Where we work · Mongolia
ISO and GRC certification consulting in Mongolia
Achieve ISO and GRC certification in Mongolia with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Dubai office team
- Effivity and Academy included
Sectors that ask for certification in Mongolia
Clients include
ISO and GRC certification in Mongolia at a glance
Personal data, cyber security and food safety rules shape certification demand in Mongolia more than any single standard does. The Law on Personal Data Protection (Revised edition) has been in force since 1 May 2022, with the National Human Rights Commission monitoring compliance, and the Law on Cyber Security gives banks, utilities, data centres and IT service providers risk assessment and audit duties. The Law on Food lets operators run HACCP and food safety management systems, and public tenders under the 2023 procurement Law set capability requirements document by document. The Mongolian National Authority for Accreditation, MNAS, appears on the international arrangement's list with scope for ISO 9001, ISO 14001, ISO 22000, ISO/IEC 27001 and ISO 45001. Demand comes from mining and critical minerals, agriculture and food processing, banks and payments, digital businesses, energy and logistics. Certificates are issued by accredited certification bodies, not by Sterling. Sterling's Dubai office serves Mongolian organisations on site where the work needs it and remotely otherwise, bringing 20+ years and 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Mongolia
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Mongolia (9)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Law of Mongolia on Personal Data Protection (Revised edition), 17 December 2021 (Mongolian title: Хүний хувийн мэдээлэл хамгаалах тухай хууль, Шинэчилсэн найруулга) Two bodies are named. The National Human Rights Commission of Mongolia monitors compliance with the personal data laws, receives and investigates complaints and reports, gives directions and recommendations on sensitive data and on electronic processing, and receives each controller's record of violations (Articles 22 and 24). The state central administrative body in charge of digital development and communication approves technological security requirements for sensitive, genetic and biometric data and the methodology for assessments (Articles 20, 23 and 25). Other state authorities monitor controllers within their own functions (Article 26). | Applies to collection, processing, use and security of personal data by any person, legal entity or non-legal entity, including processing with hardware and software, with exceptions for purely personal and family use, the owner's own property protection and disclosure required by law (Article 3). Personal data covers anything that identifies a person directly or indirectly; sensitive data covers race, ethnic origin, religion, beliefs, health, correspondence, genetic and biometric data, criminal records and sexual and gender matters (Article 4). Collection rests on consent or a listed legal ground (Articles 5 to 7); consent is written, on paper or electronic, states the purpose, controller, data list, duration, public disclosure, transfer and withdrawal, and the controller must prove it (Article 8). Transfer to foreign individuals, legal entities and international organisations is prohibited except as law or treaty provides or with the data subject's consent (Article 14). Data subjects can learn what is held, ask for correction or erasure, receive a copy and pass it to another controller (Article 16). Controllers keep procedures and records, explain decisions made without human involvement, answer complaints and use processors only under contract (Articles 18 and 19). Security measures, a loss-of-information plan, de-identification procedures and security assessments are required (Article 20), and an assessment is completed before electronic processing without human involvement that affects rights or regular processing of sensitive data (Article 23). Liability follows the Criminal Code or the Law on Violations (Article 30), and the Law states no fine amounts. | |
| The state central administrative body in charge of food issues, under the Law on Food and the Law on Ensuring the Safety of Food Products (both dated 20 December 2012) Food producers, processors, importers and caterers | The Law on Food lets food business operators implement hazard analysis and critical control point (HACCP) procedures, food quality management and safety management of raw materials and products (Article 10), requires imported food to come from factories that have confirmed such systems (Article 11), makes the operator fully responsible for internal control along its part of the food chain (Article 12) and says an operator may certify its systems with an internationally accredited competent authority, with the list published by the food body (Article 17). The Law on Ensuring the Safety of Food Products requires proper agricultural, hygiene and manufacturing practices (Article 7) and says an operator may implement a HACCP system (Article 7.3). Neither Law names ISO 22000 or FSSC 22000. | HACCP |
| The state central administrative body in charge of digital development and communications, under the Law on Cyber Security of 17 December 2021 Operators of critical information infrastructure, state-owned legal persons and IT service providers | The Law lists the organisations with critical information infrastructure (Article 19), including electricity, water and heating systems, higher-tier health organisations, medicine producers, banks and financial institutions with consolidated digital systems for payment, settlement and transactions, dominant communications and IT operators, fuel and strategic food organisations, data centre operators and others. They must adopt internal cyber security procedures, an action plan for attacks, standards to ensure information security, a cyber security officer or unit, periodic risk assessments and information security audits, and a plan for uninterrupted operation and restoration (Article 19.2). Legal persons providing shared IT services in cyberspace have their own duties, including internal procedures, risk assessments, annual information security audits and a note that audits carried out in line with international standards count towards the audit duty (Article 17). Risk assessments and audits are carried out by legal persons registered with the digital development body (Articles 8 and 9). The Law comes into force on 1 May 2022 (Article 25) and does not name ISO/IEC 27001. | |
| The state administrative body in charge of pharmaceutical matters, under the Law on Medicines and Medical Devices of 27 May 2010 Pharmaceutical, medicine and medical device makers, importers and sellers | The Law requires a special permit to manufacture, import, export and sell medicines and medical devices (Article 7), state registration and control of imports and exports (Articles 6 and 15), certification that a manufacturer meets good manufacturing practice (GMP) requirements (Articles 6 and 12) and a ban on manufacture, import or sale without the permit (Article 11). The Law does not name ISO 13485. | |
| The Energy Conservation Council and the state central administrative body, under the Law on Energy Conservation of 26 November 2015 Large energy consumers and energy service firms | Obliged consumers must carry out an energy audit, develop and implement an energy conservation programme and work plan, report annually to the Energy Conservation Council and appoint an energy conservation manager (Article 10). Energy auditing agencies and auditors work on the basis of accreditation (Article 13) and the Council grants and ends that accreditation (Article 9). The Law came into force on 26 November 2015 and does not name ISO 50001. | |
| The state central administrative organisation in charge of labour issues and state inspectors, under the Law on Labor Safety and Hygiene of 22 May 2008 and the Labour Law in force from 1 January 2022 Employers in all sectors, with mining, construction and manufacturing carrying the heaviest workplace risk | The Law on Labor Safety and Hygiene defines a labour safety and hygiene management system and workplace risk assessment (Article 3), makes directors and employers responsible for labour safety (Article 27), has the structure in charge introduce the management system and monitor its results (Article 27.3.2) and requires internal monitoring of compliance and of measures taken from workplace risk assessment (Article 35). The Labour Law refers occupational safety relations to that Law (Article 3). Neither names ISO 45001. | |
| The state central administrative body in charge of environmental affairs, under the Law on Environmental Impact Assessment of 17 May 2012 Project implementers with an environmental impact assessment, including mineral exploitation and processing plants | A detailed environmental impact assessment includes an environmental management plan made up of an environmental protection plan and an environmental monitoring programme (Articles 8 and 9). The project implementer reports on the plan's implementation each year, the approving organisation reviews it, and an independent audit may be ordered (Article 9). The Law does not name ISO 14001. | |
| Bank of Mongolia, whose English website sets out banking supervision, banking licences, money laundering controls and a payment system section with a National Payment System Council and licensed entities Banks and payment service entities | The Law on Cyber Security places banks and financial institutions with consolidated digital systems for payment, settlement and transactions among the organisations with critical information infrastructure (Article 19.1.6), which brings the information security duties of Article 19.2 to them. The Bank's pages describe its supervisory and payment system roles and do not name an ISO standard. | |
| The Anti-Corruption Agency, under the Law on Anti-Corruption of 6 July 2006 Businesses of every size, and companies dealing with public bodies | The Law makes business entities and organisations define and comply with norms of business ethics in the private sector (Article 6.5.2, as modified on 6 June 2019), obliges organisations and business entities that receive the Agency's lawful decisions and demands to act and report in time (Article 6.6) and has the Agency cooperate with managers of private business entities (Article 18.3). It does not name ISO 37001. |
Accreditation and recognition
- Mongolian National Authority for Accreditation (MNAS) — in Mongolian, Үндэсний итгэмжлэлийн төв (the National Accreditation Centre): National accreditation body of Mongolia, as its own site describes it: it works under the Government member in charge of conformity assessment accreditation, applies ISO/IEC 17011, is a full member of APAC, ILAC and the international accreditation forum, and has joined their mutual recognition arrangements.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public procurement under the Law on Procurement of Goods, Works and Services with State and Local Funds of 16 June 2023 (Revised edition), in force from 1 December 2023 (Clients, meaning state and locally owned legal entities and the other bodies the Law lists, under procedures set by the Cabinet member in charge of finance and budget): The client states in the tender documents the minimum requirements and criteria for financial and technical capability and experience that the contract needs (Article 15.1), and may not specify requirements that do not apply to performing the contract (Article 15.4). Where legislation requires a permit or certificate to perform the contract, the tender documents indicate it (Article 15.5), and technical specifications refer to the relevant standards, norms and rules (Article 12.1). The Law does not require an ISO management system certificate as a general condition, so any such request sits in the individual tender documents.
Economic zones
- Free zones under the Law on Free Zone (Revised version of 12 February 2015): trade facilitation, logistics and transit, export-oriented production, tourism
Sterling in Mongolia
Sterling delivers in Mongolia from its Dubai office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Mongolia clients ask
Is there a personal data protection law in Mongolia, and who supervises it?
Yes. The Law on Personal Data Protection (Revised edition) was adopted on 17 December 2021 and came into force on 1 May 2022, replacing the 1995 Law on Personal Secrets. The National Human Rights Commission monitors compliance and handles complaints, while the state body in charge of digital development and communication sets security requirements. Confirm current obligations with your counsel or the regulator.
Which body accredits ISO certification bodies in Mongolia, and what does its recognition cover?
The Mongolian National Authority for Accreditation (MNAS) is the national accreditation body. The international arrangement's list of 31 December 2025 shows it with scope for ISO 9001, ISO 14001, ISO 22000, ISO/IEC 27001 and ISO 45001, and ILAC lists it for laboratory testing, calibration and inspection. Other standards usually rely on accreditation from another economy, so always read the certificate's scope.
Do Mongolian government tenders require an ISO certificate?
Not as a general rule. The 2023 procurement Law has each client state the financial and technical capability and experience requirements in its tender documents, forbids requirements unrelated to performing the contract, and asks for permits or certificates only where legislation requires them. An ISO certificate is therefore a matter for the individual tender, so read each tender document and ask the client.
Does Mongolia require information security audits for companies?
For some, yes. The Law on Cyber Security requires organisations with critical information infrastructure, such as banks with consolidated payment systems, data centre operators and utilities, to have periodic risk assessments and information security audits. IT service providers in cyberspace have annual audit duties as well. Check whether your organisation falls within the Law's list, and take advice from your counsel or the digital development authority.
Which public holidays affect audit scheduling in Mongolia?
Plan around the Naadam holidays in July and the White Moon days (Tsagaan Sar) in the first spring month of the lunar calendar, plus New Year and the other days both Laws list. Saturday and Sunday are rest days. The Labour Law and the holidays Law do not list identical July dates, so confirm the official calendar for the year before fixing audit dates.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Law of Mongolia on Personal Data Protection (Revised edition), 17 December 2021 (Mongolian title: Хүний хувийн мэдээлэл хамгаалах тухай хууль, Шинэчилсэн найруулга) — legalinfo.mn (accessed 18 Oct 2026)
- The Law on Food lets food business operators implement hazard analysis and critical control point (HACCP) procedures, food quality management and safety management of raw materials and products (Article 10), requires imported food to come from factories that have confirmed such systems (Article 11), makes the operator fully responsible for internal control along its part of the food chain (Article 12) and says an operator may certify its systems with an internationally accredited competent authority, with the list published by the food body (Article 17). The Law on Ensuring the Safety of Food Products requires proper agricultural, hygiene and manufacturing practices (Article 7) and says an operator may implement a HACCP system (Article 7.3). Neither Law names ISO 22000 or FSSC 22000. — legalinfo.mn (accessed 18 Oct 2026)
- The Law lists the organisations with critical information infrastructure (Article 19), including electricity, water and heating systems, higher-tier health organisations, medicine producers, banks and financial institutions with consolidated digital systems for payment, settlement and transactions, dominant communications and IT operators, fuel and strategic food organisations, data centre operators and others. They must adopt internal cyber security procedures, an action plan for attacks, standards to ensure information security, a cyber security officer or unit, periodic risk assessments and information security audits, and a plan for uninterrupted operation and restoration (Article 19.2). Legal persons providing shared IT services in cyberspace have their own duties, including internal procedures, risk assessments, annual information security audits and a note that audits carried out in line with international standards count towards the audit duty (Article 17). Risk assessments and audits are carried out by legal persons registered with the digital development body (Articles 8 and 9). The Law comes into force on 1 May 2022 (Article 25) and does not name ISO/IEC 27001. — legalinfo.mn (accessed 18 Oct 2026)
- The Law requires a special permit to manufacture, import, export and sell medicines and medical devices (Article 7), state registration and control of imports and exports (Articles 6 and 15), certification that a manufacturer meets good manufacturing practice (GMP) requirements (Articles 6 and 12) and a ban on manufacture, import or sale without the permit (Article 11). The Law does not name ISO 13485. — legalinfo.mn (accessed 18 Oct 2026)
- Obliged consumers must carry out an energy audit, develop and implement an energy conservation programme and work plan, report annually to the Energy Conservation Council and appoint an energy conservation manager (Article 10). Energy auditing agencies and auditors work on the basis of accreditation (Article 13) and the Council grants and ends that accreditation (Article 9). The Law came into force on 26 November 2015 and does not name ISO 50001. — legalinfo.mn (accessed 18 Oct 2026)
- The Law on Labor Safety and Hygiene defines a labour safety and hygiene management system and workplace risk assessment (Article 3), makes directors and employers responsible for labour safety (Article 27), has the structure in charge introduce the management system and monitor its results (Article 27.3.2) and requires internal monitoring of compliance and of measures taken from workplace risk assessment (Article 35). The Labour Law refers occupational safety relations to that Law (Article 3). Neither names ISO 45001. — legalinfo.mn (accessed 18 Oct 2026)
- A detailed environmental impact assessment includes an environmental management plan made up of an environmental protection plan and an environmental monitoring programme (Articles 8 and 9). The project implementer reports on the plan's implementation each year, the approving organisation reviews it, and an independent audit may be ordered (Article 9). The Law does not name ISO 14001. — legalinfo.mn (accessed 18 Oct 2026)
- The Law on Cyber Security places banks and financial institutions with consolidated digital systems for payment, settlement and transactions among the organisations with critical information infrastructure (Article 19.1.6), which brings the information security duties of Article 19.2 to them. The Bank's pages describe its supervisory and payment system roles and do not name an ISO standard. — mongolbank.mn; legalinfo.mn (accessed 18 Oct 2026)
- The Law makes business entities and organisations define and comply with norms of business ethics in the private sector (Article 6.5.2, as modified on 6 June 2019), obliges organisations and business entities that receive the Agency's lawful decisions and demands to act and report in time (Article 6.6) and has the Agency cooperate with managers of private business entities (Article 18.3). It does not name ISO 37001. — legalinfo.mn (accessed 18 Oct 2026)
- Mongolian National Authority for Accreditation (MNAS) — in Mongolian, Үндэсний итгэмжлэлийн төв (the National Accreditation Centre) — mnas.gov.mn; iaf.nu; ilac.org; apac-accreditation.org; legalinfo.mn (accessed 18 Oct 2026)
- Public procurement under the Law on Procurement of Goods, Works and Services with State and Local Funds of 16 June 2023 (Revised edition), in force from 1 December 2023 — legalinfo.mn (accessed 18 Oct 2026)
- Free zones under the Law on Free Zone (Revised version of 12 February 2015) — legalinfo.mn (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Dubai team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
uae@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice