Sterling office · Saudi Arabia
Sterling International Consulting Riyadh, ISO consultants for Saudi Arabia
Our Riyadh office, in Kingdom Centre on King Fahd Road, is where expert and experienced ISO consultants plan and lead engagements for organisations across Saudi Arabia: quality, information security, environment, health and safety, and the Kingdom's own cybersecurity and data protection requirements, built with your teams and carried through to the certification audit. We ensure successful certification for our clients.
- One all-inclusive proposal for a defined scope: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in a single proposal
- A team for Riyadh and the wider Kingdom, part of a group with offices in 21 countries, implementing management systems since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify; an accredited body audits and decides
What we do here
Everything a Sterling engagement includes, delivered from Riyadh.
The same engagement we deliver in 60+ countries, led from Riyadh for organisations in the capital and across the Kingdom. One consultant leads your project from gap analysis to the certificate, and your people do the work alongside us, so the system is theirs to run after we leave.
Scope, gap analysis and implementation plan
With responsibilities, dates and decision owners, agreed before work starts.
Process development and documentation
Tailored to your operations, on Sterling's own template sets, built with your process owners.
Effivity ISO & GRC software
Your system runs in Effivity from day one, included with the engagement at no additional cost.
Training for everyone
Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Internal audit and management review
Conducted or facilitated as agreed, with findings closed with evidence before the certification body arrives.
Certification readiness and support
Preparation for Stage 1 and Stage 2, and support until the certificate is issued.
Certification decisions remain with the independent certification body.
Standards in demand
The standards organisations in Saudi Arabia ask us for most.
Most ISO requests start with a customer, a main contractor, a tender or a parent group asking for a certificate. Alongside the ISO management system standards, the Riyadh team works on the National Cybersecurity Authority's controls for government agencies and critical national infrastructure, the Saudi Central Bank's framework for the financial sector, and the Personal Data Protection Law. These last three are regulatory requirements with no certificate. If you are unsure which applies to you, the discovery call settles it.
- ISO 9001Quality management
- ISO/IEC 27001Information security
- ISO 14001Environmental management
- ISO 45001Health and safety
- NCA ECCNational cybersecurity controls
- NCA CCC (Saudi Arabia)Cloud cybersecurity
- SAMA CSFFinancial sector
- Saudi PDPLSaudi data protection
- All standards & frameworksThe full catalogue, with sector schemes
Reaching the office
Visiting Riyadh.
The office is in Kingdom Centre on King Fahd Road, in the Olaya district of Riyadh. Most of our work happens at your premises and online, so meetings at the office are by appointment: write to saudiarabia@sterling-grc.com and we will confirm a time.
- District: Olaya, Riyadh
- Street: King Fahd Road
- Building: Kingdom Centre
Please arrange your visit in advance so the consultant leading your engagement is in the office when you arrive.
The region
Riyadh and the other Sterling offices in the Middle East and Africa.
Dubai is our regional headquarters for the Middle East and Johannesburg our regional headquarters for Africa, with a second office in Dubai. A group with entities in Saudi Arabia, the UAE and beyond works with one engagement team, one plan and one Effivity system.
- Dubai (Bur Dubai), United Arab EmiratesRegional headquarters for the Middle East · uae@sterling-grc.com
- Dubai (Boulevard Plaza), United Arab EmiratesSecond UAE office, Boulevard Plaza Tower One · uae@sterling-grc.com
- Johannesburg (Sandown), South AfricaRegional headquarters for Africa · southafrica@sterling-grc.com
All Sterling offices · ISO and GRC consulting in the Middle East and Africa
Standards
Most requested in Riyadh
- ISO 9001ISO 9001 certification consulting: a quality management system built with your people, evidence prepared and support until an accredited body certifies you.
- ISO/IEC 27001ISO/IEC 27001 certification consulting: an ISMS built with your people, evidence prepared, and support through Stage 1, Stage 2 and surveillance audits.
- NCA ECC (Saudi Arabia)NCA ECC compliance consulting for Saudi national entities and CNI operators: Essential Cybersecurity Controls implemented and evidenced for NCA evaluation.
- SAMA CSF (Saudi Arabia)SAMA Cyber Security Framework compliance consulting for Saudi financial institutions: governance, controls and maturity evidence prepared for SAMA review.
- PDPL (Saudi Arabia)Saudi PDPL compliance consulting: lawful, transparent and secure processing, rights people can exercise and records ready for SDAIA, built with your teams.
- ISO 45001ISO 45001 certification consulting to prevent work-related injury and ill health, with an OH&S system built with your people and audit-ready, in 60+ countries.
- ISO 22301ISO 22301 certification consulting to keep delivering through disruption: impact analysis, continuity plans and exercises, prepared for an accredited audit.
- ISO 37001ISO 37001 certification consulting: proportionate anti-bribery controls to prevent, detect and respond, built with your teams and ready for an accredited audit.
Client experience in Saudi Arabia
Client letters on file, available on request.
Signed client letters for engagements in Saudi Arabia are available on request. The client feedback wall lists every letter by standard. Ask for references in your sector before you decide.
- 60+countries where Sterling has delivered certification
- 21countries with a Sterling office, eight regions, one coordinated team
- 2003the year the group began implementing ISO management systems; the same method, refined, since
- 8,100+client engagements across the group, from single-site SMEs to multinationals
FAQs
Questions clients in Saudi Arabia ask before they engage us.
The specific answers for your organisation come from the discovery call. These are the general ones.
Where is Sterling in Riyadh, and who do I contact?
Our Riyadh office is in Kingdom Centre, King Fahd Road, Olaya, Riyadh. Write to saudiarabia@sterling-grc.com and a Sterling consultant replies within one working day; there is no local telephone number listed, so for a call use global headquarters on +1 201 263 4443. The first step is a free discovery call of about thirty minutes, where we agree your scope, standards and target date before any proposal.
Does Sterling issue the ISO certificate?
No. Sterling does not certify. We build the management system with your team, prepare the evidence and support you through the audit, and an independent, accredited certification body audits and decides. The Saudi national accreditation body, SAAC, publishes a directory of the bodies it accredits, including certification bodies, so you can check a body before you appoint it and confirm its accreditation covers your scope.
Can we get certified to NCA ECC or the SAMA CSF?
No. Neither has a certificate. The NCA ECC sets minimum cybersecurity controls for government agencies, their affiliated companies and private entities that own, operate or host critical national infrastructure, and the National Cybersecurity Authority evaluates compliance through self-assessment, compliance-tool reports and field visits. The SAMA CSF applies to the banking, insurance and financing companies sectors and is maturity-rated. We build the controls and evidence; many clients run them alongside ISO/IEC 27001.
Does the Saudi PDPL apply to our organisation?
If you process personal data in the Kingdom, very likely yes. The Personal Data Protection Law has been in force since 14 September 2023 and also reaches processing outside the Kingdom of personal data relating to residents. SDAIA supervises it, and a breach must be reported to SDAIA within 72 hours of becoming aware. There is no certificate; we build the privacy notices, records, rights handling and breach process with your team.
Can the Riyadh team support our sites in the UAE and elsewhere?
Yes. Riyadh works with our Dubai regional headquarters and the rest of the group, which has offices in 21 countries. Multi-site and multi-country groups work with one engagement team, one plan and one Effivity system, while the certification body confirms how sites in each country are sampled and audited, and each country's regulators are confirmed during scoping.
Keep exploring
More places we work
Offices and regions
Talk to a consultant
Plan your certification with the Riyadh team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
saudiarabia@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice