Sri Lanka · Certification
ISO/IEC 27001 certification in Sri Lanka
Achieve ISO 27001 certification in Sri Lanka with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- Accredited certification
- Mumbai office team
- Effivity software included
- Academy training included
Who asks for ISO 27001 in Sri Lanka
Clients include
ISO 27001 certification in Sri Lanka at a glance
Banking Act Directions No. 16 of 2021 (Technology Risk Management and Resilience for Licensed Banks) requires ISO/IEC 27001 for the organisations it covers. Most Sri Lankan buyers ask for it anyway.
For a Sri Lankan bank, ISO 27001 is a regulatory expectation rather than a marketing choice. Banking Act Directions No. 16 of 2021 require licensed banks to implement the latest edition of ISO/IEC 27001 and obtain certification, or in some cases assurance, and they require suppliers running security operations or hosting critical systems to be certified. The Finance Business Act Directions No. 01 of 2022 apply the same supplier rule to licensed finance companies. The Personal Data Protection Act, No. 9 of 2022 adds obligations on processing from 1 January 2027 without naming any ISO standard. Certificates come from accredited certification bodies, so check what accreditation stands behind yours: SLAB lists ISO/IEC 27001 on its scheme page but not in its recognised management systems scope list. Sterling's Mumbai office helps scope the system, run the risk assessment, write the Statement of Applicability and prepare for audit, with Effivity and Sterling Academy included with the engagement.
Who needs ISO 27001 in Sri Lanka, and what happens without it
For some organisations in Sri Lanka it is a legal requirement. For most, the question comes from a buyer, a regulator or a partner that wants proof before it signs. These are the organisations that get asked.
- Licensed commercial and specialised banksBanking Act Directions No. 16 of 2021 require banks to implement ISO/IEC 27001 and obtain certification or, for some banks, assurance.
- Providers of security operations, hosting and cloud services to banksThe Directions require third-party security operations providers and infrastructure that hosts critical or customer-data systems to hold ISO 27001 certification.
- Licensed finance companies and their suppliersThe Finance Business Act Directions No. 01 of 2022 require third-party security operations providers to hold ISO 27001 certification.
- ICT and business process management exportersOverseas customers ask outsourced providers for evidence of an information security management system.
- Controllers and processors of personal dataThe Personal Data Protection Act sets obligations on integrity and confidentiality of processing, operative for Part I from 1 January 2027.
Not sure which of these applies to you?Answer a short set of questions and your readiness report arrives by e-mail.
Take the ISO/IEC 27001 readiness checkISO 27001 requirements in Sri Lanka
Strip away the vocabulary and ISO/IEC 27001 requires a company to prove six things about how it protects the information it holds.
In Sri Lanka these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: ISO/IEC 27001 explained →
How to get ISO 27001 certified in Sri Lanka
One team from the Mumbai office carries the work from scoping to certificate. Clients across Sri Lanka are served from Sterling's Mumbai office, on-site where the work needs it and remotely otherwise.
- Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
- Gap assessment against ISO/IEC 27001 and the Sri Lankan requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
- Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
- Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before the certification body arrives.
- Certification body stage 1 and stage 2, then surveillanceAn accredited body audits and decides. Sterling supports the audits and the three-year cycle.
- End to end, from one team
- Effivity ISO & GRC software
- Preferential Sterling Academy access, with complimentary awareness training for your people
- Internal auditor training for your audit team, as applicable to your standard
- Vulnerability assessment on ISMS engagements
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.
How long does ISO 27001 certification take in Sri Lanka?
There is no standard duration: it depends on your scope and on how much of the system already runs. In Sri Lanka these are the factors that set the timeline.
- Scope: number of sites, data centres, cloud services and teams
- Maturity of the risk assessment and Statement of Applicability
- Existing controls from CBSL directions or customer security requirements
- Certification body scheduling and any bank-specific audit conditions
Sterling agrees a dated plan with you on the discovery call, once the scope is known.
How much does ISO 27001 certification cost in Sri Lanka?
The cost has two parts: the consulting work to build and prove the system, and the certification body’s audit fees, which are quoted separately. In Sri Lanka these factors move both.
- Headcount and number of sites in scope
- Number of systems, applications and outsourced suppliers
- Certification body audit fees quoted separately from consulting
- Penetration testing, monitoring tools and remediation work
Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.
ISO 27001 consultants and certification bodies in Sri Lanka
Two different organisations are involved. A consultant helps you build the system and prove it works; an accredited certification body then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.
- Check that the body’s accreditation or approval covers ISO 27001 and your sector, and that its certificates can be verified online.
- Ask the consultant how the local requirements in Sri Lanka are mapped into the same system, so nothing runs twice.
- Ask for client references in your sector; Sterling’s client letters are available on request.
- Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.
Laws and regulations that drive ISO 27001 in Sri Lanka (4)
| Instrument | How it treats the standard |
|---|---|
| Banking Act Directions No. 16 of 2021 (Technology Risk Management and Resilience for Licensed Banks) | Requires Banks shall implement the latest edition of ISO/IEC 27001 and obtain certification from an accredited certification body (some banks may instead obtain assurance from an approved external auditor); third-party security operations providers and hosting infrastructure must hold ISO 27001 certification. |
| Finance Business Act Directions No. 01 of 2022 (Licensed Finance Companies) | Requires Third-party providers of security operations services to whom non-public data may be exposed must hold ISO 27001 certification from an accredited certification body. |
| CBSL Circular No. 02 of 2025 on reporting of IT and cybersecurity incidents | Scheme rule Licensed banks report defined IT and cybersecurity incident categories to the Bank Supervision Department; the circular names no standard. |
| Personal Data Protection Act, No. 9 of 2022 (as amended in 2025) | Does not name ISO/IEC 27001 Part I sets processing obligations including integrity and confidentiality, and the Authority may recognise certification and certifying bodies for personal data protection. |
Accreditation, audit language and remote audits in Sri Lanka
Choose a certification body accredited for this standard by the Sri Lanka Accreditation Board (SLAB) or by an accreditation body within the international mutual recognition arrangements (Global ACI — Global Accreditation Cooperation Incorporated, formerly the IAF MLA); check that the accreditation scope covers the standard and your sector. The Banking Act Directions define an accredited certification body as one accredited for the ISO standard by SLAB or by an accreditation body within the international mutual recognition arrangements. SLAB's scheme page lists ISO/IEC 27001, but its recognition page does not show information security in the management systems scope list, so ask the certification body which accreditation covers it and confirm that your bank or customer accepts it. Edition and transition details: ISO/IEC 27001 hub →
Audit language
Business records, standards and tenders are mostly in English, and the Constitution names English as the link language alongside Sinhala and Tamil; interviews with operators and workers may run in Sinhala or Tamil. Agree the audit language, any interpreter and the language of controlled documents with the certification body at application.
Remote and on-site
Stage audits cover the management system and the sites, data centres and teams in scope; document review and interviews can be remote at the certification body's discretion, while operations rooms and data centres are normally visited.
ISO 27001 in Sri Lanka: questions clients ask
Is ISO 27001 mandatory for banks in Sri Lanka?
For licensed banks it is close to mandatory. Banking Act Directions No. 16 of 2021 require banks to implement the latest edition of ISO/IEC 27001 and obtain certification from an accredited certification body, with assurance from an approved external auditor allowed for some banks whose Board finds the risk minimal. Check which route applies to your bank with the Central Bank.
Must a supplier running a bank's security operations centre hold ISO 27001?
Yes. Both sets of Central Bank directions say that third-party providers of security operations services to whom non-public data may be exposed must hold certification for the latest edition of ISO 27001 from an accredited certification body, for the services provided. The banking Directions add hosting infrastructure and cloud services. Confirm the exact scope wording with your customer's compliance team.
Does the Personal Data Protection Act require ISO 27001?
No. The Act names no ISO standard. Its processing obligations include integrity and confidentiality and take effect through Part I from 1 January 2027, and the Authority may recognise certification and certifying bodies for personal data protection. An ISO 27001 certificate can evidence security controls but is not a substitute for compliance. Ask the Data Protection Authority what it will recognise.
Which accreditation backs an ISO 27001 certificate issued for Sri Lanka?
Accreditation by SLAB or by a body within the international mutual recognition arrangements, as the Central Bank's Directions allow. SLAB's scheme page lists ISO/IEC 27001, while its recognition page does not show information security among the management systems scopes it signs. Ask the certification body for the certificate and scope, and check that your bank accepts it.
More on ISO 27001 for Sri Lankan organisations
- ISO/IEC 27001: the complete guide
- Watch: How to implement ISO/IEC 27001
- Banking and financial services: ISO/IEC 27001 for the sector
- BPO and shared services: ISO/IEC 27001 for the sector
- Government and public sector: ISO/IEC 27001 for the sector
- Healthcare and health data: ISO/IEC 27001 for the sector
- Professional and legal services: ISO/IEC 27001 for the sector
- Software, SaaS and technology: ISO/IEC 27001 for the sector
- Telecoms and data centres: ISO/IEC 27001 for the sector
- ISO 27001 certification in Sri Lanka and every other standard Sterling delivers there
Other standards Sri Lankan businesses ask Sterling for
Organisations in Sri Lanka often combine ISO/IEC 27001 with one of these, under one management system where the scopes allow.
Start with a free discovery call from the Mumbai office
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Banking Act Directions No. 16 of 2021 (Technology Risk Management and Resilience for Licensed Banks) — cbsl.gov.lk (accessed 11 Oct 2026)
- Finance Business Act Directions No. 01 of 2022 (Licensed Finance Companies) — cbsl.gov.lk (accessed 11 Oct 2026)
- CBSL Circular No. 02 of 2025 on reporting of IT and cybersecurity incidents — cbsl.gov.lk (accessed 11 Oct 2026)
- Personal Data Protection Act, No. 9 of 2022 (as amended in 2025) — dpa.gov.lk (accessed 11 Oct 2026)
- Sri Lanka Accreditation Board for Conformity Assessment (SLAB) — slab.lk (accessed 11 Oct 2026)
Talk to a consultant
Plan your certification with the Navi Mumbai team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
india@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice