Where we work · Vietnam
ISO and GRC certification consulting in Vietnam
Achieve ISO and GRC certification in Vietnam with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 20 standards, one team
- Accredited certification route
- Ho Chi Minh City office team
- Effivity and Academy included
Sectors that ask for certification in Vietnam
Clients include
ISO and GRC certification in Vietnam at a glance
Vietnam's demand for ISO and GRC certification comes from export customers, sector regulators and a fast-growing body of data and technology law. Medical device makers answer to the Ministry of Health under Decree No. 98/2021/NĐ-CP, which brings in ISO 13485, while food establishments holding a valid HACCP, ISO 22000 or FSSC 22000 certificate can be exempt from the food safety eligibility certificate under Decree No. 15/2018/NĐ-CP. Banks and payment providers answer to the State Bank of Vietnam. The Law on Personal Data Protection has applied since 1 January 2026, with the Ministry of Public Security as the regulator, and the Law on Artificial Intelligence sits with the Ministry of Science and Technology. Demand is strongest in electronics and precision manufacturing, food processing and seafood export, software and IT outsourcing, banking and fintech, medical devices, automotive supply and industrial park tenants. Certificates come from certification bodies, which the National Accreditation Bureau (BoA) accredits through its VICAS programme; Sterling does not certify. Sterling's Ho Chi Minh City office brings 20+ years and 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Vietnam
Each page covers who needs the standard in Vietnam, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Vietnam (8)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Law on Personal Data Protection (Luật Bảo vệ dữ liệu cá nhân) Ministry of Public Security — the specialised personal data protection agency (cơ quan chuyên trách bảo vệ dữ liệu cá nhân) sits within the ministry | In force from 1 January 2026. Applies to Vietnamese agencies, organisations and individuals; foreign agencies, organisations and individuals in Vietnam; and foreign agencies, organisations and individuals directly involved in or related to processing personal data of Vietnamese citizens and of people of Vietnamese origin without determined nationality living in Vietnam who hold an identity certificate. Covers processing impact assessments, cross-border transfers and breach notification (the specialised agency must be notified no later than 72 hours after a qualifying violation is discovered). Small enterprises and start-ups may choose whether to apply the impact-assessment articles and the duty to designate data protection staff for five years from the effective date, except those providing personal data processing services, directly processing sensitive personal data or processing data of a large number of data subjects. | |
| State Bank of Vietnam (SBV) Credit institutions, foreign bank branches, payment intermediary service providers, credit information companies, the National Payment Corporation of Vietnam and other covered banking-sector organisations | Circular No. 09/2020/TT-NHNN on information system safety in banking operations — online transaction systems must comply with TCVN 11930:2017 (Article 25); third-party cloud providers must have IT infrastructure with a valid international certification on information security assurance (Article 34); impact analysis, continuity procedures and a disaster recovery system for information systems at level 3 and above (Articles 49–50). The text does not name ISO/IEC 27001, ISO 22301 or PCI DSS. Check later amendments before quoting article numbers. | |
| State Bank of Vietnam (SBV) Card issuers, acquirers and card payment organisations | Circular No. 18/2024/TT-NHNN on bank card operations (amended by Circular No. 45/2025/TT-NHNN) — issuers and payment organisations must comply with the domestic chip card base standard (Tiêu chuẩn cơ sở về thẻ chip nội địa); the 2024 text does not name PCI DSS. | |
| Ministry of Health (MOH) Medical device manufacturers, importers and registrants | Decree No. 98/2021/NĐ-CP on the management of medical devices (consolidated text 08/VBHN-BYT) — a manufacturing establishment must meet the ISO 13485 quality management system standard; the declaration of eligibility to manufacture includes an ISO 13485 certificate issued by a conformity assessment organisation; Class A and B standard-declaration dossiers include a valid ISO 13485 certificate; imported devices must be produced at a manufacturing site certified to ISO 13485. | ISO 13485 |
| Government of Vietnam (food safety certificates administered by the sector ministries; the cited answer was given by the Ministry of Industry and Trade) Food production and trading establishments | Decree No. 15/2018/NĐ-CP — point k, clause 1, Article 12 exempts from the food safety eligibility certificate establishments holding a valid GMP, HACCP, ISO 22000, IFS, BRC or FSSC 22000 certificate or equivalent; other food safety rules still apply. | HACCP, ISO 22000, FSSC 22000 |
| Government of Vietnam; industrial park and economic zone management boards Industrial parks and economic zones (eco-industrial park designation) | Decree No. 35/2022/NĐ-CP on the management of industrial parks and economic zones — eco-industrial park criteria include that enterprises taking part in industrial symbiosis apply production and environmental management systems under appropriate ISO standards (Article 37); no specific ISO standard is named. Check later amendments. | |
| Ministry of Science and Technology (MOST) Developers, providers and deployers of artificial intelligence systems (Vietnamese and foreign organisations active in Vietnam) | Law on Artificial Intelligence No. 134/2025/QH15, in force from 1 March 2026 (with transitional provisions) — AI systems are classified by risk level; providers notify MOST of medium- and high-risk classifications; high-risk systems must undergo conformity assessment. The law does not name ISO/IEC 42001. | |
| Government Inspectorate and other inspection bodies named in the law Non-state enterprises and organisations (with additional duties for public companies and credit institutions) | Law on Anti-corruption No. 36/2018/QH14 (consolidated text 65/VBHN-VPQH; amended by Law No. 132/2025/QH15 from 1 July 2026) — non-state enterprises must take corruption-prevention measures and self-inspect to detect corruption; transparency, conflict-of-interest control and head-of-organisation responsibility provisions apply to public companies and credit institutions (Articles 80–82). The law does not name ISO 37001 or ISO 37301. |
Accreditation and recognition
- National Accreditation Bureau (BoA), Vietnam: National accreditation body; programmes include VICAS (certification, validation and verification bodies — ISO/IEC 17021-1 for management systems, ISO/IEC 17065, ISO/IEC 17024, ISO/IEC 17029), VILAS (testing and calibration laboratories), VILAS Med, VIAS (inspection bodies), VIPAS (proficiency testing providers) and VIRAS (reference material producers).
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Cities
Tenders and procurement
- Public procurement under the Law on Bidding and the national e-procurement system (Hệ thống mạng đấu thầu quốc gia) (Government of Vietnam; the state management agency for bidding operates the national e-procurement system): Law No. 22/2023/QH15 on Bidding defines the national e-procurement system as the IT system for unified management of bidding information and online bidding. The law does not mention ISO certificates; any certificate requirement is set in the individual bidding documents.
Economic zones
- Saigon Hi-Tech Park (Khu Công nghệ cao Thành phố Hồ Chí Minh): microelectronics, optoelectronics, IT and telecommunications, precision mechanics, automation and robotics, biotechnology for agriculture, health and environment, new materials, nanotechnology and new energy
- Hoa Lac Hi-Tech Park (Khu Công nghệ cao Hòa Lạc): information technology, biotechnology, new materials technology, automation technology
- VSIP integrated industrial parks (Binh Duong, Bac Ninh, Hai Duong, Hai Phong, Nghe An, Quang Ngai): industrial land and ready-built factories, manufacturing, technology companies
Sterling in Vietnam
Sterling delivers in Vietnam from its Ho Chi Minh City office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in Vietnam, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions Vietnamese clients ask
Are certification audits in Vietnam conducted in Vietnamese or English?
Agree the language before you apply. Vietnamese is the national language, so the audit can run in Vietnamese or in English, and the certification body should settle that, and the language of controlled documents, with you at application. Follow any language a regulator requires for dossiers, and any that your client's contract sets.
Does Vietnam's Law on Personal Data Protection apply to foreign companies?
Often, yes. The law reaches foreign agencies, organisations and individuals in Vietnam, and those directly involved in or related to processing personal data of Vietnamese citizens, or of people of Vietnamese origin without determined nationality who live in Vietnam and hold an identity certificate. It has been in force since 1 January 2026. Whether your own processing falls inside it is a legal question for your counsel.
Do Vietnamese public tenders require ISO certificates?
Not through the statute itself. Law No. 22/2023/QH15 on Bidding defines the national e-procurement system as the IT system for unified management of bidding information and online bidding, and it never mentions ISO certificates. Any certificate requirement is written into the individual bidding documents, so read each tender's criteria and, if unclear, ask the procuring entity.
Does a HACCP, ISO 22000 or FSSC 22000 certificate replace the food safety eligibility certificate?
Partly. Point k, clause 1, Article 12 of Decree No. 15/2018/NĐ-CP exempts an establishment holding a valid GMP, HACCP, ISO 22000, IFS, BRC or FSSC 22000 certificate, or an equivalent, from the eligibility certificate. Other food safety rules still apply. The cited answer was given by the Ministry of Industry and Trade, so check your own position with the competent ministry.
Can audits be scheduled around Tết?
Yes, with planning. The Tết (Lunar New Year) break and other public holidays affect audit scheduling, and because Tết follows the lunar calendar its dates move every year. Book audit windows early with the certification body and check the current year's holiday calendar instead of reusing a date from an earlier year.
Cities Sterling covers in Vietnam
Each city page sets out the industries, zones and standards that matter locally.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Law on Personal Data Protection (Luật Bảo vệ dữ liệu cá nhân) — congbaocdn.chinhphu.vn (accessed 5 Oct 2026)
- Circular No. 09/2020/TT-NHNN on information system safety in banking operations — congbaocdn.chinhphu.vn (accessed 5 Oct 2026)
- Circular No. 18/2024/TT-NHNN on bank card operations (amended by Circular No. 45/2025/TT-NHNN) — congbao.chinhphu.vn (accessed 5 Oct 2026)
- Decree No. 98/2021/NĐ-CP on the management of medical devices (consolidated text 08/VBHN-BYT) — datafiles.chinhphu.vn (accessed 5 Oct 2026)
- Decree No. 15/2018/NĐ-CP — chinhsachonline.chinhphu.vn (accessed 5 Oct 2026)
- Decree No. 35/2022/NĐ-CP on the management of industrial parks and economic zones — congbao.chinhphu.vn (accessed 5 Oct 2026)
- Law on Artificial Intelligence No. 134/2025/QH15, in force from 1 March 2026 (with transitional provisions) — congbao.chinhphu.vn (accessed 5 Oct 2026)
- Law on Anti-corruption No. 36/2018/QH14 (consolidated text 65/VBHN-VPQH; amended by Law No. 132/2025/QH15 from 1 July 2026) — datafiles.chinhphu.vn (accessed 5 Oct 2026)
- National Accreditation Bureau (BoA), Vietnam — boa.gov.vn; ilac.org (accessed 5 Oct 2026)
- Public procurement under the Law on Bidding and the national e-procurement system (Hệ thống mạng đấu thầu quốc gia) — congbao.chinhphu.vn (accessed 5 Oct 2026)
- Saigon Hi-Tech Park (Khu Công nghệ cao Thành phố Hồ Chí Minh) — shtp.hochiminhcity.gov.vn (accessed 5 Oct 2026)
- Hoa Lac Hi-Tech Park (Khu Công nghệ cao Hòa Lạc) — hhtp.gov.vn (accessed 5 Oct 2026)
- VSIP integrated industrial parks (Binh Duong, Bac Ninh, Hai Duong, Hai Phong, Nghe An, Quang Ngai) — vsip.com.vn (accessed 5 Oct 2026)
Talk to a consultant
Plan your certification with the Ho Chi Minh City team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
vietnam@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice