Where we work · United States
ISO and GRC certification consulting in the United States
Achieve ISO and GRC certification in the US with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 23 standards, one team
- Accredited certification route
- New York office team
- Effivity and Academy included
Sectors that ask for certification in the US
Clients include
ISO and GRC certification in the US at a glance
Certification and compliance demand in the United States is driven less by one national law than by layered sector rules, state statutes and customer contracts. Health data sits under the HIPAA Security Rule, administered through the U.S. Department of Health and Human Services. Financial institutions meet the FTC Safeguards Rule and, in New York, the Department of Financial Services' 23 NYCRR Part 500 and the SHIELD Act, while California's CCPA, as amended by the CPRA, adds consumer privacy duties. The FDA's Quality Management System Regulation incorporates ISO 13485:2016 for medical device manufacturers, and Nevada requires card-accepting data collectors to follow PCI DSS. Demand comes mainly from SaaS, cloud and managed-service providers, healthcare and health-tech, financial services and fintech, medical devices, aerospace and defence, food and beverage, federal contractors and automotive suppliers. ISO certificates are issued by accredited certification bodies, with US accreditation available through bodies such as the International Accreditation Service and A2LA; SOC 2 is an attestation by a licensed CPA firm. Sterling's New York office brings 20+ years and 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in the US
Each page covers who needs the standard in the US, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in the US (17)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| HIPAA Security Rule U.S. Department of Health and Human Services (HHS) | Applies to covered entities (health plans, health care clearinghouses and health care providers that transmit health information in electronic form) and their business associates. Requires administrative, physical and technical safeguards to ensure the confidentiality, integrity and availability of electronic protected health information. The HHS page does not mention any certification. | |
| California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA) California Attorney General and California Privacy Protection Agency | State law giving California consumers rights to know, delete, opt out of sale or sharing, correct, and limit the use of sensitive personal information. The Attorney General states that CPRA amends the CCPA and does not create a separate law, and that the Attorney General or the California Privacy Protection Agency may take legal action against non-compliant entities. | |
| Standards for Safeguarding Customer Information (FTC Safeguards Rule) Federal Trade Commission (FTC) | Applies to financial institutions under FTC jurisdiction; they must develop, implement and maintain a comprehensive information security program that is written. Does not cite ISO standards. | |
| New York Stop Hacks and Improve Electronic Data Security Act (SHIELD Act) New York State Attorney General | Expands the private information covered by breach notification and requires companies to develop, implement and maintain reasonable safeguards to protect the security, confidentiality and integrity of private information. | |
| New York State Department of Financial Services (DFS) Banking, insurance and other financial services licensed in New York (covered entities) | 23 NYCRR Part 500 — Cybersecurity Requirements for Financial Services Companies (as amended by the Second Amendment): cybersecurity program, CISO, third-party service provider security policy (500.11), incident response and business continuity management (500.16). The regulation does not cite ISO/IEC 27001 or ISO 22301. | |
| U.S. Food and Drug Administration (FDA) Medical device manufacturers (finished devices intended for commercial distribution in the US) | Quality Management System Regulation (QMSR), 21 CFR Part 820, effective February 2, 2026 — incorporates by reference ISO 13485:2016 and clause 3 of ISO 9000:2015. | ISO 13485 |
| U.S. Department of Agriculture, Food Safety and Inspection Service (FSIS) Meat and poultry establishments | 9 CFR Part 417 — every establishment shall develop and implement a written HACCP plan covering each product whenever a hazard analysis reveals food safety hazards reasonably likely to occur. | HACCP |
| U.S. Food and Drug Administration (FDA) Fish and fishery product processors; juice processors | 21 CFR Part 123 (seafood) and 21 CFR Part 120 (juice) — processors must have and implement a written HACCP plan where the hazard analysis identifies hazards reasonably likely to occur. | HACCP |
| U.S. Food and Drug Administration (FDA) Human food facilities subject to preventive controls | 21 CFR Part 117 (FSMA preventive controls for human food) — a written food safety plan, including a written hazard analysis, prepared or overseen by one or more preventive controls qualified individuals. Does not cite ISO 22000 or FSSC 22000. | |
| U.S. Food and Drug Administration (FDA) Laboratories testing food for FDA purposes (LAAF) | Laboratory Accreditation for Analyses of Foods (21 CFR 1.1138) — for each method, the laboratory is accredited by a recognized accreditation body to ISO/IEC 17025:2017, and passes proficiency testing. | ISO/IEC 17025 |
| State of Nevada (Nevada Revised Statutes) Merchants (data collectors) doing business in Nevada that accept payment cards | NRS Chapter 603A (NRS 603A.215) — a data collector doing business in Nevada that accepts a payment card shall comply with the current version of the PCI Data Security Standard for those transactions. | PCI DSS |
| U.S. Department of Energy (DOE) Industrial and commercial facilities managing energy | 50001 Ready Program — recognises facilities and organisations that attest to the implementation of an ISO 50001-based energy management system; self-paced and no-cost. | ISO 50001 |
| U.S. Environmental Protection Agency (EPA) Organisations managing environmental impacts | EPA guidance 'EMS Under ISO 14001' — describes the repeating cycle of an environmental management system (guidance, not a requirement). | ISO 14001 |
| Occupational Safety and Health Administration (OSHA) Employers (occupational safety and health) | Recommended Practices for Safety and Health Programs — core elements include management leadership, worker participation, hazard identification and assessment, and hazard prevention and control. The page does not cite ISO 45001. | |
| National Institute of Standards and Technology (NIST) Developers and users of artificial intelligence | AI Risk Management Framework (AI RMF), released January 26, 2023 — intended for voluntary use. | |
| Colorado General Assembly / Colorado Attorney General Developers and deployers of high-risk AI systems in Colorado | SB24-205 Consumer Protections for Artificial Intelligence — affirmative defence where the developer, deployer or other person complies with a nationally or internationally recognized risk management framework for AI systems that the act or the attorney general designates; the bill summary does not name ISO/IEC 42001. | |
| U.S. Department of Justice, Criminal Division Corporations under federal criminal investigation (all sectors) | Evaluation of Corporate Compliance Programs (Updated September 2024) — asks whether the compliance program is well designed, adequately resourced and empowered to function effectively, and works in practice; does not cite ISO 37001 or ISO 37301. |
Accreditation and recognition
- American Association for Laboratory Accreditation (A2LA): Accreditation body (US) — ISO/IEC 17025 testing and calibration laboratories, ISO/IEC 17065 product certification bodies, proficiency testing providers, reference material producers and other programmes.
- International Accreditation Service (IAS): Accreditation body (US) — management systems certification bodies, aerospace quality management system certification bodies, personnel certification bodies, testing and calibration laboratories and other programmes.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Cities
Tenders and procurement
- SAM.gov entity registration (U.S. General Services Administration (System for Award Management)): Registration is needed to bid and apply for federal awards as a prime awardee (a Unique Entity ID alone can be requested without registration). The page does not list ISO certificates; any certificate requirement is set in the individual solicitation.
- Higher-level contract quality requirements (FAR 46.202-4) (Federal Acquisition Regulation (federal contracting officers)): Contracting officers may require higher-level contract quality requirements; the regulation's examples of higher-level quality standards include ISO 9001, ASQ/ANSI E4, ASME NQA-1, SAE AS9100, SAE AS9003 and ISO/TS 16949, and product or process specific standards such as SAE AS5553.
Economic zones
- Foreign-Trade Zones (FTZ) programme: warehousing and distribution, production activity (case-by-case authorisation in advance from the FTZ Board)
Sterling in the US
Sterling delivers in the US from its New York office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in United States, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions US clients ask
Is ISO 27001 or SOC 2 more common for US customers?
SOC 2 is the more commonly requested of the two for US customers, with ISO/IEC 27001 in second place among the most requested standards. They are different kinds of assurance: SOC 2 is an attestation by a licensed CPA firm, while ISO/IEC 27001 is a certificate from an accredited certification body. Look at the customer's questionnaire or contract to see which one it names.
Which accreditation should a certification body hold for the US market?
Look for accreditation from the International Accreditation Service (IAS) or the American Association for Laboratory Accreditation (A2LA); each states signatory status in international recognition arrangements. IAS lists management systems certification bodies among its programmes. IAF ceased operations on 1 January 2026 and its functions passed to Global Accreditation Cooperation Incorporated, so check the scope of each recognition before relying on it.
Do US federal contracts require ISO certificates?
Not as a general rule. SAM.gov registration, needed to bid for federal awards as a prime awardee, does not list ISO certificates, so any certificate requirement comes from the individual solicitation. Separately, FAR 46.202-4 lets contracting officers require higher-level quality standards, and ISO 9001 and SAE AS9100 are among its examples. Read the quality clauses of the contract you are bidding for.
Is there a single federal privacy law in the US?
No. Obligations come by sector and by state. HIPAA covers health information, the FTC Safeguards Rule applies to financial institutions under FTC jurisdiction, the CCPA as amended by the CPRA protects California consumers, and New York's SHIELD Act requires reasonable safeguards for private information. Which of them reach you depends on your data and customers, so confirm with your counsel.
Can audits be done remotely across US time zones?
Often in part. Whether remote elements are allowed is at the certification body's discretion under its accreditation rules, so ask at application. Time zones need planning too: the country spans several, and the New York office works on Eastern Time (UTC−5, or UTC−4 during daylight saving time). Agree session times and who joins from where before fieldwork is scheduled.
Cities Sterling covers in the US
Each city page sets out the industries, zones and standards that matter locally.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- HIPAA Security Rule — hhs.gov (accessed 5 Oct 2026)
- California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA) — oag.ca.gov (accessed 5 Oct 2026)
- Standards for Safeguarding Customer Information (FTC Safeguards Rule) — ecfr.gov (accessed 5 Oct 2026)
- New York Stop Hacks and Improve Electronic Data Security Act (SHIELD Act) — ag.ny.gov (accessed 5 Oct 2026)
- 23 NYCRR Part 500 — dfs.ny.gov (accessed 5 Oct 2026)
- Quality Management System Regulation (QMSR), 21 CFR Part 820, effective February 2, 2026 — fda.gov (accessed 5 Oct 2026)
- 9 CFR Part 417 — ecfr.gov (accessed 5 Oct 2026)
- 21 CFR Part 123 (seafood) and 21 CFR Part 120 (juice) — ecfr.gov (accessed 5 Oct 2026)
- 21 CFR Part 117 (FSMA preventive controls for human food) — ecfr.gov (accessed 5 Oct 2026)
- Laboratory Accreditation for Analyses of Foods (21 CFR 1.1138) — ecfr.gov (accessed 5 Oct 2026)
- NRS Chapter 603A (NRS 603A.215) — leg.state.nv.us (accessed 5 Oct 2026)
- 50001 Ready Program — energy.gov (accessed 5 Oct 2026)
- EPA guidance 'EMS Under ISO 14001' — epa.gov (accessed 5 Oct 2026)
- Recommended Practices for Safety and Health Programs — osha.gov (accessed 5 Oct 2026)
- AI Risk Management Framework (AI RMF), released January 26, 2023 — nist.gov (accessed 5 Oct 2026)
- SB24-205 Consumer Protections for Artificial Intelligence — leg.colorado.gov (accessed 5 Oct 2026)
- Evaluation of Corporate Compliance Programs (Updated September 2024) — justice.gov (accessed 5 Oct 2026)
- American Association for Laboratory Accreditation (A2LA) — a2la.org; iaf.nu (accessed 5 Oct 2026)
- International Accreditation Service (IAS) — iasonline.org; iaf.nu (accessed 5 Oct 2026)
- SAM.gov entity registration — sam.gov (accessed 5 Oct 2026)
- Higher-level contract quality requirements (FAR 46.202-4) — acquisition.gov (accessed 5 Oct 2026)
- Foreign-Trade Zones (FTZ) programme — trade.gov (accessed 5 Oct 2026)
Talk to a consultant
Plan your certification with the New York team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
usa@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice