Where we work · Singapore
ISO and GRC certification consulting in Singapore
Achieve ISO and GRC certification in Singapore with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Singapore office team
- Effivity and Academy included
Sectors that ask for certification in Singapore
Clients include
ISO and GRC certification in Singapore at a glance
Singapore's demand for certification and compliance work comes from regulators, procurement schemes and an economy that sells services worldwide. The Personal Data Protection Commission oversees the Personal Data Protection Act 2012, whose eleven obligations include protection and data breach notification. The Monetary Authority of Singapore's guidelines on business continuity management and on outsourcing by banks shape what financial institutions expect of their providers. The Cyber Security Agency of Singapore administers the Cybersecurity Act 2018 and publishes the Cyber Trust mark, while the Infocomm Media Development Authority runs the Multi-Tier Cloud Security scheme for cloud providers. The Health Sciences Authority requires ISO 13485 certification for many medical device businesses, and bizSAFE and the Building and Construction Authority's registration system put safety standards in front of contractors and facilities managers. Demand is strongest in financial services and fintech, IT, SaaS and cloud, medical devices and healthcare, facilities management and construction, and precision engineering. Certification itself is granted by certification bodies accredited by the Singapore Accreditation Council, the national accreditation body. Sterling's Singapore office draws on 20+ years of experience and 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Singapore
Each page covers who needs the standard in Singapore, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Singapore (10)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Personal Data Protection Act 2012 (PDPA) Personal Data Protection Commission (PDPC) | PDPC lists eleven obligations: Accountability, Notification, Consent, Purpose Limitation, Accuracy, Protection, Retention Limitation, Transfer Limitation, Access and Correction, Data Breach Notification and Data Portability. Protection Obligation: reasonable security arrangements to protect personal data in the organisation's possession. Data breaches likely to result in significant harm to individuals, or of significant scale, must be notified to PDPC and affected individuals as soon as practicable. PDPC's advisory guidelines on the Protection Obligation state there is no one-size-fits-all solution and name no ISO standard or certification. | |
| Monetary Authority of Singapore (MAS) Financial institutions supervised by MAS | Guidelines on Business Continuity Management — board and senior management responsibilities, recovery with time targets, interdependencies, extensive disruptions, concentration risk and testing of plans; ISO 22301 is not cited. | |
| Monetary Authority of Singapore (MAS) Banks and merchant banks, and the providers of their outsourced relevant services | Guidelines on Outsourcing (Banks) — risk management practices for the management of outsourced relevant services (published 11 December 2023, effective 11 December 2024). | |
| Cyber Security Agency of Singapore (CSA), Commissioner of Cybersecurity Owners of critical information infrastructure (CII) in sectors including energy, water, banking and finance, healthcare and transport; licensed cybersecurity service providers | Cybersecurity Act 2018 (as amended in 2024) — framework for designating CII and CII owners' duties to protect it, incident reporting including supply-chain incidents, and licensing of penetration testing and managed security operations centre monitoring providers; no ISO standard cited on the page. | |
| Cyber Security Agency of Singapore (CSA) Organisations with extensive digitalised business operations | Cyber Trust mark — risk-based cybersecurity certification published as Singapore Standard SS 712 (2025 edition); audits by certification bodies appointed by CSA; certification valid with a yearly audit; CSA publishes a mapping between the Cyber Trust (2025) mark and ISO/IEC 27k. | ISO/IEC 27001 |
| Infocomm Media Development Authority (IMDA) Cloud service providers | Multi-Tier Cloud Security (MTCS) Singapore Standard SS 584 and the MTCS Certification Scheme; IMDA publishes a gap analysis report to support cross certification between ISO/IEC 27001:2013 and MTCS SS584:2020. | ISO/IEC 27001 |
| Health Sciences Authority (HSA) Medical device manufacturers, importers and wholesalers (dealer's licence) | Quality Management System for medical devices under the dealer's licence — manufacturers: ISO 13485 certification for Class B, C and D devices from certification bodies accredited by SAC (or MDSAP certification); declaration of conformity to ISO 13485 for Class A. Importers and wholesalers: ISO 13485 or GDPMDS certification from SAC-accredited bodies for Class B, C and D (or MDSAP); declaration of conformity for Class A. | ISO 13485 |
| Workplace Safety and Health Council (bizSAFE programme) Contractors and employers (workplace safety and health) | BizSAFE — Levels 3, 4 and STAR are valid for a fixed period or until expiry of the relevant external certification (SCAL-SLOTS, JCI, Responsible Care, ISO 45001, SS 651), whichever is earlier; the STAR risk management implementation audit checks the Code of Practice on WSH Risk Management, which goes beyond ISO 45001. | ISO 45001 |
| Civil Aviation Authority of Singapore (CAAS) Aerospace industry | SAC states CAAS is the regulatory body governing the aerospace industry in Singapore and sets requirements on conformity assessment; SAC describes AS 9100 as an aerospace quality management system standard based on ISO 9001. No CAAS requirement for AS9100 was confirmed. | |
| Building and Construction Authority (BCA) Building and construction | SAC states BCA is the regulatory body governing the construction industry; BCA's Contractors Registration System (see tender_and_procurement). |
Accreditation and recognition
- Singapore Accreditation Council (SAC): National accreditation body (managed by Enterprise Singapore); accredits management-system certification bodies (criteria SAC CT 01), laboratories under SAC-SINGLAS, inspection bodies, personnel certification bodies and validation and verification bodies.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- BCA Contractors Registration System (CRS) — FM01 Facilities Management workhead (Building and Construction Authority (BCA)): BCA circular of 23 July 2021: under Management & Development, grades M1 and M2 require "BizSAFE Star / ISO45001", plus Facilities Management Company (FMC) Accreditation added from 1 August 2022; grade M3 requires "BizSAFE Level 3 / ISO45001". ISO 9001, 14001 and 41001 are not mentioned in the circular.
- BCA Contractors Registration System (CRS) — general terms and guidelines (Building and Construction Authority (BCA)): The CRS terms of registration (Nov 2020 edition) address financial capacity, personnel, track record and company status and do not list ISO certificates; the Application and Registration Guidelines (Sep 2025) refer applicants to each workhead's Specific Registration Requirements for Management and Development requirements. Check the SRR for the workhead and grade concerned.
Economic zones
- JTC CleanTech Park: eco-business park (clean technology)
Sterling in Singapore
Sterling delivers in Singapore from its Singapore office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in Singapore, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions Singapore clients ask
Are certification audits in Singapore conducted in English?
Yes, in the normal case. English is the working language of business and administration in Singapore, so certification audits and reports are usually conducted in it. Where shop-floor staff work in another language, settle the audit language and the language of your controlled documents with the certification body at application, rather than leaving the question open until the audit begins.
Does the PDPA require ISO 27001 certification?
No. The Protection Obligation asks organisations to make reasonable security arrangements for personal data in their possession, and PDPC's advisory guidelines on it say there is no one-size-fits-all solution while naming no ISO standard or certification. The choice of measures therefore rests on your own risk. Your counsel can confirm how this applies to your business.
Which accreditation should the certification body hold for Singapore?
Start with the Singapore Accreditation Council, the national accreditation body managed by Enterprise Singapore, which accredits management-system certification bodies. Describe SAC as an accreditation body within the international mutual recognition arrangements, not as the arrangement itself. Recognition scopes change, so check the current scope before quoting it on any page or proposal.
Is CSA's Cyber Trust mark the same as ISO 27001?
No. Cyber Trust is a separate CSA certification, published as Singapore Standard SS 712 and audited by certification bodies that CSA appoints. CSA does publish a mapping between the Cyber Trust (2025) mark and ISO/IEC 27k, which shows where the two meet, but treat them as two different certifications with different owners.
Do BCA contractor registrations require ISO certificates?
Not as a general rule. The registration terms address financial capacity, personnel, track record and company status, and do not list ISO certificates. The exception to check is workhead FM01: under a 2021 BCA circular, grades M1 and M2 accept bizSAFE Star or ISO 45001, and grade M3 accepts bizSAFE Level 3 or ISO 45001. For any other workhead, read the Specific Registration Requirements for your grade.
Can audits be scheduled around Chinese New Year or Hari Raya?
Yes, but plan around the calendar. Singapore's public holidays include festivals that follow lunar and religious calendars, among them Chinese New Year, Hari Raya Puasa, Hari Raya Haji and Deepavali, and their dates move each year. Do not rely on fixed dates; agree audit dates with the certification body using each year's published calendar.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Personal Data Protection Act 2012 (PDPA) — pdpc.gov.sg (accessed 5 Oct 2026)
- Guidelines on Business Continuity Management — mas.gov.sg (accessed 5 Oct 2026)
- Guidelines on Outsourcing (Banks) — mas.gov.sg (accessed 5 Oct 2026)
- Cybersecurity Act 2018 (as amended in 2024) — csa.gov.sg (accessed 5 Oct 2026)
- Cyber Trust mark — csa.gov.sg (accessed 5 Oct 2026)
- Multi-Tier Cloud Security (MTCS) Singapore Standard SS 584 and the MTCS Certification Scheme; IMDA publishes a gap analysis report to support cross certification between ISO/IEC 27001:2013 and MTCS SS584:2020 — imda.gov.sg (accessed 5 Oct 2026)
- Quality Management System for medical devices under the dealer's licence — hsa.gov.sg (accessed 5 Oct 2026)
- bizSAFE — tal.sg (accessed 5 Oct 2026)
- SAC states CAAS is the regulatory body governing the aerospace industry in Singapore and sets requirements on conformity assessment; SAC describes AS 9100 as an aerospace quality management system standard based on ISO 9001. No CAAS requirement for AS9100 was confirmed — sac-accreditation.gov.sg (accessed 5 Oct 2026)
- SAC states BCA is the regulatory body governing the construction industry; BCA's Contractors Registration System (see tender_and_procurement) — sac-accreditation.gov.sg (accessed 5 Oct 2026)
- Singapore Accreditation Council (SAC) — sac-accreditation.gov.sg; enterprisesg.gov.sg (accessed 5 Oct 2026)
- BCA Contractors Registration System (CRS) — FM01 Facilities Management workhead — www1.bca.gov.sg (accessed 5 Oct 2026)
- BCA Contractors Registration System (CRS) — general terms and guidelines — www1.bca.gov.sg; isomer-user-content.by.gov.sg (accessed 5 Oct 2026)
- JTC CleanTech Park — enterprisesg.gov.sg (accessed 5 Oct 2026)
Talk to a consultant
Plan your certification with the Singapore team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
singapore@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice