026)
- Sohar Free Zone — opaz.gov.om (accessed 7 Oct 2026)
- Salalah Free Zone — opaz.gov.om (accessed 7 Oct 2026)
- Special Economic Zone at Duqm (SEZAD) — opaz.gov.om (accessed 7 Oct 2026)
- Al Mazunah Free Zone — opaz.gov.om (accessed 7 Oct 2026)
- Industrial estates run by Madayn (including Knowledge Oasis Muscat) — opaz.gov.om (accessed 7 Oct 2026)
- Muscat Airport Free Zone and Khazaen Economic City — opaz.gov.om (accessed 7 Oct 2026)
Talk to a consultant
Plan your certification with the Dubai team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
uae@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice