Where we work · Hong Kong
ISO and GRC certification consulting in Hong Kong
Achieve ISO and GRC certification in Hong Kong with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 20 standards, one team
- Accredited certification route
- Hong Kong office team
- Effivity and Academy included
Sectors that ask for certification in Hong Kong
Clients include
ISO and GRC certification in Hong Kong at a glance
Demand for ISO and GRC certification in Hong Kong comes from rules that cite standards without mandating certificates, and from buyers who want proof. The Development Bureau's Contractor Management Handbook asks Group B and Group C contractors on the List of Approved Contractors for Public Works for ISO 9001:2015 certification, and ISO 45001 can support its safety criterion. The Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653), in operation since 1 January 2026, has a Code of Practice naming ISO/IEC 27001 and ISO/IEC 42001 among its references, and the Privacy Commissioner for Personal Data (PCPD) points to the ISO/IEC 27000 family and ISO/IEC 27701. The Hong Kong Monetary Authority supervises bank cyber risk and operational resilience, and the Centre for Food Safety promotes HACCP. Accredited certification bodies issue certificates; the Hong Kong Accreditation Service (HKAS) accredits many under HKCAS, though some standards fall outside its scope. Demand is strong in banking, insurance and fintech, IT, cloud and managed services, public works and construction, trading and logistics, food, professional services, and technology and life-science firms in the HKSTP parks. Sterling brings 20+ years and 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included with the engagement. Sterling delivers these engagements from its Hong Kong office.
ISO and GRC standards Sterling delivers in Hong Kong
Each page covers who needs the standard in Hong Kong, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Hong Kong (11)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Personal Data (Privacy) Ordinance (PDPO) Privacy Commissioner for Personal Data (PCPD) | Passed in 1995 and in effect from December 1996 (except certain provisions). Data Protection Principle 4 (data security) requires data users to take all practicable steps to protect the personal data they hold against unauthorised or accidental access, processing, erasure, loss or use. | |
| PCPD Guidance Note on Data Security Measures for Information and Communications Technology Privacy Commissioner for Personal Data (PCPD) | Suggests organisations refer to standards by reputable organisations such as the ISO/IEC 27000 family of information security management system standards, and notes that ISO/IEC 27701:2019 gives guidance for a privacy information management system as an extension to ISO/IEC 27001 and ISO/IEC 27002; adequacy of security measures depends on the circumstances of each case. | |
| Artificial Intelligence: Model Personal Data Protection Framework Privacy Commissioner for Personal Data (PCPD) | States that organisations may refer to ISO and IEEE standards, giving ISO/IEC 27001:2022 and ISO/IEC 27002:2022 (information security), ISO/IEC 27701:2019 (personal data protection), ISO/IEC 23894:2023 (AI risk management) and ISO/IEC 42001:2023 (AI management system) as examples. | |
| Office of the Commissioner of Critical Infrastructure (Computer-system Security), Security Bureau Designated operators of critical infrastructures | Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653), in operation from January 1, 2026, imposing statutory obligations on designated operators to protect their computer systems; the Code of Practice (Version 1.0, 1 January 2026) says operators should refer to recognised methodologies and standards for computer-system security risk assessment such as GB/T 22080, GB/T 31722, ISO/IEC 27001, ISO/IEC 27005, IEC 62443-3-2, NIST 800-30 or ISO/IEC 42001, and covers business continuity management and disaster recovery planning. | ISO/IEC 27001, ISO/IEC 42001 |
| Hong Kong Monetary Authority (HKMA) Banking (authorized institutions) | Supervisory Policy Manual TM-C-1 Supervisory Approach on Cyber Risk Management (V.1 – 29.11.24), including implementation of the Cyber Resilience Assessment Framework; does not name ISO standards. | |
| Hong Kong Monetary Authority (HKMA) Banking (authorized institutions) | Supervisory Policy Manual OR-2 Operational Resilience (V.1 – 31.05.2022) — identifying critical operations and testing the ability to deliver them under severe but plausible scenarios. | |
| Hong Kong Monetary Authority (HKMA) Banks' outsourcing service providers | Supervisory Policy Manual SA-2 Outsourcing (V.1 – 28.12.01) — the HKMA's supervisory approach to outsourcing and its major supervisory concerns. | |
| Centre for Food Safety (CFS), Food and Environmental Hygiene Department Food businesses | HACCP programme — publishes HACCP system material and food safety guidelines for food businesses, including a booklet on developing a school food safety plan based on the HACCP system for lunch box caterers. | HACCP |
| Medical Device Division, Department of Health Medical device traders and manufacturers | Medical Device Administrative Control System (MDACS) — a voluntary listing system for traders and for Class II/III/IV general medical devices and Class B/C/D in vitro diagnostic medical devices, plus post-market monitoring. | |
| Electrical and Mechanical Services Department (EMSD) Owners of prescribed building types | Buildings Energy Efficiency Ordinance (Cap. 610) — compliance with codes of practice for building services installations and energy audits of certain building types under the Code of Practice for Building Energy Audit; the page does not cite ISO 50001. | |
| Independent Commission Against Corruption (ICAC) All private-sector organisations | Prevention of Bribery Ordinance (Cap. 201) — under section 9, no agent shall solicit or accept any advantage without the permission of his principal when conducting the principal's affairs or business; the ICAC offers a Corruption Prevention Advisory Service; ISO 37001 not cited. |
Accreditation and recognition
- Hong Kong Accreditation Service (HKAS): National accreditation body (Innovation and Technology Commission) operating HOKLAS (laboratories, launched 1985), HKCAS (certification bodies, launched 1998) and HKIAS (inspection bodies, launched 1999).
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- List of Approved Contractors for Public Works (Development Bureau (DEVB)): The Contractor Management Handbook (revision date April 2026) sets minimum requirements for the List. For Group B and Group C contractors (admission on probation, confirmation and retention) the Quality Management requirement is: obtain ISO 9001:2015 certification, or — if the contractor has no suitable works contracts in hand for certification auditing — a confirmation from a certification body accredited under HKCAS (or considered equivalent by DEVB) that the Hong Kong office's Quality Manual conforms to the relevant ISO standard. An applicant whose site safety convictions exceed the limit may still satisfy that criterion if it holds a certificate of compliance with ISO 45001 (or equivalent) and has completed a safety audit by an external safety auditor recognised by DEVB.
Economic zones
- Hong Kong Science Park: innovation and technology, GreenTech, FinTech
- Tai Po InnoPark: pharmaceutical manufacturing, medical manufacturing, precision manufacturing
- Tseung Kwan O InnoPark: marine, data technology, smart production
- Yuen Long InnoPark: microelectronics, pharmaceuticals, biomedicine
Sterling in Hong Kong
Sterling delivers in Hong Kong from its Hong Kong office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in Hong Kong, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions Hong Kong clients ask
Are certification audits in Hong Kong conducted in English or Chinese?
Either. Chinese and English are both official languages, and English is widely used in the Government and by the legal, professional and business sectors. Agree the audit language, and the language of your controlled documents, with the certification body when you apply, and follow any language requirement that your client's contract or your regulator imposes.
Which accreditation should a certification body hold for Hong Kong?
Ideally the Hong Kong Accreditation Service (HKAS), which sits within the Innovation and Technology Commission and runs HKCAS for certification bodies, launched in 1998. HKAS belongs to Global ACI, successor to the IAF and ILAC roles from 1 January 2026, and to APAC. HKCAS lists quality, environmental, food safety, safety, information security and energy certification, but not ISO 22301, ISO/IEC 20000-1 or ISO 13485.
Do public works contractors in Hong Kong need ISO 9001?
For Group B and Group C contractors on the Development Bureau's List of Approved Contractors for Public Works, yes in practice. The Contractor Management Handbook (revision April 2026) sets ISO 9001:2015 certification as the Quality Management requirement. A contractor lacking suitable works contracts for auditing may instead obtain a confirmation of its Hong Kong office's Quality Manual from an HKCAS-accredited body. Check the current Handbook before applying.
Does the PDPO require ISO 27001?
No certificate is demanded by the ordinance itself. Data Protection Principle 4 asks data users to take all practicable steps against unauthorised or accidental access, processing, erasure, loss or use of the personal data they hold. The PCPD's data security guidance simply suggests looking at the ISO/IEC 27000 family, and says adequacy depends on each case. Ask your counsel whether your safeguards are adequate.
What does the critical infrastructure ordinance mean for ISO 27001?
It makes ISO 27001 a recognised reference rather than a requirement. Cap. 653, in operation from 1 January 2026, places statutory duties on designated operators to protect their computer systems. Version 1.0 of the Code of Practice tells operators to refer to recognised standards for security risk assessment, such as ISO/IEC 27001, ISO/IEC 27005, IEC 62443-3-2, NIST 800-30 and ISO/IEC 42001, and it covers business continuity. Confirm your own duties with the regulator or counsel.
Can a typhoon or black rainstorm signal stop an on-site audit?
Yes, it can. The Labour Department's Code of Practice in Times of Adverse Weather and 'Extreme Conditions' covers work arrangements when Tropical Cyclone Warning Signal No. 8 or above, the Black Rainstorm Warning Signal or 'extreme conditions' are in force, and on-site audit days can be disrupted by those signals. Build in room to reschedule, and never fix holiday dates in advance, because the Government publishes general holidays, including Lunar New Year, each year.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Personal Data (Privacy) Ordinance (PDPO) — pcpd.org.hk (accessed 5 Oct 2026)
- PCPD Guidance Note on Data Security Measures for Information and Communications Technology — pcpd.org.hk (accessed 5 Oct 2026)
- Artificial Intelligence: Model Personal Data Protection Framework — pcpd.org.hk (accessed 5 Oct 2026)
- Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653), in operation from January 1, 2026, imposing statutory obligations on designated operators to protect their computer systems; the Code of Practice (Version 1.0, 1 January 2026) says operators should refer to recognised methodologies and standards for computer-system security risk assessment such as GB/T 22080, GB/T 31722, ISO/IEC 27001, ISO/IEC 27005, IEC 62443-3-2, NIST 800-30 or ISO/IEC 42001, and covers business continuity management and disaster recovery planning — info.gov.hk; occics.gov.hk (accessed 5 Oct 2026)
- Supervisory Policy Manual TM-C-1 Supervisory Approach on Cyber Risk Management (V.1 – 29.11.24), including implementation of the Cyber Resilience Assessment Framework; does not name ISO standards — brdr.hkma.gov.hk (accessed 5 Oct 2026)
- Supervisory Policy Manual OR-2 Operational Resilience (V.1 – 31.05.2022) — brdr.hkma.gov.hk (accessed 5 Oct 2026)
- Supervisory Policy Manual SA-2 Outsourcing (V.1 – 28.12.01) — hkma.gov.hk (accessed 5 Oct 2026)
- HACCP programme — cfs.gov.hk (accessed 5 Oct 2026)
- Medical Device Administrative Control System (MDACS) — mdd.gov.hk (accessed 5 Oct 2026)
- Buildings Energy Efficiency Ordinance (Cap. 610) — emsd.gov.hk (accessed 5 Oct 2026)
- Prevention of Bribery Ordinance (Cap. 201) — icac.org.hk; cpas.icac.hk (accessed 5 Oct 2026)
- Hong Kong Accreditation Service (HKAS) — itc.gov.hk (accessed 5 Oct 2026)
- List of Approved Contractors for Public Works — devb.gov.hk (accessed 5 Oct 2026)
- Hong Kong Science Park — hkstp.org (accessed 5 Oct 2026)
- Tai Po InnoPark — hkstp.org (accessed 5 Oct 2026)
- Tseung Kwan O InnoPark — hkstp.org (accessed 5 Oct 2026)
- Yuen Long InnoPark — hkstp.org (accessed 5 Oct 2026)
Talk to a consultant
Plan your certification with the Hong Kong team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hongkong@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice