Where we work · United Kingdom
ISO and GRC certification consulting in the United Kingdom
Achieve ISO and GRC certification in the UK with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 23 standards, one team
- Accredited certification route
- London office team
- Effivity and Academy included
Sectors that ask for certification in the UK
Clients include
ISO and GRC certification in the UK at a glance
Certification and compliance demand in the UK comes from a web of regulators and buyers rather than one law. The Information Commissioner's Office oversees the UK GDPR and the Data Protection Act 2018, now being amended in stages by the Data (Use and Access) Act 2025. The Financial Conduct Authority and the Prudential Regulation Authority shape expectations for banks, insurers and their suppliers, while the Medicines and Healthcare products Regulatory Agency, the Environment Agency, the Health and Safety Executive and the Food Standards Agency each set duties for their sectors. Public buyers add their own pull: the Cabinet Office's PPN 014 asks suppliers on in-scope contracts for Cyber Essentials or equivalent controls. Demand is strongest in financial services, insurance and fintech, technology and managed IT services, central government and NHS suppliers, healthcare and medical devices, manufacturing and engineering, food and drink, professional services, and energy and clean technology. Certification is granted by certification bodies accredited by UKAS, the national accreditation body, never by consultants. Sterling's London office brings 20+ years and 8,100+ client engagements in 60+ countries to these programmes, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in the UK
Each page covers who needs the standard in the UK, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in the UK (16)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| UK GDPR and the Data Protection Act 2018 Information Commissioner's Office (ICO) | The UK's general data protection regime. Controllers and processors must implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk (ICO security guidance). The ICO calls Cyber Essentials a good starting point but says organisations may have to go beyond it depending on their processing; ICO-approved certification schemes may be used as an element to demonstrate compliance with the security principle. | |
| Data (Use and Access) Act 2025 Information Commissioner's Office (ICO); policy owned by DSIT and DCMS | Received Royal Assent on 19 June 2025. Amends the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003; the data protection changes are commenced in stages by commencement regulations published on GOV.UK. | |
| EU GDPR for UK organisations serving the EEA EEA supervisory authorities (for EU GDPR); ICO (for UK GDPR) | A UK organisation may need to comply with the EU GDPR if it offers goods or services to people in the EEA or monitors their behaviour; without a base in the EEA it must appoint a representative in the EEA in most circumstances. The renewed EU adequacy decision for the UK under the GDPR is a full adequacy finding, so organisations in the EEA can send personal information to the UK without additional safeguards. | |
| Financial Conduct Authority (FCA) Banks, building societies, PRA-designated investment firms, insurers, Recognised Investment Exchanges, enhanced scope SM&CR firms, payment and e-money institutions, consolidated tape providers | Operational resilience rules (in force 31 March 2022): firms identify important business services, set impact tolerances, map and test; firms had until 31 March 2025 to ensure they could operate their important business services within their impact tolerances. The page does not cite ISO standards. | |
| Prudential Regulation Authority (PRA), Bank of England UK banks, building societies, PRA-designated investment firms, Solvency II insurers and UK branches of overseas banks and insurers | Supervisory Statement SS2/21 Outsourcing and third party risk management (November 2024 version) — due diligence should consider whether service providers can demonstrate certified adherence to recognised, relevant industry standards; certificates and independent reports from service providers may help firms obtain assurance, but firms must assess their adequacy and not assume their mere existence is sufficient. Includes chapters on data security and on business continuity and exit plans. No specific ISO standard is named in these passages. | |
| NHS — Data Security and Protection Toolkit (DSPT) service All organisations with access to NHS patient data and systems, including IT suppliers | DSPT — online self-assessment against the National Data Guardian's 10 data security standards; all organisations that have access to NHS patient data and systems must use it. Does not cite ISO/IEC 27001 on its home page. | |
| Medicines and Healthcare products Regulatory Agency (MHRA); Department of Health and Social Care (designation notices) Medical device manufacturers placing devices on the Great Britain market | Medical Devices Regulations 2002 (S.I. 2002/618). DHSC notice of publication 0129/26 of 17 January 2026 lists EN ISO 13485:2016 (with EN ISO 13485:2016/AC:2018 and EN ISO 13485:2016+A11:2021) as a designated standard for England and Wales and Scotland. Different rules apply in Northern Ireland. | ISO 13485 |
| Food Standards Agency (guidance published on GOV.UK) Food businesses | Food safety management systems for businesses — a food business needs a food safety management system, and it must meet the Hazard Analysis and Critical Control Point (HACCP) principles; there are different rules for HACCP in meat plants. | HACCP |
| Environment Agency Holders of environmental permits (England) | Develop a management system: environmental permits — a permit requires a written management system; an environmental management system may be certified against a standard such as ISO 14001 by a body accredited by a national accreditation body such as UKAS; accredited certification is not a guarantee of permit compliance but may lead to fewer checks from the Environment Agency. Application forms ask whether the system is based on ISO 14001:2015, Green Dragon, BS 8555, BS EN ISO 14005:2019 or EMAS Global. | ISO 14001 |
| Environment Agency (scheme administrator) Large undertakings qualifying for the Energy Savings Opportunity Scheme | Energy Savings Opportunity Scheme (ESOS) — Energy Savings Opportunity Scheme Regulations 2014, as amended 2026. Participants whose ISO 50001 certification covers their total or significant energy consumption, as applicable, do not need to produce an ESOS report or appoint a lead assessor. | ISO 50001 |
| Health and Safety Executive (HSE) All employers (health and safety management) | Managing for health and safety (HSG65, third edition 2013) — lists ISO 45001 and BS EN ISO 9001 among national and international standards an organisation may use, stating it is the organisation's decision whether to use one; asks, if a formal system is used, whether it has been externally certified and whether the certification is accredited. | ISO 45001, ISO 9001 |
| UK Government (NIS Regulations collection on GOV.UK) Operators of essential services and relevant digital service providers | The Security of Network and Information Systems Regulations 2018 (NIS Regulations). The Cyber Security and Resilience (Network and Information Systems) Bill was introduced to Parliament on 12 November 2025 to reform and add to them. | |
| Department for Science, Innovation and Technology (DSIT) Organisations developing or using AI | AI Management Essentials (AIME) — a self-assessment tool to help organisations assess and implement responsible AI management systems and processes; DSIT based the tool on three frameworks: ISO/IEC 42001, the NIST risk management framework and the EU AI Act. | ISO/IEC 42001 |
| Ministry of Justice (statutory guidance) Commercial organisations (anti-bribery) | Bribery Act 2010 guidance — the Act creates four key offences including failure by commercial organisations to prevent bribery by associated persons (section 7); an organisation that can prove it has adequate procedures has a defence. Procedures are built on six principles: proportionality, top-level commitment, risk assessment, due diligence, communication (training), monitoring and review. The guidance does not name ISO 37001. | |
| Home Office (guidance) Large incorporated bodies, subsidiaries, partnerships and large incorporated not-for-profit organisations | Economic Crime and Corporate Transparency Act 2023 — offence of failure to prevent fraud, which came into effect on 1 September 2025; an organisation is liable where a specified fraud offence is committed by an associated person for its benefit and it did not have reasonable fraud prevention procedures in place. | |
| Cabinet Office Category 1 responders (emergency services, local authorities, NHS bodies) | Civil Contingencies Act — Category 1 responders must, among other duties, put in place business continuity management arrangements; local authorities also provide business continuity advice to businesses and voluntary organisations. ISO 22301 is not cited on the page. |
Accreditation and recognition
- United Kingdom Accreditation Service (UKAS): National accreditation body — appointed as the UK's sole national accreditation body under the Accreditation Regulations 2009; the Government will only recognise accreditation of UK conformity assessment bodies by UKAS.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Cities
Tenders and procurement
- PPN 014: Cyber Essentials scheme (Cabinet Office): Applies to central government departments, their executive agencies, non-departmental public bodies and NHS bodies. For contracts where citizens' personal information or government employees' personal information is handled by a supplier, or where ICT systems and services designed to store or process data at OFFICIAL level are supplied, suppliers must demonstrate certain technical requirements; the quickest means is Cyber Essentials or Cyber Essentials Plus certification, renewed annually for the duration of the contract, or equivalent controls. In-scope organisations must not take a blanket approach. Updated for the Procurement Act 2023; for procurements commenced or contracts awarded before 24 February 2025 the PPN refers to PPN 09/23. The policy dates from PPN 09/14 (2014).
- Procurement Act 2023 — conditions of participation (Cabinet Office (Procurement Act 2023 guidance)): Conditions of participation can include qualifications, experience or technical ability, but a condition cannot require particular qualifications without allowing for their equivalents. The Act does not list ISO certificates; individual procurements set their own conditions.
- PPN 006: Taking account of Carbon Reduction Plans in the procurement of major government contracts (Cabinet Office): Sets out how to take account of Carbon Reduction Plans in the procurement of major central government contracts, with a technical standard and template for completing the plan. The publication page does not cite ISO 14001.
Economic zones
- Freeport East: ports and logistics, advanced manufacturing, digital and technologies, clean energy industries, defence
- Thames Freeport: advanced manufacturing, clean energy technologies, logistics
- Solent Freeport: maritime, advanced manufacturing including aerospace, automotive and electronics
- Liverpool City Region Freeport: advanced manufacturing, health and life sciences, biomanufacturing, digital and creative
- Humber Freeport: clean energy, advanced manufacturing, food and agri-tech
- Teesside Freeport: chemicals, biomanufacturing, low carbon, offshore wind and hydrogen manufacturing
- Plymouth and South Devon Freeport: marine and marine autonomy, defence, advanced engineering, net zero technologies, space
Sterling in the UK
Sterling delivers in the UK from its London office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in United Kingdom, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions UK clients ask
Do UK government contracts require Cyber Essentials?
Not for every contract. PPN 014 from the Cabinet Office covers central government departments, their executive agencies, non-departmental public bodies and NHS bodies. It points to Cyber Essentials or Cyber Essentials Plus, renewed annually for the contract's duration, where a supplier handles citizens' or government employees' personal information, or supplies ICT systems designed to store or process OFFICIAL data. Equivalent controls are accepted, and in-scope bodies must not take a blanket approach. Read each tender's own terms.
Does a UK company need to comply with both the UK GDPR and the EU GDPR?
It may need both, because the two regimes cover different activity. The UK GDPR, set out through the Data Protection Act 2018, is the general UK regime, with the ICO as regulator. The EU GDPR also reaches a UK organisation that offers goods or services to people in the EEA or monitors their behaviour. Without an EEA base, it must in most circumstances appoint an EEA representative. Confirm your own position with your counsel.
Which accreditation should a certification body hold in the UK?
Look for UKAS, appointed under the Accreditation Regulations 2009 as the UK's sole national accreditation body. The Government will only recognise accreditation of UK conformity assessment bodies by UKAS. UKAS belongs to the European co-operation for Accreditation and to Global Accreditation Cooperation Incorporated. So the test is accreditation within the international mutual recognition arrangements, the IAF MLA, whose functions passed to Global ACI in 2026.
Has the Data (Use and Access) Act 2025 changed UK data protection law?
Yes, it amends it. The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025 and changes the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003. Those data protection changes are commenced in stages by regulations published on GOV.UK, so what applies depends on the commencement position at the time. Check it with your counsel or the ICO before relying on it.
Can a public tender insist on one particular certificate?
Not without allowing equivalents. Under the Procurement Act 2023 guidance, buyers may set qualifications, experience or technical ability as conditions of participation, but may not demand particular qualifications while ignoring their equivalents. The Act itself does not list ISO certificates, and each procurement sets its own conditions. If a tender names a single certificate, ask the buyer how equivalents will be assessed, and confirm your rights with your counsel.
Do bank holidays affect audit scheduling across the UK?
Yes, they can. Bank holidays differ between England and Wales, Scotland and Northern Ireland, so there is no single UK-wide pattern to plan around. For a multi-site scope, check the calendar for each site individually, and never work from fixed dates remembered from another year. The GOV.UK bank holidays page is the reference to use when you build the audit programme.
Cities Sterling covers in the UK
Each city page sets out the industries, zones and standards that matter locally.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- UK GDPR and the Data Protection Act 2018 — legislation.gov.uk; ico.org.uk (accessed 5 Oct 2026)
- Data (Use and Access) Act 2025 — gov.uk; legislation.gov.uk (accessed 5 Oct 2026)
- EU GDPR for UK organisations serving the EEA — ico.org.uk (accessed 5 Oct 2026)
- Operational resilience rules (in force 31 March 2022): firms identify important business services, set impact tolerances, map and test; firms had until 31 March 2025 to ensure they could operate their important business services within their impact tolerances. The page does not cite ISO standards. — fca.org.uk (accessed 5 Oct 2026)
- Supervisory Statement SS2/21 Outsourcing and third party risk management (November 2024 version) — bankofengland.co.uk (accessed 5 Oct 2026)
- DSPT — dsptoolkit.nhs.uk (accessed 5 Oct 2026)
- Medical Devices Regulations 2002 (S.I. 2002/618). DHSC notice of publication 0129/26 of 17 January 2026 lists EN ISO 13485:2016 (with EN ISO 13485:2016/AC:2018 and EN ISO 13485:2016+A11:2021) as a designated standard for England and Wales and Scotland. Different rules apply in Northern Ireland. — assets.publishing.service.gov.uk; gov.uk (accessed 5 Oct 2026)
- Food safety management systems for businesses — gov.uk (accessed 5 Oct 2026)
- Develop a management system: environmental permits — gov.uk (accessed 5 Oct 2026)
- Energy Savings Opportunity Scheme (ESOS) — gov.uk (accessed 5 Oct 2026)
- Managing for health and safety (HSG65, third edition 2013) — hse.gov.uk (accessed 5 Oct 2026)
- The Security of Network and Information Systems Regulations 2018 (NIS Regulations). The Cyber Security and Resilience (Network and Information Systems) Bill was introduced to Parliament on 12 November 2025 to reform and add to them. — gov.uk (accessed 5 Oct 2026)
- AI Management Essentials (AIME) — gov.uk (accessed 5 Oct 2026)
- Bribery Act 2010 guidance — gov.uk (accessed 5 Oct 2026)
- Economic Crime and Corporate Transparency Act 2023 — gov.uk (accessed 5 Oct 2026)
- Civil Contingencies Act — gov.uk (accessed 5 Oct 2026)
- United Kingdom Accreditation Service (UKAS) — ukas.com (accessed 5 Oct 2026)
- PPN 014: Cyber Essentials scheme — gov.uk (accessed 5 Oct 2026)
- Procurement Act 2023 — conditions of participation — gov.uk (accessed 5 Oct 2026)
- PPN 006: Taking account of Carbon Reduction Plans in the procurement of major government contracts — gov.uk (accessed 5 Oct 2026)
- Freeport East — ukfreeports.campaign.gov.uk (accessed 5 Oct 2026)
- Thames Freeport — ukfreeports.campaign.gov.uk (accessed 5 Oct 2026)
- Solent Freeport — ukfreeports.campaign.gov.uk (accessed 5 Oct 2026)
- Liverpool City Region Freeport — ukfreeports.campaign.gov.uk (accessed 5 Oct 2026)
- Humber Freeport — ukfreeports.campaign.gov.uk (accessed 5 Oct 2026)
- Teesside Freeport — ukfreeports.campaign.gov.uk (accessed 5 Oct 2026)
- Plymouth and South Devon Freeport — ukfreeports.campaign.gov.uk (accessed 5 Oct 2026)
Talk to a consultant
Plan your certification with the London team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
uk@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice