Where we work · Liberia
ISO and GRC certification consulting in Liberia
Achieve ISO and GRC certification in Liberia with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Lagos office team
- Effivity and Academy included
Sectors that ask for certification in Liberia
Clients include
ISO and GRC certification in Liberia at a glance
A privacy Act, a cybercrime Act and a set of sector rules now frame compliance work in Liberia. The Personal Data Protection and Privacy Act of 2024, approved on 9 March 2026, gives the Independent Information Commissioner oversight of personal information and asks controllers to protect it with organisational, physical and technical measures. The Cybercrime Act of 2025 names ISO/IEC 27001 compliance among the mandatory standards its cybersecurity team is to enforce, the Liberia Telecommunications Authority issued Cybersecurity Regulations in 2026, and the Central Bank of Liberia asks e-payment providers to follow international security standards. Beyond the digital rules, the Environmental Protection Agency issues project permits, the Liberia Agriculture Commodity Regulatory Authority oversees cocoa, coffee and oil palm, and the Liberia Standards Authority is the national standards body. Accredited certification bodies issue certificates; Sterling does not. From its Lagos office, Sterling serves Liberian clients on site where the work needs it and remotely otherwise, bringing 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included.
ISO and GRC standards Sterling delivers in Liberia
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Liberia (12)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Personal Data Protection and Privacy Act of 2024 (long title: An Act for the Collection, Processing, Transmission, Storage, Protection, and Use of Personal Information in Liberia) Independent Information Commissioner, the oversight body created by the Freedom of Information Act of 2010, which the Act amends to give it data protection and monitoring functions (sections 8 and 10) | Applies to the processing of personal information of residents of Liberia and the ECOWAS region by public and private bodies, with extraterritorial reach where the processing links to Liberian or ECOWAS residents. Sets principles of specified purposes, fair and lawful processing, accuracy, adequacy and limited retention; lawful grounds including consent, contract, legal obligation, vital interests, public order and legitimate interests; a general ban on processing sensitive personal information except in listed cases; data subject rights to be informed, to access, to correct, to block or erase, to be indemnified and to data portability; security measures, a security policy, vulnerability management and monitoring; prompt notice to affected people when sensitive information is acquired by an unauthorised person and serious harm is likely; accountability for processors and transfers, with an accountable individual designated; and rules for government agencies and their contractors. The Commissioner may receive complaints, investigate, issue cease and desist orders, approve privacy codes, authorise transfers of personal data out of Liberia and impose administrative and financial penalties, and the penalties chapter creates offences punishable by imprisonment and fines. The scope section lists exclusions, including information necessary for banks and other financial institutions under the jurisdiction of the central monetary authority and personal information originally collected from residents of foreign jurisdictions under those jurisdictions' laws. | |
| Liberia Telecommunications Authority (LTA) Telecommunications, internet and mobile network operators | Telecommunications Act 2007 and the LTA Cybersecurity Regulations 2026 (LTA-REG-0013-2026, dated 13 January 2026): providers keep a cybersecurity unit, document digital assets, run risk assessments, protect data, detect and respond to incidents, test and file disaster recovery and business continuity plans with the LTA, monitor their networks and report to it; the LTA may carry out spot checks and unannounced examinations, and the regulations come into effect on the day published. | ISO/IEC 27001, ISO 22301, ISO/IEC 27701 |
| Central Bank of Liberia (CBL) Banks, e-payment and mobile money providers | Regulations Concerning Licensing and Operations of Electronic Payment (E-Payment) Services in Liberia, Prudential Regulations No. CBL/RSD/003/2020, issued on 8 January 2020 and printed in the Liberia Official Gazette (Extraordinary): section 9.1 asks providers to protect personal information, secure the integrity, confidentiality and availability of data by adopting prevailing international standards and to keep a cyber-security policy that conforms with international standards; section 9.2 asks for tested backup and business continuity plans. The CBL also publishes the Payment Systems Act (2014), its AML/CFT regulations and guidelines on internal control, and lists the Bank Financial Institutions and Bank Financial Holding Companies Act of 2025. | ISO/IEC 27001, ISO 22301, PCI DSS, ISO 37301 |
| Liberia Cybersecurity Emergency Response Team (LCERT), the technical arm of the Liberia National Cybersecurity Council (LNCC) established by the Cybercrime Act of 2025 Critical information infrastructure, financial institutions, telecommunications providers and healthcare facilities | Cybercrime Act of 2025, printed by authority with the words approved 3 July 2026: the Act provides that LCERT is to publish and enforce mandatory cybersecurity standards that include ISO/IEC 27001 compliance, NIST-aligned frameworks, periodic security audits and penetration testing, that enhanced standards apply to financial institutions, telecommunications providers and healthcare facilities, and that sector regulators work with LCERT on enforcement; the President may designate critical national information infrastructure by Order and may require its audit and inspection; LCERT functions follow identify, protect, detect, respond and recover. | ISO/IEC 27001, ISO 22301, ISO/IEC 27701 |
| Environmental Protection Agency of Liberia (EPA) Industrial, mining, plantation and construction projects with environmental impact | The Act creating the Environment Protection Agency, which the Agency says the Legislature passed on 26 November 2002, and the Environmental Protection and Management Law; the Department of Compliance and Enforcement coordinates Environmental and Social Impact Assessment processes, issues permits for approved projects and monitors compliance, and the Agency publishes the 2021 Revised Environmental and Social Impact Assessment and Strategic Environmental Assessment Procedural Guidelines and guidelines for importing, handling, transporting and storing chemicals. | ISO 14001 |
| Ministry of Labour Employers and workplaces | The Ministry says it was created by an Act of the Legislature in 1981 and is responsible for the promotion, administration, development, regulation and control of the Decent Work Act and the Labour Practices Law. | ISO 45001 |
| Liberia Medicines and Health Products Regulatory Authority (LMHRA) Pharmaceutical importers, distributors, manufacturers and health product suppliers | The Authority describes itself as the statutory arm of the Government responsible for ensuring that medicines and health products circulating in Liberia are safe and efficacious, officially established on 29 September 2010; its site lists a quality control laboratory with physio-chemical, micro-chemical, cosmetics and metrology laboratories, together with licensing and inspections sections. | ISO 13485, ISO/IEC 17025, ISO 9001 |
| Liberia Agriculture Commodity Regulatory Authority (LACRA) Cocoa, coffee, oil palm and other agricultural commodity producers, processors and exporters | LACRA says it was established to replace the Liberian Produce Marketing Corporation and is mandated by Liberian law as regulator of agricultural trade, overseeing production, quality control and export of cocoa, coffee and oil palm and setting and enforcing standards so that products meet national and international quality requirements; its pages name no ISO standard. | ISO 22000, HACCP, FSSC 22000, ISO 9001 |
| Ministry of Mines and Energy Mining and energy operators | The Ministry's site lists Regulations Governing Tailing Storage Facilities Management under the Mineral, Mining and Environmental Protection Law of the Republic of Liberia 2024 (Version 1.0), regulations on groundwater exploration and borehole drilling permits, river sand mining regulations and its digital licensing procedures. | ISO 14001, ISO 45001, ISO 9001 |
| Liberia Electricity Regulatory Commission (LERC) Electricity generators, distributors and micro utilities | The Commission's site refers to the 2015 Electricity Law and publishes electricity and micro utility licensing application forms and consumer complaint procedures; its pages name no ISO standard. | ISO 50001 |
| National Investment Commission (NIC) Investors and project developers | NIC describes itself as the official investment promotion and facilitation agency of the Republic of Liberia, offering site selection, incentives and single-window support for regulatory clearances, and lists agribusiness, infrastructure and logistics, tourism, free zones and industrial parks, and mining sites for iron ore, gold, diamonds and other minerals; its pages do not ask investors for ISO certificates. | ISO 9001, ISO 14001 |
| Forestry Development Authority (FDA) Forestry and timber operators | The Authority says it is a semi-public autonomous corporation created by an act of the Legislature on 20 December 1976 to manage and conserve the forests and related resources of the country; its site has sections on legality verification, the FLEGT-VPA and laws and regulations. | ISO 14001, ISO 45001 |
Accreditation and recognition
- Accreditation bodies that are signatories of the international mutual recognition arrangements (Global ACI — Global Accreditation Cooperation Incorporated, formerly the IAF MLA): The arrangement under which an accredited certificate from one signatory's economy is recognised by the others; it is not a Liberian body.
- Liberia Standards Authority (LiSA), formerly the National Standards Laboratory: National standards body: the Ministry of Commerce and Industry describes it as the national apex body established by law in 2022 and responsible for the development, promotion and maintenance of Liberian Standards.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public procurement under the Public Procurement and Concessions Commission (PPCC) (Public Procurement and Concessions Commission): The Commission publishes a step-by-step procedural manual, complaint procedures, standard bidding documents and templates, and is rolling out electronic government procurement to ministries, agencies and commissions in phases; qualification criteria are set in each bidding document, so ask the procuring entity whether it expects an ISO certificate.
Economic zones
- Special economic zones under the Special Economic Zones Act of 2017 (Liberia Special Economic Zone Authority): industrial and export-oriented enterprises licensed as zone developers or operators
Sterling in Liberia
Sterling delivers in Liberia from its Lagos office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Liberia clients ask
Does Liberia have a data protection law, and who oversees it?
Yes. The Personal Data Protection and Privacy Act of 2024 carries the words approved 9 March 2026 and gives oversight to the Independent Information Commissioner, a body created by the Freedom of Information Act of 2010. Section 44 provides that it takes effect upon publication into handbills, so confirm the current position and the implementing rules with your counsel or the Commissioner.
What cyber security rules apply to Liberian telecoms operators?
The Liberia Telecommunications Authority issued Cybersecurity Regulations 2026 under the Telecommunications Act 2007. Providers keep a cybersecurity unit, run risk assessments, protect data, respond to incidents, test disaster recovery and business continuity plans and file them with the Authority, which may examine compliance without notice. The regulations name no ISO standard, so ask the Authority what evidence it prefers.
Does Liberian law mention ISO 27001?
The Cybercrime Act of 2025 does. It provides that the Liberia Cybersecurity Emergency Response Team is to publish and enforce mandatory cybersecurity standards that include ISO/IEC 27001 compliance, with enhanced standards for financial institutions, telecommunications providers and healthcare facilities. Which standards have been published, and when they bind you, is for that team to say, so check with it.
Which body accredits certification bodies for Liberian sites?
A certificate for a Liberian site usually carries accreditation from another economy within the international mutual recognition arrangements, so look at the accreditation mark and scope on the certification body's own certificate. The Liberia Standards Authority is the national standards body, with a standards role rather than an accreditation role. Ask your customer which accreditation it accepts.
Who issues environmental permits for projects in Liberia?
The Environmental Protection Agency. Its Department of Compliance and Enforcement coordinates the Environmental and Social Impact Assessment process, issues permits for approved projects and monitors compliance, using the 2021 Revised procedural guidelines. An ISO 14001 certificate does not replace a permit, so start with the Agency when a mine, plantation or plant may need an assessment.
Which authority regulates cocoa, coffee and oil palm exports?
LACRA, the Liberia Agriculture Commodity Regulatory Authority, which calls itself the regulator of agricultural trade. Its remit covers production, quality control and exports of those three commodities, with standards set and enforced to meet national and international requirements. Because its site names no ISO standard, find out from every buyer which food safety certificate is wanted.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Personal Data Protection and Privacy Act of 2024 (long title: An Act for the Collection, Processing, Transmission, Storage, Protection, and Use of Personal Information in Liberia) — lta.gov.lr (accessed 18 Oct 2026)
- Telecommunications Act 2007 and the LTA Cybersecurity Regulations 2026 (LTA-REG-0013-2026, dated 13 January 2026): providers keep a cybersecurity unit, document digital assets, run risk assessments, protect data, detect and respond to incidents, test and file disaster recovery and business continuity plans with the LTA, monitor their networks and report to it; the LTA may carry out spot checks and unannounced examinations, and the regulations come into effect on the day published — lta.gov.lr (accessed 18 Oct 2026)
- Regulations Concerning Licensing and Operations of Electronic Payment (E-Payment) Services in Liberia, Prudential Regulations No. CBL/RSD/003/2020, issued on 8 January 2020 and printed in the Liberia Official Gazette (Extraordinary): section 9.1 asks providers to protect personal information, secure the integrity, confidentiality and availability of data by adopting prevailing international standards and to keep a cyber-security policy that conforms with international standards; section 9.2 asks for tested backup and business continuity plans. The CBL also publishes the Payment Systems Act (2014), its AML/CFT regulations and guidelines on internal control, and lists the Bank Financial Institutions and Bank Financial Holding Companies Act of 2025 — cbl.org.lr (accessed 18 Oct 2026)
- Cybercrime Act of 2025, printed by authority with the words approved 3 July 2026: the Act provides that LCERT is to publish and enforce mandatory cybersecurity standards that include ISO/IEC 27001 compliance, NIST-aligned frameworks, periodic security audits and penetration testing, that enhanced standards apply to financial institutions, telecommunications providers and healthcare facilities, and that sector regulators work with LCERT on enforcement; the President may designate critical national information infrastructure by Order and may require its audit and inspection; LCERT functions follow identify, protect, detect, respond and recover — lta.gov.lr (accessed 18 Oct 2026)
- The Act creating the Environment Protection Agency, which the Agency says the Legislature passed on 26 November 2002, and the Environmental Protection and Management Law; the Department of Compliance and Enforcement coordinates Environmental and Social Impact Assessment processes, issues permits for approved projects and monitors compliance, and the Agency publishes the 2021 Revised Environmental and Social Impact Assessment and Strategic Environmental Assessment Procedural Guidelines and guidelines for importing, handling, transporting and storing chemicals — epa.gov.lr (accessed 18 Oct 2026)
- The Ministry says it was created by an Act of the Legislature in 1981 and is responsible for the promotion, administration, development, regulation and control of the Decent Work Act and the Labour Practices Law — mol.gov.lr (accessed 18 Oct 2026)
- The Authority describes itself as the statutory arm of the Government responsible for ensuring that medicines and health products circulating in Liberia are safe and efficacious, officially established on 29 September 2010; its site lists a quality control laboratory with physio-chemical, micro-chemical, cosmetics and metrology laboratories, together with licensing and inspections sections — lmhra.gov.lr (accessed 18 Oct 2026)
- LACRA says it was established to replace the Liberian Produce Marketing Corporation and is mandated by Liberian law as regulator of agricultural trade, overseeing production, quality control and export of cocoa, coffee and oil palm and setting and enforcing standards so that products meet national and international quality requirements; its pages name no ISO standard — lacra.gov.lr (accessed 18 Oct 2026)
- The Ministry's site lists Regulations Governing Tailing Storage Facilities Management under the Mineral, Mining and Environmental Protection Law of the Republic of Liberia 2024 (Version 1.0), regulations on groundwater exploration and borehole drilling permits, river sand mining regulations and its digital licensing procedures — mme.gov.lr (accessed 18 Oct 2026)
- The Commission's site refers to the 2015 Electricity Law and publishes electricity and micro utility licensing application forms and consumer complaint procedures; its pages name no ISO standard — lerc.gov.lr (accessed 18 Oct 2026)
- NIC describes itself as the official investment promotion and facilitation agency of the Republic of Liberia, offering site selection, incentives and single-window support for regulatory clearances, and lists agribusiness, infrastructure and logistics, tourism, free zones and industrial parks, and mining sites for iron ore, gold, diamonds and other minerals; its pages do not ask investors for ISO certificates — nic.gov.lr; moci.gov.lr (accessed 18 Oct 2026)
- The Authority says it is a semi-public autonomous corporation created by an act of the Legislature on 20 December 1976 to manage and conserve the forests and related resources of the country; its site has sections on legality verification, the FLEGT-VPA and laws and regulations — fda.gov.lr (accessed 18 Oct 2026)
- Accreditation bodies that are signatories of the international mutual recognition arrangements (Global ACI — Global Accreditation Cooperation Incorporated, formerly the IAF MLA) — iaf.nu (accessed 18 Oct 2026)
- Liberia Standards Authority (LiSA), formerly the National Standards Laboratory — moci.gov.lr (accessed 18 Oct 2026)
- Public procurement under the Public Procurement and Concessions Commission (PPCC) — ppcc.gov.lr (accessed 18 Oct 2026)
- Special economic zones under the Special Economic Zones Act of 2017 (Liberia Special Economic Zone Authority) — moci.gov.lr (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Lagos team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Lagos office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice