Where we work · Kenya
ISO and GRC certification consulting in Kenya
Achieve ISO and GRC certification in Kenya with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Nairobi office team
- Effivity and Academy included
Sectors that ask for certification in Kenya
Clients include
ISO and GRC certification in Kenya at a glance
Two public bodies frame most certification conversations in Kenya: the Kenya Accreditation Service, the national accreditation body, and the Office of the Data Protection Commissioner, which regulates personal data under the Data Protection Act, 2019. Around them sit the Central Bank of Kenya, whose cybersecurity guidance note applies to banks and whose payment regulations ask payment service providers for an annual system security audit report, and the National Computer and Cybercrimes Coordination Committee for critical information infrastructure. The National Environment Management Authority, the Directorate of Occupational Safety and Health Services and the Energy and Petroleum Regulatory Authority each run audit duties of their own. Demand comes from banks and payment firms, horticulture and food processors, apparel exporters in the export processing zones, BPO and ICT firms, health product makers and suppliers to public buyers. Certificates are issued by accredited certification bodies, never by Sterling. Sterling's Nairobi office serves clients in Kenya on-site where the work needs it and remotely otherwise, bringing 8,100+ client engagements in 60+ countries, 20+ years of practice, and Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Kenya
Each page covers who needs the standard in Kenya, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Kenya (15)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Data Protection Act, 2019 Office of the Data Protection Commissioner (ODPC), a State Office established by the Act and headed by the Data Commissioner | Applies to personal data entered in a record by automated or non-automated means, where the controller or processor is established or ordinarily resident in Kenya and processes the data while in Kenya, or is not established in Kenya but processes personal data of data subjects located in Kenya. Generally no person may act as a data controller or data processor unless registered with the Data Commissioner, who prescribes the thresholds for mandatory registration. The Act sets principles for processing, rights for data subjects, a data protection impact assessment before high-risk processing (with consultation of the Commissioner where the assessment shows high risk), data protection by design and by default, notification of breaches to the Commissioner and to affected people, grounds for processing sensitive personal data and conditions for transfers out of Kenya. The Commissioner may carry out periodic audits, issue guidelines and codes of practice, and offer data protection certification standards, seals and marks; the Act says a certification issued under it does not alter the controller's or processor's responsibility for compliance. The Act itself provides for a data protection officer, who a controller or processor may designate where the processing is by a public or private body or the core activities involve regular systematic monitoring or sensitive data. | |
| Data Protection Regulations, 2021 Office of the Data Protection Commissioner (ODPC) | The General Regulations cover consent, lawful basis, the exercise of data subject rights, restrictions on commercial use of personal data and direct marketing opt-outs, retention, data protection policies, contracts between controllers and processors, the elements of data protection by design and notification of breaches. Regulation 26 requires processing for listed purposes of strategic interest to the State, including civil registration and legal identity systems, elections, systems for administering public finances, systems designated as protected computer systems under the Computer Misuse and Cybercrimes legislation, basic education and primary or secondary health care, to be done through a server and data centre in Kenya or with at least one serving copy of the data stored in a data centre in Kenya. The ODPC's registration FAQ states that smaller organisations below its turnover and staffing thresholds are exempt from mandatory registration, except organisations processing personal data for listed purposes such as health administration, education, financial services, insurance, telecommunications, hospitality, direct marketing, credit bureaus and security or CCTV operations, and that registration opened on 14 July 2022 through the ODPC's online portal. | |
| Computer Misuse and Cybercrimes Act, 2018 National Computer and Cybercrimes Coordination Committee (NC4); the Communications Authority of Kenya hosts the National KE-CIRT/CC | NC4's published functions include approving the identification and designation of critical information infrastructure, formulating codes of cybersecurity practice and standards of performance for owners of critical information infrastructure, and reviewing compliance reports and evaluating audit reports on designated infrastructure. The Communications Authority states that the Kenya Information and Communications Act, 1998 mandates it to develop a national cyber security management framework and that the National KE-CIRT/CC coordinates response to cyber security matters nationally. The Act cites no management system standard. | |
| ODPC guidance notes and codes Office of the Data Protection Commissioner (ODPC) | The notes are guidance published by the regulator for controllers and processors in the named areas and for the processing activities they describe; they are not management system standards and carry no certificate. The ODPC also announced in July 2026 that it had introduced a quality management system based on ISO 9001:2015 for its own services, supported through the Kenya Digital Economy Acceleration Project, and the announcement does not say the Office is certified. | |
| Central Bank of Kenya (CBK) Banks and other institutions licensed under the Banking Act | Guidance Note on Cybersecurity (August 2017), issued under section 33(4) of the Banking Act and applying to all institutions licensed under it; it sets minimum requirements on governance, regular independent assessment and testing, outsourcing and training, and defines business continuity management, but names no ISO standard. In September 2026 the CBK also published draft revised Prudential Guidelines and draft Risk Management Guidelines for public comment; the draft risk guidelines give ISO 27001, NIST frameworks, CIS Critical Controls, COBIT, PCI-DSS and OWASP as examples of best practice and cover information security, business continuity and ICT outsourcing. The drafts are not in force until issued. | ISO/IEC 27001, ISO 22301, PCI DSS |
| Central Bank of Kenya (CBK) Payment service providers, including mobile money and e-money issuers | National Payment System Act, 2011 (No. 39 of 2011) and National Payment System Regulations, 2014 (Legal Notice No. 109). Regulation 29 requires a payment service provider to submit to the CBK, each year, a system security audit report on its payment services by a reputable independent audit firm, and to use systems that give a complete audit trail of transactions; the regulations name no ISO or PCI standard for that report. In 2026 the National Treasury and the CBK developed a draft National Payment System Policy and a National Payment System Bill, 2026, which the CBK has published for comment and which would repeal the Act (cited there as Cap. 491A); until a new law is passed the existing Act and Regulations stand. | PCI DSS, ISO/IEC 27001, SOC 2 |
| National Computer and Cybercrimes Coordination Committee (NC4); Communications Authority of Kenya (National KE-CIRT/CC) Owners of critical information infrastructure and computer systems under the cybercrimes law | Computer Misuse and Cybercrimes Act, 2018 (No. 5 of 2018) — NC4 approves designation of critical information infrastructure, formulates codes of cybersecurity practice and standards of performance for its owners and reviews their compliance and audit reports; no management system standard is named on NC4's published functions. | ISO/IEC 27001, ISO 22301 |
| Ministry of Health and public health authorities under the food laws; Kenya Bureau of Standards (KEBS) for standards Food businesses, food premises and processors | Food, Drugs and Chemical Substances Act (Cap. 254, Revised Edition 2012) — prohibits sale of unwholesome, poisonous or adulterated food and the preparation of food under insanitary conditions, and its Food, Drugs and Chemical Substances (Food Hygiene) Regulations, 1978 require a licence for premises used to sell, prepare, package, store or display food, issued by the health authority once the regulations are complied with. Neither names HACCP, ISO 22000 or FSSC 22000, so a food safety certificate is a buyer or export expectation that sits beside the licence. The Standards Act (Chapter 496) is the basis of KEBS's mandate to promote standardisation in industry and commerce. | HACCP, ISO 22000, FSSC 22000 |
| Kenya Plant Health Inspectorate Service (KEPHIS) Exporters and importers of plants, plant products and seed; laboratories serving them | Kenya Plant Health Inspectorate Service Act No. 54 of 2012, which lists the Plant Protection Act (Cap. 324) and the Seeds and Plant Varieties Act (Cap. 326) among the laws the Service implements; KEPHIS states that it issues phytosanitary certificates for exports through its integrated export import certification system and that its laboratories carry methods accredited by KENAS under ISO/IEC 17025:2017. | ISO/IEC 17025, ISO 22000 |
| Directorate of Occupational Safety and Health Services (DOSHS), Ministry of Labour and Social Protection Workplaces: occupiers and employers | Occupational Safety and Health Act, 2007 — requires occupiers to prepare a safety and health policy statement, to set up a safety and health committee where twenty or more persons are employed (or where the Director directs), and to have a thorough safety and health audit of the workplace carried out each year by a safety and health advisor, with the report sent to the Director; Part V provides for registration of workplaces. The Directorate's FAQ also describes the Work Injury Benefits Act, 2007, which provides compensation for work-related injuries and occupational diseases. Neither cites ISO 45001. | ISO 45001 |
| National Environment Management Authority (NEMA) Projects and facilities under the environmental regulations | Environmental (Impact Assessment and Audit) Regulations, 2003 under the Environmental Management and Co-ordination Act — NEMA states that projects need an environmental impact assessment licence before they start, that an initial environmental audit and control audits are carried out by an expert or firm registered by NEMA, and that facilities submit annual environmental audit reports, after the initial audit possibly as self-audits. The regulations are not an ISO 14001 requirement; NEMA reviews the reports and may issue improvement orders. | ISO 14001 |
| Energy and Petroleum Regulatory Authority (EPRA) Designated energy-consuming industrial, commercial and institutional facilities | Energy (Energy Management) Regulations, 2012 (Legal Notice No. 102 under the Energy Act, 2006) — apply to owners and occupiers of industrial, commercial and institutional facilities using any form of energy; designated facilities appoint an energy officer, have an energy audit carried out by a licensed energy auditor at the intervals the regulations set and report to the regulator. EPRA's 2024 benchmarking report states that EPRA designated the facilities that should comply with the 2012 Regulations in 2013 and that the Energy Act 2019 mandates EPRA to develop national energy efficiency measures. The regulations do not cite ISO 50001. | ISO 50001 |
| Ethics and Anti-Corruption Commission (EACC) Public and private entities: bribery prevention | Bribery Act, 2016 (Act No. 47 of 2016), reproduced on the EACC site in its revised edition as the Anti-Bribery Act (Cap. 79B) — section 9 requires a public or private entity to put in place procedures, appropriate to its size, scale and the nature of its operation, for the prevention of bribery and corruption, and a director or senior officer can commit an offence where a private entity's failure is proved to have been committed with their consent or connivance; the Bribery Regulations (Legal Notice No. 88 of 2022) require written procedures covering corruption risk assessment, communication and training, reporting, protection of whistle-blowers and monitoring and review. The EACC has published model procedures; none of these texts names ISO 37001. | ISO 37001, ISO 37301 |
| Pharmacy and Poisons Board (PPB) Medicines, medical devices and in vitro diagnostics, and other health products | Pharmacy and Poisons Act (Cap. 244) — the PPB lists medical devices and IVDs among the products it regulates, inspects manufacturing and distribution establishments against Good Practices guidelines and states that a manufacturing licence holder must comply with good manufacturing practice under the Act; its legal provisions page lists the Pharmacy and Poisons Act, the Health Act, 2017 and the Anti-Counterfeit Act. ISO 13485 is not named in the pages cited. | ISO 13485 |
| Kenya Civil Aviation Authority (KCAA) Aircraft maintenance organisations | Civil Aviation (Approved Maintenance Organisation) Regulations — KCAA states that it certificates organisations that intend to provide services to an owner or operator of a Kenyan-registered aircraft, domestic or foreign, under those regulations. An AMO certificate is an aviation authority approval and is separate from an AS9100 certificate. | AS9100 |
Accreditation and recognition
- Kenya Accreditation Service (KENAS): National accreditation body for Kenya, a state corporation established under the Kenya Accreditation Service Act (Cap. 496A); it accredits certification bodies, inspection and verification bodies, testing, calibration and medical laboratories, and proficiency testing providers.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Cities
Tenders and procurement
- Public Procurement and Asset Disposal Act, 2015 and the Public Procurement Regulatory Authority (PPRA) (Public Procurement Regulatory Authority (PPRA)): PPRA describes the Act as giving effect to Article 227 of the Constitution and providing procedures for efficient public procurement and asset disposal by public entities, and publishes standard tender documents and a public procurement information portal. Qualification criteria and the evidence required are set in each bidding document, so read the qualification clause of the tender you are bidding on; the Act itself does not make an ISO certificate a general requirement.
- Access to Government Procurement Opportunities (AGPO) and preference and reservation rules (Public Procurement Regulatory Authority (PPRA)): PPRA describes AGPO as a programme that helps youth, women and persons with disability-owned enterprises take part in government procurement through a reservation of opportunities, under the Public Procurement and Disposal (Preference and Reservations) Regulations, 2011 for the target groups it lists, which also include small and micro enterprises, citizen contractors and local contractors. It is a preference scheme and does not itself ask for a management system certificate.
Economic zones
- Export Processing Zones (Export Processing Zones Authority, EPZA): export-oriented manufacturing, horticulture and food processing, textile, apparel and leather, BPO and ICT
- Special Economic Zones (Special Economic Zones Authority, SEZA): industrial and export-oriented investment
- EPZA flagship projects:
Sterling in Kenya
Sterling delivers in Kenya from its Nairobi office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in Kenya, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions Kenyan clients ask
Which accreditation should a certification body hold for Kenya?
Look for accreditation by the Kenya Accreditation Service (KENAS), Kenya's national accreditation body, which is a Global ACI full member for management system certification under ISO/IEC 17021-1. KENAS's AFRAC certificate lists sub-scopes for quality, environmental, food safety, occupational health and safety and information security management. For any other standard, ask the body to show its accreditation scope.
Do Kenyan organisations have to register with the Data Protection Commissioner?
Generally yes. The Data Protection Act, 2019 says no person may act as a data controller or processor unless registered with the Data Commissioner, who prescribes the thresholds. The ODPC says smaller organisations below its thresholds are exempt, except those processing personal data for listed purposes such as health, education, finance, telecoms or direct marketing. Check your position with your counsel or the ODPC.
Does the Central Bank of Kenya require banks to hold ISO 27001?
Not by name. The CBK's Guidance Note on Cybersecurity covers banks licensed under the Banking Act and asks for governance, independent testing, outsourcing controls and training without citing any ISO standard. Its September 2026 draft guidelines list ISO 27001 only as an example, and they remain drafts. Ask the CBK what applies to your licence.
Do payment service providers in Kenya need an annual security audit?
Yes, the National Payment System Regulations, 2014 require a payment service provider to submit a system security audit report on its payment services, by a reputable independent audit firm, to the CBK each year. The regulations name no ISO or PCI standard for it, so ask the CBK which evidence it accepts before you commission the work.
Is an annual safety audit a legal duty for Kenyan workplaces?
Yes, for workplaces covered by the Occupational Safety and Health Act, 2007: each year a safety and health advisor audits the workplace and the report goes to the Director of Occupational Safety and Health Services. ISO 45001 is not cited in the Act and is a voluntary management system. Ask the Directorate how the duty applies to your premises.
Are audits in Kenya carried out in English?
Usually, because English is the working language of most business records, standards and tenders, and the Constitution names English and Kiswahili as the official languages. Interviews with operators and suppliers may run in Kiswahili or another local language. Agree the audit language, any interpreter and the language of controlled documents with the certification body when you apply.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Data Protection Act, 2019 — odpc.go.ke (accessed 11 Oct 2026)
- Data Protection Regulations, 2021 — odpc.go.ke (accessed 11 Oct 2026)
- Computer Misuse and Cybercrimes Act, 2018 — nc4.go.ke; ca.go.ke (accessed 11 Oct 2026)
- ODPC guidance notes and codes — odpc.go.ke (accessed 11 Oct 2026)
- Guidance Note on Cybersecurity (August 2017), issued under section 33(4) of the Banking Act and applying to all institutions licensed under it; it sets minimum requirements on governance, regular independent assessment and testing, outsourcing and training, and defines business continuity management, but names no ISO standard. In September 2026 the CBK also published draft revised Prudential Guidelines and draft Risk Management Guidelines for public comment; the draft risk guidelines give ISO 27001, NIST frameworks, CIS Critical Controls, COBIT, PCI-DSS and OWASP as examples of best practice and cover information security, business continuity and ICT outsourcing. The drafts are not in force until issued. — centralbank.go.ke (accessed 11 Oct 2026)
- National Payment System Act, 2011 (No. 39 of 2011) and National Payment System Regulations, 2014 (Legal Notice No. 109). Regulation 29 requires a payment service provider to submit to the CBK, each year, a system security audit report on its payment services by a reputable independent audit firm, and to use systems that give a complete audit trail of transactions; the regulations name no ISO or PCI standard for that report. In 2026 the National Treasury and the CBK developed a draft National Payment System Policy and a National Payment System Bill, 2026, which the CBK has published for comment and which would repeal the Act (cited there as Cap. 491A); until a new law is passed the existing Act and Regulations stand. — centralbank.go.ke (accessed 11 Oct 2026)
- Computer Misuse and Cybercrimes Act, 2018 (No. 5 of 2018) — nc4.go.ke; ca.go.ke (accessed 11 Oct 2026)
- Food, Drugs and Chemical Substances Act (Cap. 254, Revised Edition 2012) — infotradekenya.go.ke; kebs.go.ke (accessed 11 Oct 2026)
- Kenya Plant Health Inspectorate Service Act No. 54 of 2012, which lists the Plant Protection Act (Cap. 324) and the Seeds and Plant Varieties Act (Cap. 326) among the laws the Service implements; KEPHIS states that it issues phytosanitary certificates for exports through its integrated export import certification system and that its laboratories carry methods accredited by KENAS under ISO/IEC 17025:2017. — kephis.go.ke (accessed 11 Oct 2026)
- Occupational Safety and Health Act, 2007 — labour.go.ke; doshmis.go.ke (accessed 11 Oct 2026)
- Environmental (Impact Assessment and Audit) Regulations, 2003 under the Environmental Management and Co-ordination Act — nema.go.ke (accessed 11 Oct 2026)
- Energy (Energy Management) Regulations, 2012 (Legal Notice No. 102 under the Energy Act, 2006) — eprocedures.investkenya.go.ke; epra.go.ke (accessed 11 Oct 2026)
- Bribery Act, 2016 (Act No. 47 of 2016), reproduced on the EACC site in its revised edition as the Anti-Bribery Act (Cap. 79B) — eacc.go.ke (accessed 11 Oct 2026)
- Pharmacy and Poisons Act (Cap. 244) — web.pharmacyboardkenya.org (accessed 11 Oct 2026)
- Civil Aviation (Approved Maintenance Organisation) Regulations — kcaa.or.ke (accessed 11 Oct 2026)
- Kenya Accreditation Service (KENAS) — kenas.go.ke; ilac.org (accessed 11 Oct 2026)
- Public Procurement and Asset Disposal Act, 2015 and the Public Procurement Regulatory Authority (PPRA) — ppra.go.ke (accessed 11 Oct 2026)
- Access to Government Procurement Opportunities (AGPO) and preference and reservation rules — ppra.go.ke (accessed 11 Oct 2026)
- Export Processing Zones (Export Processing Zones Authority, EPZA) — epzakenya.com (accessed 11 Oct 2026)
- Special Economic Zones (Special Economic Zones Authority, SEZA) — sezauthority.go.ke (accessed 11 Oct 2026)
- EPZA flagship projects — epzakenya.com (accessed 11 Oct 2026)
Talk to a consultant
Plan your certification with the Nairobi team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Nairobi office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice