Where we work · Cambodia
ISO and GRC certification consulting in Cambodia
Achieve ISO and GRC certification in Cambodia with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 20 standards, one team
- Accredited certification route
- Ho Chi Minh City office team
- Effivity and Academy included
Sectors that ask for certification in Cambodia
Clients include
ISO and GRC certification in Cambodia at a glance
Cambodia's quality and compliance picture is shaped by export buyers, a growing accreditation system and a few sector laws. The Institute of Standards of Cambodia develops national standards under the Law on Standards of Cambodia, while the General Department of Accreditation of Cambodia, within the Ministry of Industry, Science, Technology and Innovation, accredits laboratories, inspection bodies and certification bodies and is an ILAC signatory for testing laboratories. Food businesses meet the Law on Food Safety and the Law on the Management of Quality and Safety of Products and Services, banks answer to the National Bank of Cambodia's technology risk supervision, and employers fall under the Labour Law's health and safety chapter. Garments, footwear and travel goods, agri-food, electronics, automotive and bicycle parts, furniture and wood products, banking and tourism generate most of the demand, and the Council for the Development of Cambodia reports 26 operating special economic zones as of the first half of 2024. Certificates come from accredited certification bodies, never from Sterling. Sterling's Ho Chi Minh City office serves clients in Cambodia, bringing 8,100+ client engagements in 60+ countries and 20+ years of experience, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Cambodia
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Cambodia (8)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| National Bank of Cambodia (NBC), Technology Risk and Innovation Supervision Department Banks, microfinance institutions and payment firms | The Department formulates regulations on technology risk management of banks and financial institutions, examines their technology and innovation risks for security and cybersecurity resilience, monitors business continuity plans, and monitors the risk management practices of third-party service providers. NBC also publishes a prakas on operational risk for capital adequacy ratios (16 August 2024) and a prakas amending the rules for third-party processors (6 December 2019). The Department's page names no ISO standard. | |
| Ministry of Health; Ministry of Commerce inspection agents Food businesses and food importers | Law on Food Safety (listed by the Ministry of Health with the date 8 June 2022) and the Law on the Management of Quality and Safety of Products and Services (Reach Kram NS/RKM/0600/001, ratified by the National Assembly on 29 May 2000 and the Senate on 2 June 2000), which bars food known to be contaminated, toxic or below bacteriological or sanitary requirements from commerce, requires Khmer-language labelling and gives Ministry of Commerce inspection agents powers of inspection. The Law on the Management of Quality and Safety of Products and Services does not name HACCP or ISO 22000; confirm with the Ministry of Health which rules implement the Law on Food Safety. | |
| Ministry of Agriculture, Forestry and Fisheries (MAFF) Agriculture, animal products and fisheries | MAFF's site lists general directorates for agriculture, animal health and production and fisheries, and a department of agro-industry; confirm the export and processing rules that apply to your product with the directorate concerned. | |
| Ministry of Labour and Vocational Training (MLVT) Employers and workplaces | Labour Law (1997), Chapter VIII on health and safety of workers: applies to enterprises of any kind covered by the Law, requires clean and hygienic workplaces, requires machinery and tools to be installed and maintained in the best possible safety conditions, and has the labour ministry and other ministries prepare prakas on enforcement. The Law names no ISO standard. | |
| Ministry of Environment Projects and activities with environmental impact | Law on Environmental Protection and Natural Resource Management (1996): an environmental impact assessment is required for every project and activity, private or public, and is reviewed by the Ministry of Environment; the process is set by Sub-Decree No. 72 on the Environmental Impact Assessment Process (1999). The Law names no ISO standard. | |
| Ministry of Health Medicines and private medical practice | The Ministry publishes the Law on the Management of Pharmaceuticals with its amendment, and the Law on the Management of Private Medical, Paramedical and Medical Aid Practice. The Ministry's list does not name ISO 13485 or any other ISO standard. | |
| Council for the Development of Cambodia (CDC) Investors and exporters seeking incentives | Law on Investment (2021) and Sub-Decree No. 139 of 26 June 2023 on its implementation: Qualified Investment Projects receive incentives, and the Law lists the sectors and activities entitled to them, including industries supplying regional and global production chains, agro-processing and food processing, electrical and electronic industries, digital industries, health, tourism, environmental management and the circular economy, and green energy. CDC names agri-food, automotive, electronics, textile and apparel, bicycles and parts, and furniture, veneer and plywood as priority sectors. | |
| Ministry of Post and Telecommunications (MPTC) Digital economy, ICT and cybersecurity | Cambodia Digital Economy and Society Policy Framework 2021–2035, published by MPTC on 14 June 2023: two foundations (infrastructure, and trust and confidence in the digital system) and three pillars (digital citizens, digital government and digital businesses), with a Digital Security Committee for security in the digital space. MPTC also ran ISO/IEC 27001 Lead Implementer training for ministry technical officials in May 2025 under a project supported by the Japan International Cooperation Agency. | ISO/IEC 27001 |
Accreditation and recognition
- General Department of Accreditation of Cambodia (GDAC), working under the Cambodian Accreditation National Council (CANC): National accreditation authority for conformity assessment bodies, within the Ministry of Industry, Science, Technology and Innovation (MISTI): testing and calibration laboratories (ISO/IEC 17025), medical laboratories (ISO 15189), product certification bodies (ISO/IEC 17065), management system certification bodies (ISO/IEC 17021), validation and verification bodies and inspection bodies (ISO/IEC 17020); GDAC's site publishes lists of accredited laboratories, medical laboratories, certification bodies and inspection bodies. Its certification body list has fields for personnel, EMS, FSMS, product and QMS.
- Institute of Standards of Cambodia (ISC): National standards body provided for by the Law on Standards of Cambodia (Royal Kram NS/RKM/0607/013, 24 June 2007): develops national standards, with a National Standards Council for which the Institute acts as secretariat; Cambodian Standards are issued by ministerial prakas, and a standard can be made mandatory on the proposal of the ministries concerned.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Suppliers Database with Sustainability Dimensions (SD2) (Council for the Development of Cambodia (CDC)): Domestic suppliers register in the database to be found by investors and foreign firms; registered companies can highlight and verify sustainability dimensions, and need meet at least one of the six rather than all. Individual buyers set their own supplier evidence, so check what each customer or tender asks for.
Economic zones
- Special economic zones overseen by the Council for the Development of Cambodia: furniture, veneer and wood products, automotive and electronic products, heavy industry such as car-tyre manufacturing
Sterling in Cambodia
Sterling delivers in Cambodia from its Ho Chi Minh City office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Cambodia clients ask
Who accredits certification and testing bodies in Cambodia?
The General Department of Accreditation of Cambodia, known as GDAC, works under the Cambodian Accreditation National Council and sits within the Ministry of Industry, Science, Technology and Innovation. It is the national accreditation authority for laboratories, inspection bodies and certification bodies, and ILAC lists it as an arrangement signatory for testing laboratories. Always check the scope on any body's accreditation certificate.
Can a Cambodian laboratory be accredited locally to ISO/IEC 17025?
Yes. GDAC accredits testing and calibration laboratories to ISO/IEC 17025, and since August 2023 it has been an ILAC signatory for testing, which supports recognition of accredited test results abroad. Other scopes may stand differently, so ask GDAC for the scope of any laboratory you rely on. Accreditation is GDAC's decision, never Sterling's.
Which laws set food safety expectations in Cambodia?
Two instruments matter most. The Ministry of Health lists a Law on Food Safety dated 8 June 2022, and the Law on the Management of Quality and Safety of Products and Services bars contaminated food from commerce and requires Khmer labelling, enforced by Ministry of Commerce inspectors. The quality and safety law names neither HACCP nor ISO 22000, so check the food law's implementing rules with the Ministry of Health.
Are audits in Cambodia run in English or Khmer?
Either can be agreed. Statutes are in Khmer, and the English translations the Council for the Development of Cambodia publishes are unofficial, with the Khmer text prevailing. Product labels must carry Khmer safety information. Agree the audit language, any interpreter and the language of controlled documents with the certification body when you apply, so the audit team fits your site.
What does the National Bank of Cambodia expect on technology risk?
Its Technology Risk and Innovation Supervision Department writes technology risk regulations and examines banks and financial institutions on security and cybersecurity resilience, business continuity plans and third-party service providers. The Department's page names no ISO standard, so ISO 27001 and ISO 22301 serve as recognised evidence rather than a stated requirement. Confirm supervisory expectations with the National Bank.
Which sectors drive certification demand in Cambodia?
Export manufacturing carries most of it: the Council for the Development of Cambodia says garments, footwear and travel goods made up 62.26% of all exports as of December 2023. Agri-food, electronics, automotive and bicycle parts, furniture and wood products, banks and tourism add more. Each buyer sets its own supplier requirements, so ask your customers which standards they expect.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- The Department formulates regulations on technology risk management of banks and financial institutions, examines their technology and innovation risks for security and cybersecurity resilience, monitors business continuity plans, and monitors the risk management practices of third-party service providers. NBC also publishes a prakas on operational risk for capital adequacy ratios (16 August 2024) and a prakas amending the rules for third-party processors (6 December 2019). The Department's page names no ISO standard. — nbc.gov.kh (accessed 18 Oct 2026)
- Law on Food Safety (listed by the Ministry of Health with the date 8 June 2022) and the Law on the Management of Quality and Safety of Products and Services (Reach Kram NS/RKM/0600/001, ratified by the National Assembly on 29 May 2000 and the Senate on 2 June 2000), which bars food known to be contaminated, toxic or below bacteriological or sanitary requirements from commerce, requires Khmer-language labelling and gives Ministry of Commerce inspection agents powers of inspection. The Law on the Management of Quality and Safety of Products and Services does not name HACCP or ISO 22000; confirm with the Ministry of Health which rules implement the Law on Food Safety. — cdc.gov.kh; moh.gov.kh (accessed 18 Oct 2026)
- MAFF's site lists general directorates for agriculture, animal health and production and fisheries, and a department of agro-industry; confirm the export and processing rules that apply to your product with the directorate concerned. — maff.gov.kh (accessed 18 Oct 2026)
- Labour Law (1997), Chapter VIII on health and safety of workers: applies to enterprises of any kind covered by the Law, requires clean and hygienic workplaces, requires machinery and tools to be installed and maintained in the best possible safety conditions, and has the labour ministry and other ministries prepare prakas on enforcement. The Law names no ISO standard. — cdc.gov.kh (accessed 18 Oct 2026)
- Law on Environmental Protection and Natural Resource Management (1996): an environmental impact assessment is required for every project and activity, private or public, and is reviewed by the Ministry of Environment; the process is set by Sub-Decree No. 72 on the Environmental Impact Assessment Process (1999). The Law names no ISO standard. — cdc.gov.kh (accessed 18 Oct 2026)
- The Ministry publishes the Law on the Management of Pharmaceuticals with its amendment, and the Law on the Management of Private Medical, Paramedical and Medical Aid Practice. The Ministry's list does not name ISO 13485 or any other ISO standard. — moh.gov.kh (accessed 18 Oct 2026)
- Law on Investment (2021) and Sub-Decree No. 139 of 26 June 2023 on its implementation: Qualified Investment Projects receive incentives, and the Law lists the sectors and activities entitled to them, including industries supplying regional and global production chains, agro-processing and food processing, electrical and electronic industries, digital industries, health, tourism, environmental management and the circular economy, and green energy. CDC names agri-food, automotive, electronics, textile and apparel, bicycles and parts, and furniture, veneer and plywood as priority sectors. — cdc.gov.kh (accessed 18 Oct 2026)
- Cambodia Digital Economy and Society Policy Framework 2021–2035, published by MPTC on 14 June 2023: two foundations (infrastructure, and trust and confidence in the digital system) and three pillars (digital citizens, digital government and digital businesses), with a Digital Security Committee for security in the digital space. MPTC also ran ISO/IEC 27001 Lead Implementer training for ministry technical officials in May 2025 under a project supported by the Japan International Cooperation Agency. — mptc.gov.kh; asset.cambodia.gov.kh (accessed 18 Oct 2026)
- General Department of Accreditation of Cambodia (GDAC), working under the Cambodian Accreditation National Council (CANC) — da-canc.gov.kh; global-aci.org; ilac.org (accessed 18 Oct 2026)
- Institute of Standards of Cambodia (ISC) — cdc.gov.kh (accessed 18 Oct 2026)
- Suppliers Database with Sustainability Dimensions (SD2) — sd2.cdc.gov.kh (accessed 18 Oct 2026)
- Special economic zones overseen by the Council for the Development of Cambodia — cdc.gov.kh (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Ho Chi Minh City team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
vietnam@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice