Where we work · Colombia

ISO and GRC certification consulting in Colombia

Achieve ISO and GRC certification in Colombia with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.

Request a discovery call See all 21 standards

21 standards, one team
Accredited certification route
New York office team
Effivity and Academy included

Sectors that ask for certification in Colombia

Agribusiness, food and beverage processors and exporters
Manufacturers, including automotive, aeronautical, naval and building materials
Energy and extractive industries and their suppliers
Healthcare, pharmaceutical, cosmetics and life sciences firms
Banks, fintechs and payment firms
Business-process outsourcing, shared-service and software firms serving overseas clients

Clients include

Talk to the New York office

We call youA Sterling consultant replies within one working day.
Scope and proposalAgreed on the call; no proposal before the scope is clear.
CertificationOne team takes you through to the independent audit.

In short

ISO and GRC certification in Colombia at a glance

Colombia's data protection regime is run by the Superintendencia de Industria y Comercio under Ley Estatutaria 1581 de 2012, and most compliance conversations start there. Accreditation is just as centralised: the compiled Decreto 1074 de 2015 gives the Organismo Nacional de Acreditación de Colombia, ONAC, the exclusive accreditation role, and Global ACI lists ONAC as a full member and mutual recognition signatory. Other rules shape demand directly. Decreto 1072 de 2015 makes an occupational safety and health management system obligatory for employers, the digital citizen services rules accept a certifiable information security management system, INVIMA supervises food and medical device manufacture, and the Superintendencia de Sociedades promotes anti-bribery programmes under Ley 1778 de 2016. Demand comes from food and agribusiness exporters, manufacturers, energy operators, financial institutions, outsourcing and software firms, and suppliers to public bodies. Certificates are issued by accredited certification bodies, never by Sterling. Sterling's New York office serves clients in Colombia on-site where the work needs it and remotely otherwise, bringing 20+ years and 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included with the engagement.

Explore

ISO and GRC standards Sterling delivers in Colombia

Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.

Regulators and laws that drive certification in Colombia (12)

Law or regulator	What it asks for	Standards it cites
Ley Estatutaria 1581 de 2012 — general provisions for the protection of personal data (habeas data), with its regulations compiled in Decreto 1074 de 2015 Superintendencia de Industria y Comercio (SIC), through its Delegatura para la Protección de Datos Personales (article 19 of the law). Where Ley 1266 de 2008 applies to an entity supervised by the Superintendencia Financiera de Colombia, that body supervises and enforces.	Applies to personal data in databases processed by public or private entities, to processing in Colombia and to foreign controllers subject to Colombian law; purely personal or household databases and several others are excluded. Sets the principles of legality, purpose, freedom, accuracy, transparency, restricted access, security and confidentiality; requires prior, informed authorisation obtainable by any means that allows later consultation, with listed exceptions; prohibits processing of sensitive data except in listed cases and limits the processing of children's data; requires controllers to tell the data subject the purpose, the rights and the controller's contact details when asking for consent; gives data subjects rights to know, update, correct, request proof of authorisation, complain to the SIC, revoke authorisation or request deletion where principles are not respected, and access data free of charge. Controllers must adopt an internal manual of policies and procedures, keep proof of authorisations, secure the data and inform the SIC of security-code violations that create risks; processors owe parallel duties. The decree adds that controllers must be able to show the SIC, in proportion to their size and the risks, that they have effective measures and policies, and requires a published treatment policy and, where it cannot be shown, a privacy notice at the latest when data is collected. International transfers to countries without an adequate level of protection are prohibited except in listed cases, and the SIC can issue declarations of conformity. Controllers that are companies or non-profit entities with total assets above 100,000 Tax Value Units (UVT), and public legal persons, must register each database in the Registro Nacional de Bases de Datos. The law creates no certificate and cites no ISO standard. Enforcement measures and their amounts are set in the law and are not restated here.
Ley Estatutaria 1266 de 2008 — general provisions on habeas data and the management of financial, credit, commercial and services information Superintendencia de Industria y Comercio for operators, sources and users of the data it governs; the Superintendencia Financiera de Colombia where the operator, source or user is an entity it supervises.	Regulates personal data held in databanks, public or private, focused on financial, credit, commercial and services information and information from third countries; excludes data for purely personal or domestic use and some others. It sits alongside Ley 1581 de 2012, which excludes databases governed by it.
Ministerio de Comercio, Industria y Turismo (sector decree), with the Organismo Nacional de Acreditación de Colombia (ONAC) as the national accreditation body Quality infrastructure, accreditation and conformity assessment (all sectors)	Decreto 1074 de 2015, Part 2, Title 1, Chapter 7 (Subsistema Nacional de la Calidad). It defines accreditation as a third-party statement formally demonstrating a conformity assessment body's competence, says the activity is exercised exclusively by ONAC and that public entities which accredit are coordinated by ONAC, and requires producers and importers of products under technical regulations to obtain a certificate of conformity from a certification body accredited by ONAC or, on stated conditions, from a foreign body accredited within recognised multilateral recognition arrangements. Tests behind those certificates are run in laboratories accredited by bodies within such arrangements. The compiled decree separately names the national standardisation body as the Government's adviser and coordinator on technical standardisation.
Ministerio del Trabajo Occupational safety and health (all employers)	Decreto 1072 de 2015, Chapter 2.2.4.6 (Sistema de Gestión de la Seguridad y Salud en el Trabajo, SG-SST). The chapter sets mandatory directives for all public and private employers, contracting parties, cooperatives and temporary-service companies, covering employees, contractors, cooperative members and workers on assignment; the Ministry defines the minimum standards used to verify implementation (the compiled text points to Resolución 312 de 2019); article 2.2.4.6.25 requires an emergency prevention, preparedness and response plan covering all sites and shifts, including contractors, suppliers and visitors; Chapter 12, added by Decreto 1347 de 2021, adopts a major-accident prevention programme for classified installations holding listed chemical substances. The decree does not mention ISO 45001.
Autoridad Nacional de Licencias Ambientales (ANLA) and the competent environmental authorities, under the Ministerio de Ambiente y Desarrollo Sostenible Industry and activities with environmental impact	Decreto 1076 de 2015 (sector decree for the environment). It describes ANLA as the body ensuring that projects, works or activities subject to licensing, permit or environmental procedure meet the national environmental requirements, and sets the environmental licence procedure with its environmental impact study. An article added by Decreto 766 de 2026 requires the laboratory tests used to determine whether a waste is hazardous to be accredited by IDEAM under ISO/IEC 17025 (latest edition), and accepts foreign laboratories accredited within recognised multilateral recognition arrangements where no national laboratory has the method in its scope. The decree does not mention ISO 14001.	ISO/IEC 17025
Ministerio de Salud y Protección Social, with the Instituto Nacional de Vigilancia de Medicamentos y Alimentos (INVIMA) as sanitary authority Food, beverage and food-supplement manufacture	Resolución 2674 de 2013, which regulates article 126 of Decreto Ley 019 de 2012 and sets the sanitary requirements for people and firms that manufacture, process, prepare, pack, store, transport, distribute, import, export and sell food and food raw materials, and the requirements for sanitary notification, permit or registration. Article 22 says every food factory must have a control system and that the person in charge may apply HACCP, or another system giving similar results that can be shown to the competent health authority; where HACCP is adopted it must be implemented under its general principles. INVIMA describes itself as Colombia's sanitary authority for medicines, foods, medical devices and other products.	HACCP
Instituto Nacional de Vigilancia de Medicamentos y Alimentos (INVIMA), Ministerio de Salud y Protección Social Medical devices (manufacture, storage and import)	Decreto 4725 de 2005, the regime of sanitary registrations, marketing permits and sanitary surveillance of medical devices for human use. Establishments that manufacture, semi-process, fill and pack devices must comply with the Good Manufacturing Practices for medical devices issued by the Ministry; INVIMA issues the Certificate of Compliance with Good Manufacturing Practices and checks implementation through periodic visits, and issues the Certificate of Storage and Conditioning Capacity for importers and sellers. The decree does not mention ISO 13485.
Ministerio de Tecnologías de la Información y las Comunicaciones (MinTIC) Digital government and providers of digital citizen services	Decreto 1078 de 2015, Title 17 (guidelines for the use and operation of the servicios ciudadanos digitales). It binds public administration bodies and private persons exercising public functions, and article 2.2.17.6.6 says actors processing information under the title must adopt appropriate, effective and verifiable security measures that let them show compliance with the good practices of the information security and privacy model issued by MinTIC, or with a certifiable information security management system. It names no standard.
Superintendencia Financiera de Colombia (SFC) Banks and other financial institutions	The SFC publishes information security and cybersecurity indicators for banks (investment, incident management and vulnerabilities) and, in a 2026 special publication, a supervision exercise on artificial intelligence and machine learning in credit risk management: of 47 credit institutions with loans current at March 2025, 38 reported using such models, with an inventory of 346 models. The publication states that its opinions are not an official SFC position. Its binding circulars set the expectations for each licence and should be read from the SFC.
Superintendencia de Sociedades and other supervisory authorities Anti-bribery and corporate integrity	Ley 1778 de 2016, article 23, has the Superintendencia de Sociedades promote transparency and business ethics programmes, with internal audit rules and mechanisms to prevent transnational bribery, among companies it supervises, and article 7 lists the existence, implementation and effectiveness of such programmes among the criteria for grading the enforcement response. Ley 2195 de 2022, article 9, provides that legal entities under the supervision of a superintendency or other authority adopt transparency and business ethics programmes, with content set by the authority according to sector, risks, assets, income, staff and corporate purpose, which may be integrated with an existing risk management system.
Unidad de Planeación Minero-Energética (UPME) with the energy, environment and finance ministries Energy efficiency and non-conventional energy	Ley 1715 de 2014 promotes efficient energy management and the programme PROURE; UPME evaluates and certifies that investments qualify for the tax and tariff benefits the law grants for efficiency measures. UPME's energy efficiency page records an industrial energy efficiency project that built capacity in energy management systems and links to the PROURE action plan 2022-2030. The law and the page do not require ISO 50001.
Instituto Colombiano Agropecuario (ICA) Agricultural primary production and exports	ICA's portal shows work on animal and plant health, safety of primary agricultural production and agricultural inputs, border control and import and export procedures, including a certificate section and the foreign-trade single window. ICA's pages do not name ISO 22000 or HACCP.

Accreditation and recognition

Organismo Nacional de Acreditación de Colombia (ONAC): National accreditation body — ONAC states on its site that it is a corporation belonging to the Subsistema Nacional de la Calidad, of private character, mixed nature and without profit, set up under Colombian law; Decreto 1074 de 2015 says the accreditation activity is exercised exclusively by ONAC. Its site lists schemes for management system certification bodies under ISO/IEC 17021-1, testing and calibration laboratories under ISO/IEC 17025, inspection bodies, product certification, persons certification, clinical laboratories, proficiency testing and greenhouse-gas validation and verification, and shows recognition logos for the ILAC MRA, the IAAC and the international arrangement for management systems certification.

Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.

Tenders and procurement

Public procurement through SECOP II and the Registro Único de Proponentes (RUP) (Agencia Nacional de Contratación Pública – Colombia Compra Eficiente (SECOP II and the Tienda Virtual del Estado Colombiano); the chambers of commerce keep the RUP): The agency's RUP page defines the Registro Único de Proponentes as the bidders' registry kept by the chambers of commerce, in which people who want to take part in procurement processes must be registered. Neither the RUP page nor the agency's home page names ISO certificates as a condition, so the process documents of each tender set the quality and security requirements.
Transparency and business ethics programmes for suppliers under supervision (Superintendencia de Sociedades and other supervisory authorities, under Ley 2195 de 2022 and Ley 1778 de 2016): Companies under the supervision of a superintendency or other authority must adopt transparency and business ethics programmes whose content the authority sets by sector, risk, assets, income, staff and purpose; the statutory auditor, where there is one, evaluates the programme and issues an opinion. The law does not name ISO 37001 or ISO 37301.

Economic zones

Zonas francas (free trade zones, multi-user and single-company):

Sterling in Colombia

Sterling delivers in Colombia from its New York office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.

Questions Colombia clients ask

Who regulates personal data protection in Colombia?

The Superintendencia de Industria y Comercio, through its Delegatura para la Protección de Datos Personales, oversees Ley Estatutaria 1581 de 2012, investigating, ordering corrective measures, issuing instructions and running the Registro Nacional de Bases de Datos. Credit and financial information under Ley 1266 de 2008 follows a split, with the Superintendencia Financiera de Colombia supervising entities it already supervises. Confirm your own case with counsel or the authority.

Which body accredits certification bodies in Colombia?

ONAC, the Organismo Nacional de Acreditación de Colombia, is the national body: Decreto 1074 de 2015 says the accreditation activity is exercised exclusively by it. Global ACI lists it as a full member and mutual recognition signatory, with entries for ISO 9001, 14001, 22000, 27001, 13485, 45001, 50001, FSSC 22000 and 37001 dated between 2015 and 2026. Ask each certification body for its accreditation certificate and scope.

Are certification audits in Colombia conducted in English?

Frequently, where the client is a multinational or exporter, though Spanish remains the official language and the language of Colombian laws, decrees, tenders and regulatory filings. When you apply, settle the audit language, the use of an interpreter and the language of controlled documents with the certification body, and flag early any interviews that will take place in Spanish on the shop floor.

Is an occupational safety and health management system compulsory in Colombia?

A national system is: Decreto 1072 de 2015 makes the Sistema de Gestión de la Seguridad y Salud en el Trabajo obligatory for public and private employers, contracting parties and cooperatives, and the Ministry of Labour sets the minimum standards used to check it. The decree does not mention ISO 45001, so a certificate is a separate, voluntary step that customers may ask for.

Do Colombian public tenders require ISO certificates?

Not through a blanket rule that the procurement agency's pages state. Bidders register in the Registro Único de Proponentes, which the chambers of commerce keep, and compete through SECOP II. Neither the registry page nor the agency's home page names ISO certificates as a condition, so each tender's process documents set the quality and security requirements. Read the technical requirements of each tender before deciding.

Does Colombia's digital government rule accept an ISO 27001 certificate?

It accepts a certifiable information security management system, although it does not name ISO/IEC 27001. For the digital citizen services framework, Decreto 1078 de 2015 asks actors to adopt appropriate, effective and verifiable security measures, shown either through the information security and privacy model of the ICT ministry or through a certifiable management system. Check the requirements in your contract.

Next step

Start with a free discovery call

A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.

Book a discovery call

Sources

Ley Estatutaria 1581 de 2012 — general provisions for the protection of personal data (habeas data), with its regulations compiled in Decreto 1074 de 2015 — secretariasenado.gov.co; alcaldiabogota.gov.co (accessed 18 Oct 2026)
Ley Estatutaria 1266 de 2008 — general provisions on habeas data and the management of financial, credit, commercial and services information — secretariasenado.gov.co (accessed 18 Oct 2026)
Decreto 1074 de 2015, Part 2, Title 1, Chapter 7 (Subsistema Nacional de la Calidad). It defines accreditation as a third-party statement formally demonstrating a conformity assessment body's competence, says the activity is exercised exclusively by ONAC and that public entities which accredit are coordinated by ONAC, and requires producers and importers of products under technical regulations to obtain a certificate of conformity from a certification body accredited by ONAC or, on stated conditions, from a foreign body accredited within recognised multilateral recognition arrangements. Tests behind those certificates are run in laboratories accredited by bodies within such arrangements. The compiled decree separately names the national standardisation body as the Government's adviser and coordinator on technical standardisation. — alcaldiabogota.gov.co (accessed 18 Oct 2026)
Decreto 1072 de 2015, Chapter 2.2.4.6 (Sistema de Gestión de la Seguridad y Salud en el Trabajo, SG-SST). The chapter sets mandatory directives for all public and private employers, contracting parties, cooperatives and temporary-service companies, covering employees, contractors, cooperative members and workers on assignment; the Ministry defines the minimum standards used to verify implementation (the compiled text points to Resolución 312 de 2019); article 2.2.4.6.25 requires an emergency prevention, preparedness and response plan covering all sites and shifts, including contractors, suppliers and visitors; Chapter 12, added by Decreto 1347 de 2021, adopts a major-accident prevention programme for classified installations holding listed chemical substances. The decree does not mention ISO 45001. — alcaldiabogota.gov.co (accessed 18 Oct 2026)
Decreto 1076 de 2015 (sector decree for the environment). It describes ANLA as the body ensuring that projects, works or activities subject to licensing, permit or environmental procedure meet the national environmental requirements, and sets the environmental licence procedure with its environmental impact study. An article added by Decreto 766 de 2026 requires the laboratory tests used to determine whether a waste is hazardous to be accredited by IDEAM under ISO/IEC 17025 (latest edition), and accepts foreign laboratories accredited within recognised multilateral recognition arrangements where no national laboratory has the method in its scope. The decree does not mention ISO 14001. — alcaldiabogota.gov.co (accessed 18 Oct 2026)
Resolución 2674 de 2013, which regulates article 126 of Decreto Ley 019 de 2012 and sets the sanitary requirements for people and firms that manufacture, process, prepare, pack, store, transport, distribute, import, export and sell food and food raw materials, and the requirements for sanitary notification, permit or registration. Article 22 says every food factory must have a control system and that the person in charge may apply HACCP, or another system giving similar results that can be shown to the competent health authority; where HACCP is adopted it must be implemented under its general principles. INVIMA describes itself as Colombia's sanitary authority for medicines, foods, medical devices and other products. — minsalud.gov.co; invima.gov.co (accessed 18 Oct 2026)
Decreto 4725 de 2005, the regime of sanitary registrations, marketing permits and sanitary surveillance of medical devices for human use. Establishments that manufacture, semi-process, fill and pack devices must comply with the Good Manufacturing Practices for medical devices issued by the Ministry; INVIMA issues the Certificate of Compliance with Good Manufacturing Practices and checks implementation through periodic visits, and issues the Certificate of Storage and Conditioning Capacity for importers and sellers. The decree does not mention ISO 13485. — minsalud.gov.co; invima.gov.co (accessed 18 Oct 2026)
Decreto 1078 de 2015, Title 17 (guidelines for the use and operation of the servicios ciudadanos digitales). It binds public administration bodies and private persons exercising public functions, and article 2.2.17.6.6 says actors processing information under the title must adopt appropriate, effective and verifiable security measures that let them show compliance with the good practices of the information security and privacy model issued by MinTIC, or with a certifiable information security management system. It names no standard. — alcaldiabogota.gov.co (accessed 18 Oct 2026)
The SFC publishes information security and cybersecurity indicators for banks (investment, incident management and vulnerabilities) and, in a 2026 special publication, a supervision exercise on artificial intelligence and machine learning in credit risk management: of 47 credit institutions with loans current at March 2025, 38 reported using such models, with an inventory of 346 models. The publication states that its opinions are not an official SFC position. Its binding circulars set the expectations for each licence and should be read from the SFC. — superfinanciera.gov.co (accessed 18 Oct 2026)
Ley 1778 de 2016, article 23, has the Superintendencia de Sociedades promote transparency and business ethics programmes, with internal audit rules and mechanisms to prevent transnational bribery, among companies it supervises, and article 7 lists the existence, implementation and effectiveness of such programmes among the criteria for grading the enforcement response. Ley 2195 de 2022, article 9, provides that legal entities under the supervision of a superintendency or other authority adopt transparency and business ethics programmes, with content set by the authority according to sector, risks, assets, income, staff and corporate purpose, which may be integrated with an existing risk management system. — secretariasenado.gov.co (accessed 18 Oct 2026)
Ley 1715 de 2014 promotes efficient energy management and the programme PROURE; UPME evaluates and certifies that investments qualify for the tax and tariff benefits the law grants for efficiency measures. UPME's energy efficiency page records an industrial energy efficiency project that built capacity in energy management systems and links to the PROURE action plan 2022-2030. The law and the page do not require ISO 50001. — secretariasenado.gov.co; upme.gov.co (accessed 18 Oct 2026)
ICA's portal shows work on animal and plant health, safety of primary agricultural production and agricultural inputs, border control and import and export procedures, including a certificate section and the foreign-trade single window. ICA's pages do not name ISO 22000 or HACCP. — ica.gov.co (accessed 18 Oct 2026)
Organismo Nacional de Acreditación de Colombia (ONAC) — global-aci.org; onac.org.co; alcaldiabogota.gov.co (accessed 18 Oct 2026)
Public procurement through SECOP II and the Registro Único de Proponentes (RUP) — colombiacompra.gov.co (accessed 18 Oct 2026)
Transparency and business ethics programmes for suppliers under supervision — secretariasenado.gov.co (accessed 18 Oct 2026)
Zonas francas (free trade zones, multi-user and single-company) — alcaldiabogota.gov.co; investincolombia.com.co

Talk to a consultant

Plan your certification with the New York team.

Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.

usa@sterling-grc.com

+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page

What would you like to achieve?

Choose a starting point. The enquiry form takes about a minute.

Get certified to a standard for the first timeUnderstand cost, scope and timingAdd a standard, or integrate the systems we haveArrange a meeting at the New York office

Book my free discovery call

Continue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice

Request a call Call New York

End to end, from one team

On every engagement, in every country

Multi-country programmes

100% success guarantee · 8,100+ client engagements in 60+ countries · since 2003

ISO and GRC certification consulting in Colombia

ISO and GRC certification in Colombia at a glance

ISO and GRC standards Sterling delivers in Colombia

Quality & operational excellence

Information security, cyber & cloud

Privacy & data protection

AI governance & digital trust

Environment, energy & climate

Health & safety

Governance, risk & resilience

Financial services, payments & AML

Food safety & agriculture

Healthcare, medical devices & life sciences

Laboratories, inspection & accreditation

Automotive, aerospace, rail & defence

Construction, energy, oil & gas