Where we work · Cameroon
ISO and GRC certification consulting in Cameroon
Achieve ISO and GRC certification in Cameroon with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Casablanca office team
- Effivity and Academy included
Sectors that ask for certification in Cameroon
- Agriculture, livestock and fishing producers and processors
- Food manufacturers, exporters and distributors
- Heavy industry, automotive-supply and general manufacturers
- Mining, oil and gas operators and their contractors
- Banks, microfinance institutions and payment firms
- Telecom, IT and digital-infrastructure companies
Clients include
ISO and GRC certification in Cameroon at a glance
Cameroon's compliance map is layered, and management-system certification sits on top of it. Law No. 2024/017 of 23 December 2024 on personal data protection provides for an independent data protection authority, while ANTIC runs mandatory security audits of information systems for public bodies, telecom operators, credit institutions and microfinance. The 2018 framework law on food safety asks every food operator to register and to run HACCP or another recognised system, and COBAC requires credit institutions to keep business continuity plans. The 2025 investment incentives ordinance names agriculture, manufacturing, energy, health, transport, tourism and digital infrastructure as eligible sectors, and public tenders run through the COLEPS platform. ANOR develops Cameroonian standards, and English and French are both official languages. Certificates for Cameroonian organisations usually carry accreditation from another economy within the international arrangements. Sterling's Casablanca office serves Cameroonian organisations, backed by 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Cameroon
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Cameroon (10)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Loi n° 2024/017 du 23 décembre 2024 relative à la protection des données à caractère personnel au Cameroun Autorité de protection des données à caractère personnel, which the law defines as the independent public body in charge of personal data protection; its tasks include seeing that the law is applied, issuing the authorisations the law provides for, drawing up the reference list of technical and organisational measures, approving certification mechanisms, handling complaints and publishing the list of countries recognised as offering equivalent protection; its composition, organisation and operation are to be fixed by a decree of the President of the Republic | The law applies to processing by the State, local authorities and any natural or legal person, to processing of data of people established, resident or in transit in Cameroon, and to controllers and processors established in Cameroon. Processing needs prior consent unless the law lists an exception (legal obligation, public-interest task, protecting health), and processing generally needs prior authorisation from the Authority. Controllers inform people at collection, notify the Authority and the person of a breach without delay, keep a register of processing, carry out a risk assessment and an impact assessment for high-risk processing, report each year to the Authority on their security measures, and obtain authorisation before transferring data abroad under standard contractual clauses the Authority publishes. People have rights of access, correction, erasure, objection, restriction and portability, and a right to challenge automated decisions. The law sets administrative sanctions and criminal penalties, and gives those in charge of processing a transition period from promulgation to comply. | |
| Loi n° 2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun Agence Nationale des Technologies de l'Information et de la Communication (ANTIC) | ANTIC states that the law, with Décret n° 2012/1643/PM of 14 June 2012, sets mandatory security audits of electronic communications networks and information systems. Public administrations, public bodies and public-capital companies, telecom operators and internet providers, and credit and microfinance institutions are the four categories ANTIC lists. | |
| Agence Nationale des Technologies de l'Information et de la Communication (ANTIC) Information systems security of public bodies, telecom operators, credit and microfinance institutions | Law No. 2010/012 of 21 December 2010 and Décret n° 2012/1643/PM of 14 June 2012 on mandatory audits. ANTIC states that it draws up an annual audit plan and the audit reference documents, approves external auditors, audits public administrations itself, reviews external auditors' reports and checks that audited bodies act on recommendations. Its page describes organisational, physical and technical audit phases and does not name ISO/IEC 27001. | |
| The competent authority designated under the food safety framework law Food production, processing, import, export, distribution and sale | Loi n° 2018/020 du 11 décembre 2018 portant loi-cadre sur la sécurité sanitaire des aliments. The text requires food operators to be registered with the competent authority before they operate, requires self-control based on a guide validated by the authority, imposes traceability and hygiene rules in the light of the Codex Alimentarius, requires every operator to set up HACCP or another recognised system defined by international standards, and makes food subject to a market authorisation that weighs site inspection reports on good practice and HACCP, the self-control system and results from accredited or approved laboratories. | HACCP, ISO 22000 |
| Banking Commission of Central Africa (COBAC), published on the site of the Bank of Central African States (BEAC) Banks and other credit institutions | COBAC regulations listed on the BEAC site include R-2008/01 on the obligation for credit institutions to draw up a business continuity plan and R-2016/04 on internal control. Loi n° 2022/006 du 27 avril 2022 regissant le secret bancaire au Cameroun is published by the Presidency. | ISO 22301 |
| Bank of Central African States (BEAC), whose member states include Cameroon Payment systems, electronic money and cards | The BEAC presents a reform of the payment systems and means of payment of the CEMAC, the SYGMA large-value system, the SYSTAC clearing system, an interbank card system and a collection of payment instructions, circulars and regulations. The page does not name PCI DSS. | |
| Agence de Promotion des Investissements (API), a public administrative body based in Douala under the ministry in charge of private investment promotion Investment promotion and incentives | Ordonnance n° 2025/002 du 18 juillet 2025 fixing investment incentives, ratified by Loi n° 2025/015 du 17 décembre 2025. The Presidency's investor pages say API receives and processes applications to the privileged regimes and monitors approved companies' commitments. The ordinance names eligible sectors and leaves upstream petroleum, mining and gas to their own texts. | |
| The ministries and bodies set by the mining and petroleum codes; the Société Nationale des Hydrocarbures (SNH) is the national hydrocarbons company Mining, petroleum and gas | Loi n° 2023/014 du 19 décembre 2023 portant Code minier and Loi n° 2019/008 du 25 avril 2019 portant code pétrolier, both published on the Presidency's site. Quality, safety and environmental conditions for suppliers come from the licences and from operator contracts. | |
| The ministry and bodies set by the forests and wildlife law Forests and wildlife | Loi n° 2024/008 du 24 juillet 2024 portant régime des forêts et de la faune, published on the Presidency's site. | |
| Agence des Normes et de la Qualité (ANOR) National standards | ANOR's site presents its role as drawing up, approving and revising Cameroonian standards with technical committees. A March 2025 notice on its site approves a set of Cameroonian standards in food technology and products, drawn up in line with ISO/IEC procedures. |
Accreditation and recognition
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public procurement through the COLEPS online platform (Ministry of Public Contracts (MINMAP)): The ministry presents COLEPS (Cameroon OnLine E-Procurement System) as a platform for dematerialised public procurement procedures used by contracting authorities, project owners, bidders and commissions. Quality or security certificates matter only where an individual tender document sets them.
Economic zones
- Economic and industrial zones under Law No. 2013/011, MAGZI and the free industrial zones office: manufacturing, agro-industry, logistics
- Port Autonome de Douala: container and general cargo, timber, fishing, hydrocarbons, minerals and cereals
- Kribi industrial and port zone: industry, port logistics
Sterling in Cameroon
Sterling delivers in Cameroon from its Casablanca office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Cameroon clients ask
Does Cameroon have a personal data protection law, and who oversees it?
Yes. Law No. 2024/017 of 23 December 2024 covers processing by the State, local authorities and private organisations, and it provides for an independent data protection authority. The law requires consent or a listed exception, prior authorisation, breach notification and authorisation of transfers abroad, and gives organisations a transition period to comply. Ask your counsel or the Authority which duties reach your processing.
Are certification audits in Cameroon conducted in English or French?
Either language works. Cameroon gives English and French equal official value, so statutes, regulator notices and tender documents can be read in both. When you apply, settle the working language of the audit, whether an interpreter is needed and which language controlled documents use, and warn the certification body if staff on the shop floor speak a local language.
Who writes Cameroonian standards, and does ANOR certify companies?
ANOR draws up, approves and revises Cameroonian standards with technical committees, including a recent set in food technology. For a management-system certificate such as ISO 9001 or ISO 22000, rely on a certification body accredited within the international arrangements, and confirm with your buyer which certificate and accreditation it accepts.
Must Cameroonian organisations have their information systems security-audited?
For some, yes. ANTIC says Law No. 2010/012 and a 2012 decree make security audits of information systems compulsory for four groups: public administrations, public bodies and public-capital companies, telecom operators with internet providers, and credit or microfinance institutions. The agency or approved outside auditors carry them out, and ANTIC's page never mentions ISO/IEC 27001. Ask ANTIC or counsel whether you are covered.
Does Cameroonian law require HACCP in food businesses?
Yes. The 2018 framework law on food safety requires every operator that produces, processes or distributes food to set up HACCP or another recognised system defined by international standards, and to be registered with the competent authority. It does not require an ISO certificate, so a certificate such as ISO 22000 is a buyer or export decision.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Loi n° 2024/017 du 23 décembre 2024 relative à la protection des données à caractère personnel au Cameroun — prc.cm (accessed 18 Oct 2026)
- Loi n° 2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun — antic.cm (accessed 18 Oct 2026)
- Law No. 2010/012 of 21 December 2010 and Décret n° 2012/1643/PM of 14 June 2012 on mandatory audits. ANTIC states that it draws up an annual audit plan and the audit reference documents, approves external auditors, audits public administrations itself, reviews external auditors' reports and checks that audited bodies act on recommendations. Its page describes organisational, physical and technical audit phases and does not name ISO/IEC 27001. — antic.cm (accessed 18 Oct 2026)
- Loi n° 2018/020 du 11 décembre 2018 portant loi-cadre sur la sécurité sanitaire des aliments. The text requires food operators to be registered with the competent authority before they operate, requires self-control based on a guide validated by the authority, imposes traceability and hygiene rules in the light of the Codex Alimentarius, requires every operator to set up HACCP or another recognised system defined by international standards, and makes food subject to a market authorisation that weighs site inspection reports on good practice and HACCP, the self-control system and results from accredited or approved laboratories. — prc.cm (accessed 18 Oct 2026)
- COBAC regulations listed on the BEAC site include R-2008/01 on the obligation for credit institutions to draw up a business continuity plan and R-2016/04 on internal control. Loi n° 2022/006 du 27 avril 2022 regissant le secret bancaire au Cameroun is published by the Presidency. — beac.int; prc.cm (accessed 18 Oct 2026)
- The BEAC presents a reform of the payment systems and means of payment of the CEMAC, the SYGMA large-value system, the SYSTAC clearing system, an interbank card system and a collection of payment instructions, circulars and regulations. The page does not name PCI DSS. — beac.int (accessed 18 Oct 2026)
- Ordonnance n° 2025/002 du 18 juillet 2025 fixing investment incentives, ratified by Loi n° 2025/015 du 17 décembre 2025. The Presidency's investor pages say API receives and processes applications to the privileged regimes and monitors approved companies' commitments. The ordinance names eligible sectors and leaves upstream petroleum, mining and gas to their own texts. — prc.cm (accessed 18 Oct 2026)
- Loi n° 2023/014 du 19 décembre 2023 portant Code minier and Loi n° 2019/008 du 25 avril 2019 portant code pétrolier, both published on the Presidency's site. Quality, safety and environmental conditions for suppliers come from the licences and from operator contracts. — prc.cm; snh.cm (accessed 18 Oct 2026)
- Loi n° 2024/008 du 24 juillet 2024 portant régime des forêts et de la faune, published on the Presidency's site. — prc.cm (accessed 18 Oct 2026)
- ANOR's site presents its role as drawing up, approving and revising Cameroonian standards with technical committees. A March 2025 notice on its site approves a set of Cameroonian standards in food technology and products, drawn up in line with ISO/IEC procedures. — anor.cm (accessed 18 Oct 2026)
- Public procurement through the COLEPS online platform — minmap.cm (accessed 18 Oct 2026)
- Economic and industrial zones under Law No. 2013/011, MAGZI and the free industrial zones office — prc.cm (accessed 18 Oct 2026)
- Port Autonome de Douala — pad.cm; prc.cm (accessed 18 Oct 2026)
- Kribi industrial and port zone — prc.cm (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Casablanca team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Casablanca office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice