Where we work · El Salvador
ISO and GRC certification consulting in El Salvador
Achieve ISO and GRC certification in El Salvador with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- New York office team
- Effivity and Academy included
Sectors that ask for certification in El Salvador
- Free-zone and maquila manufacturers supplying parents and buyers abroad
- Food, beverage, fishery and agri-food processors and exporters
- Pharmaceutical, cosmetics and medical device makers and distributors
- Banks, insurers and other supervised financial entities and their IT and outsourcing providers
- Contact-centre, business-process and software-services firms serving overseas clients
- Public institutions and the firms that sell to them
Clients include
ISO and GRC certification in El Salvador at a glance
Two decrees from 2024 anchor compliance in El Salvador: the Ley para la Protección de Datos Personales, applied by the Agencia de Ciberseguridad del Estado, and the Ley de Ciberseguridad y Seguridad de la Información. The agency's own policies for personal data point to ISO 27001 as their reference. Beside them stands a national quality system created in 2011: OSN writes standards, OSARTEC technical regulations, and OSA accredits, as a mutual recognition signatory in Global ACI's list. The central bank's NRP-23 expects supervised entities to run an information security management system, the Ley de Compras Públicas calls for anti-bribery certification in named institutions, and the Dirección Nacional de Medicamentos regulates medicines, cosmetics and medical devices. Free-zone manufacturers, food and fishery processors, pharmaceutical and device makers, financial entities, contact-centre and software firms, and public-sector suppliers drive demand. Certificates come from accredited certification bodies, never from Sterling. Sterling works with El Salvador clients from its New York office, visiting sites where the work needs it and otherwise remotely, backed by 20+ years, 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included.
ISO and GRC standards Sterling delivers in El Salvador
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in El Salvador (8)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Ley para la Protección de Datos Personales (Decreto N.° 144) — Law for the Protection of Personal Data Agencia de Ciberseguridad del Estado (ACE), named in the law as the lead body that applies and supervises it, with powers to inspect, issue the policies on handling personal data that bind those subject to the law, issue implementation guides and exercise the sanctioning power. As reformed, a Director de Protección de Datos Personales appointed by the President of the Republic handles the sanction procedures. | Applies to any natural or legal person, public or private, that processes personal data manually or by automated means, including through third parties; excludes data held for purely family or domestic use, data processed for public security, defence and criminal-law purposes, credit-history data under its own law, and certain public registers. Principles include accuracy, fairness, specific and informed consent, data minimisation, transparency, security, lawfulness, limited retention and demonstrated accountability. Gives data subjects rights of access, rectification, cancellation, opposition, portability, erasure ('forgetting') and restriction (ARCO-POL). Requires a privacy notice with listed contents (including cookies), express consent (written for sensitive data), a contract between the party transferring data and the receiver, international transfers only to destinations with at least the law's level of protection, and notification of a security breach to ACE, the Attorney General's Office and the people affected within a maximum period the law sets, counted from knowledge. ACE may create data protection certification mechanisms, seals and marks and approve third parties to issue them; the text read creates no certificate of compliance itself. Fines are set in the law and are not restated here. | |
| The national quality system created by the Ley de Creación del Sistema Salvadoreño para la Calidad (Decreto N.° 790): the Organismo Salvadoreño de Normalización (OSN), the Organismo Salvadoreño de Reglamentación Técnica (OSARTEC) and the Organismo Salvadoreño de Acreditación (OSA) Standardisation, technical regulation, accreditation and conformity assessment (all sectors) | Law published in Diario Oficial N.° 158, Tomo 392, of 26 August 2011 and in force from September 2011. OSN's own history page says the law made it the authority on standardisation, with functions to prepare, adopt and publish standards, run a national standardisation programme and represent the country in regional and international standardisation bodies. OSARTEC's own pages say it coordinates the adoption, adaptation, updating and publication of technical regulations issued by State institutions and is the national Codex Alimentarius contact point under Article 16(g) of the law. OSA's pages say the law created it as the accreditation body. | |
| Banco Central de Reserva de El Salvador (Comité de Normas), with supervision by the Superintendencia del Sistema Financiero Banks, insurers, pension and securities firms and other supervised entities (information security and cyber security) | NRP-23, Normas Técnicas para la Gestión de la Seguridad de la Información (CNBCR-07/2020), approved on 14 April 2020 with effect from 1 July 2020. It sets minimum criteria for information security and cyber security management at supervised entities and requires each to establish, maintain and document an information security management system (SGSI) consistent with its business continuity management system. It adds that, depending on size, nature and complexity, entities may submit their processes to internationally recognised information security certifications, and its annex on outsourced IT services has the entity obtain from the provider a sworn declaration or current certification that it has an information security programme and tested business continuity plans, and confirm it can ask for current audit reports. | ISO/IEC 27001, ISO 22301 |
| Dirección Nacional de Medicamentos (DNM), under the Ley de Medicamentos Medicines, cosmetics, hygiene products, medical devices and the establishments that make or sell them | Ley de Medicamentos (Decreto Legislativo N.° 1008 of 22 February 2012, Diario Oficial N.° 43, Tomo 394, of 2 March 2012), which the Legislative Assembly's Decreto N.° 846 describes as aiming to ensure registration, quality and safety of medicines and cosmetic products. Decreto N.° 846 (Ley Especial de Precios por Servicios de la Dirección Nacional de Medicamentos) prices DNM services that include medical device registration, import and export permits and manufacturing audits. It names no ISO standard. | |
| OSARTEC, coordinating technical regulations issued by State institutions; Central American regulations adopted through COMIECO resolutions Foods, beverages, fishery products, cosmetics and pharmaceuticals (technical regulations) | OSARTEC's inventories list Central American technical regulations (RTCA) and Salvadoran technical regulations (RTS), among them RTCA 67.01.33:06 on good manufacturing practices for processed food and beverage industries, RTCA 11.03.42:07 on good manufacturing practices for the pharmaceutical industry, RTCA 71.03.49:08 on good manufacturing practices for cosmetic laboratories, RTS 67.01.01:13 on good manufacturing practices and microbiological criteria for fishery and aquaculture products, and RTS 67.04.01:23 on good agricultural practices for vegetables. The inventory also records COMIECO resolutions of 2025 and 2026 amending the food labelling and food additive regulations. These regulations set product and plant requirements; they are not management system certificates. | HACCP |
| Ministerio de Trabajo y Previsión Social (MTPS), through its labour inspection directorate Employers (occupational safety and health) | Ley General de Prevención de Riesgos en los Lugares de Trabajo and its Reglamento de Gestión de la Prevención de Riesgos en los Lugares de Trabajo (Decreto N.° 86). MTPS describes the Programa de Gestión de Prevención de Riesgos Ocupacionales as the instrument that records promotion, execution, supervision and evaluation of preventive action, to be kept available for labour inspectors and updated every year, and says the employer may be guided by international technical standards provided they do not contravene current rules. | ISO 45001 |
| Ministerio de Medio Ambiente y Recursos Naturales (the 'Ministerio' of the law) Projects and activities with environmental impact | Ley del Medio Ambiente (Decreto N.° 233 of 2 March 1998, with later reforms). It requires an environmental permit before starting and operating the activities, works and projects the law defines, to be issued by the Ministry after approving an environmental impact study. It creates the national environmental management system for public bodies and names no ISO standard. | |
| Agencia de Ciberseguridad del Estado (ACE) Public institutions and operators with an impact on critical infrastructure (cyber security) | Ley de Ciberseguridad y Seguridad de la Información (Decreto N.° 143), dated 12 November 2024 and published in Diario Oficial N.° 219, Tomo 445, of 15 November 2024; ACE's own site lists it as in force. It regulates cyber security and information security measures in public institutions and in entities with an impact on the nation's critical infrastructure, tells ACE to issue rules, protocols and technical criteria based on national or international standards, and makes failure to comply with them an informatics risk. |
Accreditation and recognition
- Organismo Salvadoreño de Acreditación (OSA): National accreditation body — OSA's own pages say the Ley de Creación del Sistema Salvadoreño para la Calidad (Decreto N.° 790) created it, that it accredits calibration, testing and clinical laboratories as well as inspection and certification bodies, that it works to ISO/IEC 17011, and that it recognises the equivalence of accreditation certificates issued by signatories of the regional and international accreditation arrangements. It publishes directories of accredited conformity assessment bodies.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public purchasing under the Ley de Compras Públicas and the COMPRASAL electronic system (Dirección Nacional de Compras Públicas (DINAC), the lead body for public procurement, and the contracting institutions): Ley de Compras Públicas (Decreto N.° 652 of 25 January 2023, since amended) has the institutions the Reglamento names obtain and keep certification to the anti-bribery standard under international management standards, and requires every other institution to have a compliance officer who checks the purchasing cycle. A further article requires suppliers bidding to provide external audits to hold the corresponding anti-bribery certification. The law sets quality and technological currency as a principle of public contracting but does not require ISO 9001 or other certificates as a blanket condition; each tender sets its own requirements.
- Registro Único de Proveedores del Estado (RUPES) (DINAC, as part of COMPRASAL): The law makes RUPES a national, centralised register in which every natural or legal person wishing to take part in purchasing processes must register, except for emergency, urgent and low-value purchases; it is the means of validating the legal capacity to bid and contract, and it classifies suppliers on performance and other technical factors.
Economic zones
- Zonas francas y depósitos para perfeccionamiento activo (DPA): assembly and maquila manufacturing, manufacture and processing of industrial goods, processing of marine species for industrial transformation, greenhouse and laboratory flora production
- Strategic industrial activities within the free-zone law: vehicle manufacture, aircraft manufacture, marine vessel manufacture, nanotechnology-based industrial goods
Sterling in El Salvador
Sterling delivers in El Salvador from its New York office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions El Salvador clients ask
Who regulates personal data held by companies in El Salvador?
The Agencia de Ciberseguridad del Estado is the authority for Decreto 144, the Ley para la Protección de Datos Personales, issued in November 2024 and covering public and private bodies. The consolidated text held by the judiciary shows reforms made in September 2026. Duties and procedures can shift with reforms like these, so read the latest consolidated text and take advice before relying on any summary.
Which body accredits certification bodies in El Salvador?
OSA, the Organismo Salvadoreño de Acreditación, listed by Global ACI as a full member and signatory of its mutual recognition arrangement. Dated entries on that page cover ISO 9001 and the ISO/IEC 17021-1 management systems scope from December 2025 and ISO 37001 from April 2026, while ISO 22301, ISO/IEC 20000-1, ISO/IEC 27701, ISO/IEC 42001 and IATF 16949 are not shown, so ask any certification body for its accreditation scope.
Does the public purchasing law require anti-bribery certification?
For some bodies, yes. The Ley de Compras Públicas has institutions named in its Reglamento obtain and keep certification to the anti-bribery standard, and institutions not named must appoint a compliance officer. Suppliers bidding to provide external audits must also hold the corresponding certification. It does not demand ISO 9001 from every supplier, so read each tender.
Does the central bank's norm NRP-23 require ISO 27001 certification?
Not as a mandate. The central bank text asks banks and similar entities for a documented information security system aligned with continuity planning, and allows larger or more complex ones to put processes through internationally recognised certification. A separate annex covers outsourced IT providers. Your supervisor decides what applies to you, so ask it before committing to a certificate.
Are certification audits in El Salvador conducted in English?
Frequently, when exporters and service providers serve foreign customers, though Salvadoran law, regulator policies and technical regulations are in Spanish. Tell the certification body at application which language auditors should use, whether an interpreter is needed, and which language your controlled documents and floor interviews will use.
Which periods are poor choices for scheduling audits in El Salvador?
Holy Week and the early-August festival week. The labour ministry says Holy Week days are holidays, that working on a holiday is by mutual agreement and carries a double-pay surcharge, and that in 2026 the August festivities brought holidays in the district of San Salvador and a paid national holiday. Check the calendar for your planned year.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Ley para la Protección de Datos Personales (Decreto N.° 144) — Law for the Protection of Personal Data — ace.gob.sv; jurisprudencia.gob.sv (accessed 18 Oct 2026)
- Law published in Diario Oficial N.° 158, Tomo 392, of 26 August 2011 and in force from September 2011. OSN's own history page says the law made it the authority on standardisation, with functions to prepare, adopt and publish standards, run a national standardisation programme and represent the country in regional and international standardisation bodies. OSARTEC's own pages say it coordinates the adoption, adaptation, updating and publication of technical regulations issued by State institutions and is the national Codex Alimentarius contact point under Article 16(g) of the law. OSA's pages say the law created it as the accreditation body. — osn.gob.sv; osartec.gob.sv; osa.gob.sv (accessed 18 Oct 2026)
- NRP-23, Normas Técnicas para la Gestión de la Seguridad de la Información (CNBCR-07/2020), approved on 14 April 2020 with effect from 1 July 2020. It sets minimum criteria for information security and cyber security management at supervised entities and requires each to establish, maintain and document an information security management system (SGSI) consistent with its business continuity management system. It adds that, depending on size, nature and complexity, entities may submit their processes to internationally recognised information security certifications, and its annex on outsourced IT services has the entity obtain from the provider a sworn declaration or current certification that it has an information security programme and tested business continuity plans, and confirm it can ask for current audit reports. — bcr.gob.sv (accessed 18 Oct 2026)
- Ley de Medicamentos (Decreto Legislativo N.° 1008 of 22 February 2012, Diario Oficial N.° 43, Tomo 394, of 2 March 2012), which the Legislative Assembly's Decreto N.° 846 describes as aiming to ensure registration, quality and safety of medicines and cosmetic products. Decreto N.° 846 (Ley Especial de Precios por Servicios de la Dirección Nacional de Medicamentos) prices DNM services that include medical device registration, import and export permits and manufacturing audits. It names no ISO standard. — jurisprudencia.gob.sv (accessed 18 Oct 2026)
- OSARTEC's inventories list Central American technical regulations (RTCA) and Salvadoran technical regulations (RTS), among them RTCA 67.01.33:06 on good manufacturing practices for processed food and beverage industries, RTCA 11.03.42:07 on good manufacturing practices for the pharmaceutical industry, RTCA 71.03.49:08 on good manufacturing practices for cosmetic laboratories, RTS 67.01.01:13 on good manufacturing practices and microbiological criteria for fishery and aquaculture products, and RTS 67.04.01:23 on good agricultural practices for vegetables. The inventory also records COMIECO resolutions of 2025 and 2026 amending the food labelling and food additive regulations. These regulations set product and plant requirements; they are not management system certificates. — osartec.gob.sv (accessed 18 Oct 2026)
- Ley General de Prevención de Riesgos en los Lugares de Trabajo and its Reglamento de Gestión de la Prevención de Riesgos en los Lugares de Trabajo (Decreto N.° 86). MTPS describes the Programa de Gestión de Prevención de Riesgos Ocupacionales as the instrument that records promotion, execution, supervision and evaluation of preventive action, to be kept available for labour inspectors and updated every year, and says the employer may be guided by international technical standards provided they do not contravene current rules. — mtps.gob.sv (accessed 18 Oct 2026)
- Ley del Medio Ambiente (Decreto N.° 233 of 2 March 1998, with later reforms). It requires an environmental permit before starting and operating the activities, works and projects the law defines, to be issued by the Ministry after approving an environmental impact study. It creates the national environmental management system for public bodies and names no ISO standard. — jurisprudencia.gob.sv (accessed 18 Oct 2026)
- Ley de Ciberseguridad y Seguridad de la Información (Decreto N.° 143), dated 12 November 2024 and published in Diario Oficial N.° 219, Tomo 445, of 15 November 2024; ACE's own site lists it as in force. It regulates cyber security and information security measures in public institutions and in entities with an impact on the nation's critical infrastructure, tells ACE to issue rules, protocols and technical criteria based on national or international standards, and makes failure to comply with them an informatics risk. — ace.gob.sv (accessed 18 Oct 2026)
- Organismo Salvadoreño de Acreditación (OSA) — global-aci.org; osa.gob.sv (accessed 18 Oct 2026)
- Public purchasing under the Ley de Compras Públicas and the COMPRASAL electronic system — jurisprudencia.gob.sv (accessed 18 Oct 2026)
- Registro Único de Proveedores del Estado (RUPES) — jurisprudencia.gob.sv (accessed 18 Oct 2026)
- Zonas francas y depósitos para perfeccionamiento activo (DPA) — infotrade.economia.gob.sv
- Strategic industrial activities within the free-zone law — infotrade.economia.gob.sv
Talk to a consultant
Plan your certification with the New York team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
usa@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice