Where we work · Sudan
ISO and GRC certification consulting in Sudan
Achieve ISO and GRC certification in Sudan with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 20 standards, one team
- Accredited certification route
- Dubai office team
- Effivity and Academy included
Sectors that ask for certification in Sudan
Clients include
ISO and GRC certification in Sudan at a glance
Sudanese demand for ISO and GRC work follows regulators and buyers rather than one national rule. The Central Bank of Sudan issued a Cybersecurity Framework for Banks and Financial Institutions, dated January 2026 on its cover, which gives ISO 27001, NIST-CSF, SWIFT CSP and the PCI standards as examples of industry standards to follow. The National Medicines and Poisons Board sets the conditions for importing, making, storing and registering medicines, cosmetics and medical supplies under the Medicines and Poisons Act 2009. The Sudanese Standards and Metrology Organization, the national standards body, works under the Standards and Metrology Act 2008 and the Measurement and Calibration Act 2018, runs calibration, inspection and hallmarking services, and lists an ISO/IEC 17025 laboratory accreditation certificate among the papers for imported pesticides and fertilisers. Free zones are established under the Free Zones and Markets Act 2009. Certificates come from accredited certification bodies, never from Sterling. Sterling's Dubai office serves clients in Sudan, with 20+ years, 8,100+ client engagements in 60+ countries, and Effivity software and Sterling Academy training included with the engagement.
ISO and GRC standards Sterling delivers in Sudan
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Sudan (5)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Central Bank of Sudan (CBOS) Banks, payment companies and other financial institutions | The Bank publishes a Cybersecurity Framework for Banks and Financial Institutions (إطار الأمن السيبراني للمصارف والمؤسسات المالية), dated January 2026 on its cover. It covers all entities under the Bank's supervision and puts responsibility for applying it on boards, executive management, information security, IT and risk and compliance officers. Its chapters run from governance and risk management through technical controls, data and information protection, resilience, digital services and card operations to business continuity. A section on industry standards tells entities to follow the latest editions of relevant regulations and international standards, giving ISO 27001, NIST-CSF, SWIFT CSP, PCI PTS, PCI PA-DSS, PCI DSS and EMV as examples. The framework does not state that an ISO certificate is required. | ISO/IEC 27001, PCI DSS, ISO 22301 |
| Central Bank of Sudan (CBOS) Payment systems and mobile payments | The Bank lists a regulation organising payment systems business (لائحة تنظيم أعمال نظم الدفع, 2013 edition) and a regulation on licensing and organising mobile-payment financial institutions (2020) among its regulations. The cybersecurity framework names both when it lists the rules that entities must comply with. Its tenders page also carries notices for the national instant payment system and mobile payment projects. | PCI DSS, ISO/IEC 27001 |
| National Medicines and Poisons Board (NMPB) Medicines, cosmetics and medical supplies | The Board is the national authority for setting the conditions for importing, manufacturing, controlling, storing, pricing, transporting and using medicines, cosmetics, medical supplies and pharmaceutical preparations under the Medicines and Poisons Act 2009 (قانون الأدوية والسموم لسنة 2009). Its listed powers include registering medicines, cosmetics, medical supplies and poisons, setting the conditions for licensing drug warehouses, pharmaceutical laboratories and drug factories, registering foreign medicine and supply companies, and licensing clinical trials. Its pages do not name ISO 13485 or ISO 9001. | |
| Sudanese Standards and Metrology Organization (SSMO) Standards, metrology, market inspection and the gold trade | The Organization describes itself as the reference body for standards, control, measurement and calibration. Its laws page lists its founding order (2007), the Standards and Metrology Act 2008, the Measurement and Calibration Act 2018 and the Precious Metals and Gemstones Control Act 2008. Its services page lists the preparation of national standards, document checks on goods and services, testing of modified vehicles, hallmarking and licensing for the gold and silver trade, calibration of weighing and measuring instruments, fuel pumps and gas depots, industrial and service inspection and market inspection campaigns. It is a full member of ISO, IEC and the Codex Alimentarius Commission, among other bodies. None of its pages makes a management system certificate compulsory. | |
| Sudanese Standards and Metrology Organization (SSMO) Imported agricultural inputs (pesticides and fertilisers) | The Organization's frequently-asked-questions page lists the documents it asks for when checking imported pesticides and fertilisers, among them the test report, the origin certificate and an accreditation certificate of the testing laboratory under ISO/IEC 17025:2017. For pesticides it also lists a form issued by the National Pesticides Council. | ISO/IEC 17025 |
Accreditation and recognition
- An accreditation body within the international mutual recognition arrangements (Global ACI — Global Accreditation Cooperation Incorporated, formerly the IAF MLA): Accreditation of the certification body or laboratory, usually granted in another economy.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Tender and supplier pre-qualification notices published by the Central Bank of Sudan (Central Bank of Sudan): The tenders page lists notices for the national instant payment system, a mobile payment project, building and maintenance works, and the pre-qualification of suppliers of technology equipment and of other service providers. Requirements sit in each notice, and the page shows no general ISO certificate rule.
Economic zones
- Free zones established under the Free Zones and Markets Act 2009: banking and financial services in free zones, trade and logistics
Sterling in Sudan
Sterling delivers in Sudan from its Dubai office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Sudan clients ask
Which Sudanese regulator expects banks to follow ISO/IEC 27001?
The Central Bank of Sudan. Its Cybersecurity Framework for Banks and Financial Institutions, dated January 2026 on its cover, covers all entities under its supervision and tells them to follow relevant international standards, naming ISO 27001, NIST-CSF, SWIFT CSP and the PCI standards as examples. It does not say a certificate is required, so ask your supervisor what evidence it wants.
What does the National Medicines and Poisons Board control?
Under the Medicines and Poisons Act 2009 the Board sets conditions for importing, making, storing, pricing and using medicines, cosmetics and medical supplies. It registers products and foreign supply companies and sets licensing conditions for warehouses, laboratories and factories. Its pages do not name ISO 13485, so ask the Board what a given licence needs.
Is there a national body that sets Sudanese standards?
Yes, the Sudanese Standards and Metrology Organization. It prepares national standards, runs calibration, inspection and hallmarking services under its own acts, and belongs to ISO, IEC and Codex. Its pages do not make a management system certificate compulsory, so a certificate usually answers a buyer, a tender or an export contract instead.
Which laboratory standard do imported pesticide and fertiliser consignments need?
The Standards and Metrology Organization's frequently-asked-questions page lists an accreditation certificate of the testing laboratory under ISO/IEC 17025:2017 among the documents for imported pesticides and fertilisers, next to the test report and origin certificate. Importers should confirm the current document list with the Organization before shipping.
Can an audit in Sudan be held in English?
Often it can, since the Central Bank and the medicines board both run English pages and many managers deal in English with overseas buyers, but Arabic leads at regulators and on most sites. Decide the audit language, the interpreter if one is needed and the language of controlled documents with the certification body at application, and follow your buyer's rule.
Which days should audit dates avoid?
Start with each site's own working week, because the Standards and Metrology Organization publishes daily office hours only. Religious holidays are tied to the lunar calendar and move every year, so audit dates should be agreed with the site and the certification body in good time and never taken from the Gregorian calendar alone.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- The Bank publishes a Cybersecurity Framework for Banks and Financial Institutions (إطار الأمن السيبراني للمصارف والمؤسسات المالية), dated January 2026 on its cover. It covers all entities under the Bank's supervision and puts responsibility for applying it on boards, executive management, information security, IT and risk and compliance officers. Its chapters run from governance and risk management through technical controls, data and information protection, resilience, digital services and card operations to business continuity. A section on industry standards tells entities to follow the latest editions of relevant regulations and international standards, giving ISO 27001, NIST-CSF, SWIFT CSP, PCI PTS, PCI PA-DSS, PCI DSS and EMV as examples. The framework does not state that an ISO certificate is required. — cbos.gov.sd (accessed 18 Oct 2026)
- The Bank lists a regulation organising payment systems business (لائحة تنظيم أعمال نظم الدفع, 2013 edition) and a regulation on licensing and organising mobile-payment financial institutions (2020) among its regulations. The cybersecurity framework names both when it lists the rules that entities must comply with. Its tenders page also carries notices for the national instant payment system and mobile payment projects. — cbos.gov.sd (accessed 18 Oct 2026)
- The Board is the national authority for setting the conditions for importing, manufacturing, controlling, storing, pricing, transporting and using medicines, cosmetics, medical supplies and pharmaceutical preparations under the Medicines and Poisons Act 2009 (قانون الأدوية والسموم لسنة 2009). Its listed powers include registering medicines, cosmetics, medical supplies and poisons, setting the conditions for licensing drug warehouses, pharmaceutical laboratories and drug factories, registering foreign medicine and supply companies, and licensing clinical trials. Its pages do not name ISO 13485 or ISO 9001. — nmpb.gov.sd (accessed 18 Oct 2026)
- The Organization describes itself as the reference body for standards, control, measurement and calibration. Its laws page lists its founding order (2007), the Standards and Metrology Act 2008, the Measurement and Calibration Act 2018 and the Precious Metals and Gemstones Control Act 2008. Its services page lists the preparation of national standards, document checks on goods and services, testing of modified vehicles, hallmarking and licensing for the gold and silver trade, calibration of weighing and measuring instruments, fuel pumps and gas depots, industrial and service inspection and market inspection campaigns. It is a full member of ISO, IEC and the Codex Alimentarius Commission, among other bodies. None of its pages makes a management system certificate compulsory. — ssmo.gov.sd (accessed 18 Oct 2026)
- The Organization's frequently-asked-questions page lists the documents it asks for when checking imported pesticides and fertilisers, among them the test report, the origin certificate and an accreditation certificate of the testing laboratory under ISO/IEC 17025:2017. For pesticides it also lists a form issued by the National Pesticides Council. — ssmo.gov.sd (accessed 18 Oct 2026)
- Tender and supplier pre-qualification notices published by the Central Bank of Sudan — cbos.gov.sd (accessed 18 Oct 2026)
- Free zones established under the Free Zones and Markets Act 2009 — cbos.gov.sd (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Dubai team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
uae@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice