Where we work · Saudi Arabia
ISO and GRC certification consulting in Saudi Arabia
Achieve ISO and GRC certification in Saudi Arabia with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 23 standards, one team
- Accredited certification route
- Riyadh office team
- Effivity and Academy included
Sectors that ask for certification in Saudi Arabia
Clients include
ISO and GRC certification in Saudi Arabia at a glance
Demand for certification and compliance in Saudi Arabia is shaped as much by regulators as by buyers. The National Cybersecurity Authority (NCA) sets the Essential Cybersecurity Controls (ECC-2:2024) for government agencies, their affiliates and private entities that own, operate or host Critical National Infrastructures, with the Data Cybersecurity Controls (DCC-1:2022) as a companion. The Saudi Central Bank (SAMA) applies its Cyber Security Framework, which requires PCI-DSS compliance for cardholder data, and a Business Continuity Management Framework that draws on ISO 22301 and ISO 27001. The Saudi Food and Drug Authority (SFDA) links medical device authorisation and establishment licensing to ISO 13485. Government purchasing runs through the Etimad platform, where each tender sets its own criteria. Demand therefore comes from government entities and their suppliers, banking, insurance and fintech, infrastructure operators, healthcare and medical devices, construction and energy contractors, IT and cloud providers, and manufacturing, food and logistics. Management system certificates come from accredited certification bodies, with the Saudi Accreditation Center (SAAC) as the national accreditation body. Sterling, with 20+ years of experience and 8,100+ client engagements in 60+ countries, serves Saudi clients from Sterling's Riyadh office, with Effivity and Sterling Academy included in the engagement.
ISO and GRC standards Sterling delivers in Saudi Arabia
Each page covers who needs the standard in Saudi Arabia, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Saudi Arabia (6)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| National Cybersecurity Authority (NCA) Government agencies (ministries, authorities, establishments) and their affiliated companies and entities inside and outside the Kingdom; private sector entities owning, operating or hosting Critical National Infrastructures | Essential Cybersecurity Controls (ECC-2:2024) — includes subdomains on third-party cybersecurity and on cloud computing and hosting cybersecurity, and a domain on cybersecurity resilience aspects of business continuity management; NCA evaluates compliance through self-assessment, periodic reports of the compliance tool and/or field auditing visits; other entities are encouraged to apply it. The document does not name ISO/IEC 27001 or any ISO standard. | NCA Essential Cybersecurity Controls |
| National Cybersecurity Authority (NCA) Organisations protecting data across its lifecycle (extension of the ECC) | Data Cybersecurity Controls (DCC-1:2022) — minimum cybersecurity requirements to protect data during its entire data lifecycle; extends the ECC; published with an assessment and compliance tool. The page does not state a relationship to the PDPL. | |
| Saudi Central Bank (SAMA) Banks, insurance and reinsurance companies, financing companies, credit bureaus and the financial market infrastructure | Cyber Security Framework (issued 2017) — based on SAMA requirements and industry cyber security standards such as NIST, ISF, ISO, BASEL and PCI; requires compliance with the Payment Card Industry Data Security Standard (PCI-DSS) for cardholder data; no specific ISO standard number cited. | SAMA Cyber Security Framework, PCI DSS |
| Saudi Central Bank (SAMA) All SAMA member organisations, banks operating in Saudi Arabia and their banking subsidiaries | Business Continuity Management Framework (27/2/2017, in force) — based on SAMA requirements, industry practices and international standards such as ISO 22301, ISO 27001, BCI Good Practice Guidelines and DRII Professional Practice guidelines. | ISO 22301, ISO/IEC 27001 |
| Saudi Food and Drug Authority (SFDA) Medical device manufacturers seeking marketing authorisation | MDS – REQ 1: Requirements for Medical Devices Marketing Authorization (MDS-REQ-001-V6/211219) — manufacturers establish, document and maintain an effective quality management system according to ISO 13485:2016 or an identical adopted standard; no explicit third-party certificate requirement in this document. | ISO 13485 |
| Saudi Food and Drug Authority (SFDA) Medical device establishments — local manufacturers, authorised representatives, importers and distributors | Requirements for Licensing of Medical Device Establishments (MDS-REQ-009-V2.0) — depending on the establishment category, a certificate of conformity to the quality management system requirements of the Saudi standard SFDA.MD/GSO ISO 13485:2017 or its equivalent from an accredited conformity assessment body, or documented evidence or an SFDA inspection report. | ISO 13485 |
Accreditation and recognition
- Saudi Accreditation Center (SAAC): National accreditation body; ILAC MRA signatory for testing and calibration (ISO/IEC 17025) and inspection (ISO/IEC 17020) since August 2021, extended to medical testing (ISO 15189) in December 2023; admitted to the IAF MLA in January 2024 for management systems certification (ISO/IEC 17021-1) with the ISO 9001 (QMS) sub-scope.
- Saudi Accreditation Committee (decision of the SASO Board, 2015): Market rule: the SASO Board decided that quality management systems certification bodies in the Saudi market obtain the approval of the Saudi Accreditation Committee according to ISO/IEC 17021, with a one-year transition period.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Cities
Tenders and procurement
- Etimad platform (Ministry of Finance): Integrated electronic platform for Ministry of Finance services used by government entities for tendering, invitations, RFP purchase, proposal review and electronic awarding. The government pages checked do not list ISO certificates; any certificate requirement is set in the individual tender.
- Government Tenders and Procurement Law (Ministry of Finance (implementing regulations)): Regulates government tenders and procurement procedures to prevent the influence of personal interests and to safeguard public funds; no ISO certificate requirement stated on the page checked. Decree number not yet confirmed on the official text.
Sterling in Saudi Arabia
Sterling delivers in Saudi Arabia from its Riyadh office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in Saudi Arabia, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions Saudi clients ask
Are certification audits in Saudi Arabia conducted in Arabic or English?
Both are workable. Arabic is the Kingdom's official language, and English is common in multinationals, banks and technology firms, so the choice is settled with the certification body when you apply, covering the audit itself and your controlled documents. Where a regulator, a government buyer or a client contract asks for Arabic, that requirement wins over convenience.
Which accreditation should our certification body hold for Saudi Arabia?
Look for a certification body accredited by the Saudi Accreditation Center (SAAC), the national accreditation body. IAF recorded SAAC's mutual recognition scope as ISO 9001 quality management only, so for any other standard check the body's own accreditation scope rather than assuming coverage. A 2015 SASO Board decision also asked quality management certification bodies in the Saudi market to be approved by the Saudi Accreditation Committee; confirm the current rule with SAAC.
Do the NCA's Essential Cybersecurity Controls apply to private companies?
Only partly. Private companies fall squarely within the ECC if they own, operate or host Critical National Infrastructures; for others it is encouraged. A private supplier outside that group can still face the controls through its contracts, because the third-party and cloud computing and hosting subdomains reach suppliers that way. Confirm your position with the NCA or your counsel.
Do Saudi government tenders require ISO certificates?
Not as a general rule. The government pages checked for the Etimad platform, which the Ministry of Finance runs for tendering, proposal review and electronic awarding, list no ISO certificate requirement; any such requirement is set in the individual tender. The Government Tenders and Procurement Law regulates procurement procedures to prevent personal interests influencing awards and to safeguard public funds. Read each tender's qualification criteria.
Which SAMA frameworks name international standards?
Two of them do. The Cyber Security Framework, issued in 2017, is based on SAMA requirements and standards such as NIST, ISF, ISO, BASEL and PCI, and requires PCI-DSS compliance for cardholder data. The Business Continuity Management Framework is based on international standards such as ISO 22301 and ISO 27001. Read the current texts on SAMA's rulebook before quoting either.
Can audits be scheduled during Ramadan?
Often yes, with planning. The Sunday–Thursday working week, Ramadan working hours, the Eid holidays, Founding Day and Saudi National Day all affect audit scheduling. Islamic holiday dates move each year, so no fixed dates are given here; agree the audit calendar with your certification body well ahead and confirm the dates for the year concerned.
Cities Sterling covers in Saudi Arabia
Each city page sets out the industries, zones and standards that matter locally.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Essential Cybersecurity Controls (ECC-2:2024) — cdn.nca.gov.sa; nca.gov.sa (accessed 5 Oct 2026)
- Data Cybersecurity Controls (DCC-1:2022) — nca.gov.sa (accessed 5 Oct 2026)
- Cyber Security Framework (issued 2017) — rulebook.sama.gov.sa (accessed 5 Oct 2026)
- Business Continuity Management Framework (27/2/2017, in force) — rulebook.sama.gov.sa (accessed 5 Oct 2026)
- MDS – REQ 1: Requirements for Medical Devices Marketing Authorization (MDS-REQ-001-V6/211219) — sfda.gov.sa (accessed 5 Oct 2026)
- Requirements for Licensing of Medical Device Establishments (MDS-REQ-009-V2.0) — sfda.gov.sa (accessed 5 Oct 2026)
- Saudi Accreditation Center (SAAC) — ilac.org; iaf.nu (accessed 5 Oct 2026)
- Saudi Accreditation Committee (decision of the SASO Board, 2015) — saso.gov.sa (accessed 5 Oct 2026)
- Etimad platform — hrsd.gov.sa; stats.gov.sa (accessed 5 Oct 2026)
- Government Tenders and Procurement Law — hrsd.gov.sa (accessed 5 Oct 2026)
Talk to a consultant
Plan your certification with the Riyadh team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
saudiarabia@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice