Where we work · Southeast Asia
ISO and GRC consulting in Southeast Asia, led by ISO consultants based in Manila.
Sterling's regional headquarters in Manila supports organisations across Southeast Asia with ISO certification, information security, data protection and financial-sector compliance programmes. Our expert and experienced consultants work with your team from gap analysis to the certification audit, with each country's accreditation body and regulators in view from the first workshop. We ensure successful certification for our clients.
- A regional headquarters in Makati City, Manila, with offices in Singapore, Malaysia, Indonesia and Vietnam, part of a group implementing management systems since 2003
- Programmes that account for local rules: the Philippines' Data Privacy Act, Singapore's PDPA, MAS technology risk guidelines and BSP circulars where they apply
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify; an accredited body audits and decides
- Certificates buyers acceptA system certified by a body whose accreditation you have checked against what your customers, principals and tenders ask for.
- Local rules built inData protection laws and financial-sector rules mapped into the same system rather than run as separate projects.
- One programme, several countriesSites in the Philippines, Singapore and neighbouring markets under one engagement team and one Effivity workspace.
- Evidence that keeps runningRecords produced by daily work, so surveillance audits, client due diligence and regulator requests draw on one source.
Countries
Each country page sets out the regulators, the accreditation route and every standard Sterling delivers there.
- Brunei0 standards and frameworks
- Cambodia0 standards and frameworks
- China21 standards and frameworks
- Hong Kong20 standards and frameworks
- Indonesia22 standards and frameworks
- Japan21 standards and frameworks
- Laos0 standards and frameworks
- Malaysia22 standards and frameworks
- Myanmar0 standards and frameworks
- Philippines23 standards and frameworks
- Singapore21 standards and frameworks
- South Korea22 standards and frameworks
- Taiwan22 standards and frameworks
- Thailand21 standards and frameworks
- Timor-Leste0 standards and frameworks
- Vietnam20 standards and frameworks
Offices
Sterling in Southeast Asia: five offices, one engagement team.
Our regional headquarters in Manila leads engagements across Southeast Asia, supported by Sterling offices in Singapore, Malaysia, Indonesia and Vietnam, with consultants travelling to your sites whenever observation or in-person work is needed.
- Manila (regional headquarters)Suite C, 8th Floor, The Valero Tower, 122 Valero St., Salcedo Village, Brgy. Bel-Air, Makati City, Manila · +63 97781 51204 · philippines@sterling-grc.com
- SingaporeSterling office · 101 Thomson Road, United Square, near Holiday Inn, Singapore 307591 · +65 3125 6208 · singapore@sterling-grc.com
- Kuala Lumpur, MalaysiaSterling office · Menara Prestige, No. 1, Jalan Pinang, Kuala Lumpur · malaysia@sterling-grc.com
- Jakarta, IndonesiaSterling office · Menara BCA Grand Indonesia, Jl. M.H. Thamrin No. 1, Jakarta · indonesia@sterling-grc.com
- Ho Chi Minh City, VietnamSterling office · Deutsches Haus, 33 Le Duan Street, Saigon Ward, Ho Chi Minh City · vietnam@sterling-grc.com
- Hong KongSterling office · LKF Tower, 33 Wyndham Street, 19F–23F, Hong Kong Island, Hong Kong · hongkong@sterling-grc.com
Programmes with sites in Thailand or elsewhere in the region are led from Manila, with the on-site plan agreed in the proposal. Every other Sterling office, including the global headquarters in New York, is listed under All offices and contact details.
Standards in demand
The standards and frameworks organisations in Southeast Asia ask us about.
Most programmes start with a certifiable ISO standard that customers, principals or tenders ask for, then add the local rules that apply to the business: the Data Privacy Act for personal data handled in the Philippines, Singapore's PDPA, the MAS technology risk guidelines for Singapore financial institutions and the BSP circulars for Philippine banks and other supervised institutions. ISO 22000, SOC 2, PCI DSS and the data protection laws of Malaysia, Thailand and Indonesia are handled by the same team.
- ISO 9001Quality management
- ISO/IEC 27001Information security
- ISO 14001Environmental management
- ISO 45001Occupational safety
- Data Privacy Act (Philippines)Data protection
- PDPA (Singapore)Data protection
- MAS TRM (Singapore)Financial regulation
- BSP circulars (Philippines)Financial regulation
- All standards & frameworksThe full catalogue, with sector schemes
Bodies and regulators
Who accredits, who certifies and who regulates in Southeast Asia.
Sterling does not certify or accredit. Each country has its own accreditation body for certification bodies and laboratories, and its own data protection and financial-sector rules. Those rules are legal duties with no certificate attached; the regulator supervises and enforces them.
| Country | Accreditation body and recognition | Regulators and schemes that ask for certification |
|---|---|---|
| Philippines | The Philippine Accreditation Bureau (PAB), part of the Department of Trade and Industry, accredits certification bodies to ISO/IEC 17021-1, including for ISO 9001 and ISO/IEC 27001, and publishes accreditation certificates with their scope. Global ACI recognition not confirmed; see the note below | Data Privacy Act of 2012, enforced by the National Privacy Commission (breach notice within 72 hours under NPC Circular 16-03); BSP rules on IT risk, business continuity and outsourcing for supervised institutions; for government agencies, the FY 2023 Performance-Based Bonus guidelines asked for ISO QMS certification of at least one core process |
| Singapore | The Singapore Accreditation Council (SAC) accredits management system certification bodies and laboratories and runs a public search of accredited organisations; it states APAC and IAF MLA membership for quality management systems. Global ACI recognition not confirmed | Personal Data Protection Act 2012, administered by the PDPC; MAS Technology Risk Management Guidelines of 18 January 2021 for financial institutions; CSA Cyber Trust mark (SS 712:2025), certified by CSA-appointed certification bodies |
| Malaysia | The Department of Standards Malaysia accredits management system certification bodies to MS ISO/IEC 17021-1 and publishes a directory of accredited bodies. Global ACI recognition not confirmed | Personal Data Protection Act 2010 (Act 709), amended by Act A1727 with provisions in force during 2025, supervised by the Personal Data Protection Commissioner; Cyber Security Act 2024 (Act 854) for national critical information infrastructure entities |
| Indonesia | Indonesia's national accreditation body; we confirm its current scope for your standard during scoping | Law No. 27 of 2022 on Personal Data Protection: organisations had two years from 17 October 2022 to comply, and a failure of personal data protection is notified within 3 × 24 hours |
| Vietnam and Thailand | Vietnam: the National Accreditation Bureau (BoA) operates the VICAS scheme for certification bodies to ISO/IEC 17021-1 and states IAF MLA signatory status. Thailand: the accreditation body is confirmed during scoping | Thailand's Personal Data Protection Act B.E. 2562 (2019), overseen by the Personal Data Protection Committee, with breach notice to its Office within 72 hours where feasible. Vietnamese rules are confirmed during scoping |
Global ACI replaced the IAF MLA and the ILAC MRA on 1 January 2026. PAB refers to ILAC and APLAC arrangements on its own pages, SAC and BoA state IAF membership, but none of the bodies above could be confirmed on Global ACI's list of recognised accreditation bodies when we checked, so confirm each body's current standing before you rely on it. Check any certificate on IAF CertSearch or the accreditation body's own register.
How we deliver
One method, delivered where you are.
Engagements in Southeast Asia follow the staged method Sterling uses in every region, led from the Manila regional headquarters.
- One engagement team accountable across every country you operate in, with local consultants where the work is
- Remote and on site: workshops, document reviews and coaching remotely; site work where observation or in-person work is necessary, with short travel from the regional offices
- One Effivity workspace for every site, included with the engagement at no additional cost
- One certification body for multi-site programmes where the body agrees, with local requirements handled where they arise
- Design™ or Drive™: your team implements with Sterling's structure and coaching, or Sterling consultants take on the agreed consulting and documentation work
Programmes in the region often cover a Philippine delivery centre or plant alongside offices in Singapore or another neighbouring market, with customers and principals abroad who run their own supplier audits and security questionnaires. We plan scope, sampling and site visits around that, keep the data protection law of each country and any MAS or BSP obligations on the same risk register as the ISO requirements, and prepare your team for the certification body's readiness review and certification audit. Where a regulator or a customer's auditor tests your controls, Sterling prepares the controls and the evidence; the regulator and the auditor reach their own conclusions.
Effivity · included with the engagement
Your system runs in software from the first workshop.
Effivity is the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures it within the agreed scope, so evidence accumulates as people do their work and the certification auditor reviews a live system rather than a binder. Sterling consulting clients get their subscription included with the engagement, at no additional cost.
ISO & GRC softwareSterling Academy · included with the engagement
Your people learn the standard, not just the forms.
E-learning with practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online, with progress by department for the certification audit. Sterling consulting clients get preferential course access and special pricing, including complimentary awareness training for their people as part of the engagement.
Contact us about Academy accessStandards
Most requested in Southeast Asia
- ISO 9001ISO 9001 certification consulting: a quality management system built with your people, evidence prepared and support until an accredited body certifies you.
- ISO/IEC 27001ISO/IEC 27001 certification consulting: an ISMS built with your people, evidence prepared, and support through Stage 1, Stage 2 and surveillance audits.
- SOC 2SOC 2 Readiness and compliance consulting: controls mapped to the Trust Services Criteria and evidence prepared for the CPA firm's SOC 2 attestation report.
- PCI DSSPCI DSS compliance consulting for merchants and service providers: scope, the twelve requirements and evidence prepared for your annual validation by a QSA.
- ISO 22301ISO 22301 certification consulting to keep delivering through disruption: impact analysis, continuity plans and exercises, prepared for an accredited audit.
- ISO 14001ISO 14001 certification consulting: aspects, impacts and compliance obligations controlled, with support until an accredited body certifies you.
- HIPAAHIPAA compliance consulting for US covered entities and business associates: a documented programme protecting PHI.
- ISO 22000ISO 22000 certification consulting: PRPs, a validated hazard control plan, traceability and recall readiness, built with your teams for an accredited audit.
Where we work
Your business
crosses borders.
Your programme can too.
A Sterling lead in your working hours, wherever you operate. Multi-site programmes run with one engagement team, one Effivity workspace and one certification body, with local requirements and customer expectations handled where they arise.
Global headquarters in New York; regional headquarters in Dubai, Navi Mumbai, Manila, London, Enschede and Johannesburg; offices in 21 countries.
All offices and contact detailsClient experience in Southeast Asia
On the record: what clients in Southeast Asia say about working with Sterling.
The managing director writes, on behalf of the whole organisation, that the guidance and support provided during its journey to ISO/IEC 27001:2022 certification were invaluable, and that the certificate is a direct result of that support.
The president and CEO writes that the certification is helping the company win business, and that Sterling's training of the team on the standard made a large difference to the development and improvement of its operations.
The technical services manager and the vice-president for operations report that five of the company's sites received ISO 14001 and ISO 45001 certification, with the project completed ahead of schedule and beyond expectation.
The ISO project manager writes that every project milestone was met within the agreed timeframe and to the stated objectives, and that the team's expertise, meticulous planning and collaborative approach were instrumental in a smooth and efficient implementation.
Each account is drawn from a signed letter or e-mail on file and reported in our words, with the signatory's role and organisation attached; the original letters are available on request. Ask for references in your sector before you decide.
- 60+countries where Sterling has delivered certification
- 21countries with a Sterling office, eight regions, one coordinated team
- 2003the year the group began implementing ISO management systems; the same method, refined, since
- 8,100+client engagements across the group, from single-site SMEs to multinationals
FAQs
Questions clients in Southeast Asia ask before they engage us.
The specific answers for your organisation come from the discovery call. These are the general ones.
Where is Sterling's office in Southeast Asia?
Sterling's regional headquarters for Southeast Asia is at Suite C, 8th Floor, The Valero Tower, 122 Valero St., Salcedo Village, Makati City, Manila. You can reach the team on +63 97781 51204 or at philippines@sterling-grc.com. Sterling also has offices in Singapore, Malaysia, Indonesia and Vietnam. Consultants run workshops and document reviews remotely and travel to your sites when observation or in-person work is needed.
Who accredits certification bodies in the Philippines and Singapore?
In the Philippines, the Philippine Accreditation Bureau (PAB) of the Department of Trade and Industry accredits certification bodies to ISO/IEC 17021-1. In Singapore, the Singapore Accreditation Council (SAC) accredits certification bodies and laboratories and offers a public search of accredited organisations. Sterling does not certify. Before you choose a certification body, check its accreditation and scope for your standard, and verify issued certificates on IAF CertSearch or the accreditation body's register.
Does the BSP require ISO/IEC 27001 certification?
No BSP rule we have found requires it. BSP Circular No. 982 of 2017 on information security management states that security certifications are not specifically required under BSP regulations but may be considered a sound security practice. Supervised institutions must still meet the Manual of Regulations for Banks on IT risk management, business continuity and outsourcing. An ISO/IEC 27001 system is a practical way to organise the controls and evidence those sections expect.
Is there a certificate for MAS TRM compliance in Singapore?
No. The MAS Technology Risk Management Guidelines, revised on 18 January 2021, set out what MAS expects of financial institutions, and MAS considers their observance in its risk assessment of each institution. No certificate proves compliance. Separate MAS notices on technology risk and cyber hygiene apply by licence type. Sterling helps you map the guidelines to your controls, close the gaps and keep the evidence your internal audit and MAS will ask for.
Does data protection law in the region lead to a certificate?
Not on its own. The Philippines' Data Privacy Act, Singapore's PDPA, Malaysia's PDPA, Thailand's PDPA and Indonesia's Law No. 27 of 2022 are legal duties enforced by their regulators. Certification to ISO/IEC 27701 by an accredited body is a separate, voluntary step, and in the Philippines ISO/IEC 27001 and ISO/IEC 27701 certification are prerequisites for the National Privacy Commission's voluntary Privacy Mark. We build the law and the standard into one system.
Can one programme cover sites in several Southeast Asian countries?
Yes. A multi-country programme runs under one engagement team, with every site in one Effivity workspace and, where the certification body agrees, one certification programme. During scoping we confirm the accreditation body, the certification body's coverage and the local regulations for each country, because the bodies and rules differ from market to market. Sites in the Philippines, Singapore, Malaysia, Indonesia and Vietnam can be supported from the nearest Sterling office.
Do you work with government agencies in the Philippines?
Yes. The FY 2023 guidelines for the Performance-Based Bonus asked departments, agencies, state universities and colleges and government-owned corporations to hold ISO QMS certification for at least one critical frontline service or core process. The later circular we checked does not repeat that condition, so confirm the current guidelines with your agency. Sterling prepares the quality management system and your people; an accredited certification body audits and decides.
Talk to a consultant
Plan your certification in Southeast Asia with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice