Where we work · Libya
ISO and GRC certification consulting in Libya
Achieve ISO and GRC certification in Libya with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 20 standards, one team
- Accredited certification route
- Dubai office team
- Effivity and Academy included
Sectors that ask for certification in Libya
Clients include
ISO and GRC certification in Libya at a glance
Libyan buyers rarely write ISO into law, so demand follows the sector. The Central Bank of Libya's IT Governance Guideline tells banks, electronic payment companies and branches to build on international practice, naming ISO 27000, ISO/IEC 27001, ISO 22301, ISO 20000 and PCI DSS as references. The Food and Drug Control Centre inspects and tests food and medicines, issues release permits and follows products in the market. The National Oil Corporation publishes a strategy that includes refined products, petrochemicals and higher quality standards, and its group companies advertise tenders. LIBAC is the national accreditation body, with management systems certification bodies among its fields, and the Arab Accreditation Cooperation lists it as an associate member. Msaad Free Zone adds services, industry and petroleum services. Certificates come from accredited certification bodies, never from Sterling. Sterling's Dubai office serves clients in Libya, with 20+ years, 8,100+ client engagements in 60+ countries, and Effivity software and Sterling Academy training included with the engagement.
ISO and GRC standards Sterling delivers in Libya
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Libya (5)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Central Bank of Libya, Banking Supervision Department Banks, electronic payment companies and branches of banks | The bank publishes an IT Governance Guideline (دليل حوكمة تكنولوجيا المعلومات) under circular No. 21 of 2023. It applies to all banks, electronic payment companies and bank branches operating in Libya, to the extent that it fits them, and to outsourced providers through their contracts. It tells boards to build on international practice such as Basel, COBIT, ISO 27000 and ISO 20000 (ITIL), and to draw on ISO/IEC 27001/2, ISO 22301, PCI DSS and ISO 31000 when drafting policies. A section covers the security of electronic payment services such as cash machines and payment cards. It presents these standards as references and does not make a certificate compulsory. | ISO/IEC 27001, ISO 22301, ISO/IEC 20000-1, PCI DSS |
| Food and Drug Control Centre (FDCC) Food, medicines and medical supplies | The Centre's tasks page says it inspects and tests locally produced and imported food and issues the permits for its release, inspects medicines, vaccines, pharmaceutical preparations and medical equipment and supplies, tests them and issues certificates of results and release permits, inspects local food and drug producers and their distribution and storage channels, and follows products after they reach the market. Its powers page lists seizure of products that break the rules and closure of producers, distributors and sellers that do. The pages do not name ISO 22000, HACCP or ISO 13485. | |
| National Oil Corporation (NOC) and its group companies Oil, gas, refining and petrochemicals | The Corporation's website lists nine strategic programmes, among them raising oil and gas output, refined products and petrochemicals, renewable and clean energy, upgrading infrastructure, legislation, policies and standards, and raising the Corporation's quality standards. It states sustainability aims of ending oil spills, using renewable energy and cutting gas flaring to near zero, publishes sustainability and regulation and compliance reports, and has a health and safety department among its policy pages. It names no ISO standard. | |
| Economy ministry (Food Codex page and consumer services) Food safety and consumer protection | The ministry's Food Codex page describes the Codex general principles of food hygiene, which apply along the whole food chain, and recommends a hazard analysis and critical control point approach to strengthen food safety. It notes that Codex texts do not replace national legislation. The page does not make HACCP or ISO 22000 certification compulsory. | |
| Economy ministry, companies department Foreign companies setting up in Libya | The ministry publishes the documents it asks for when a foreign company opens a representative office or a branch, and pages on foreign company licences, joint companies and commercial agencies. Foreign-language documents are legalised abroad and translated by a legal translator in Libya. The pages say nothing about management system certificates. |
Accreditation and recognition
- Libyan Accreditation Centre (LIBAC), the Arabic المركز الليبي للاعتماد: National accreditation body, a public centre with its own legal personality and financial independence.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public tenders published by the National Oil Corporation for its group companies (National Oil Corporation and its subsidiary companies): The tenders page lists open calls issued by group companies for construction works, equipment hire, supplies and refinery projects, each with its own reference and closing date. Requirements are set in each tender document, and the page shows no general ISO certificate rule.
Economic zones
- Msaad Free Zone: financial services, tourism and sports services, industrial services and manufacturing, petroleum services, media and technology, port, storage and cargo airport, exhibitions and conferences
Sterling in Libya
Sterling delivers in Libya from its Dubai office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Libya clients ask
Who accredits certification bodies in Libya, and is the body recognised abroad?
LIBAC, the Libyan Accreditation Centre, is the national accreditation body, and bodies certifying management systems are one of its four fields. The Arab Accreditation Cooperation lists it as an associate member, not as a mutual recognition signatory. Many clients therefore ask for a certification body accredited within the international arrangements; check the scope on the accreditation certificate.
Which Libyan authority controls food and medicines, and what does it inspect?
The Food and Drug Control Centre. It inspects and tests local and imported food and medicines, issues release permits and results certificates, inspects producers, storage and distribution, and follows products after they reach the market. Its published tasks do not name ISO 22000 or HACCP, so ask the Centre which evidence it expects for your product.
Does the Central Bank of Libya expect banks to follow ISO standards?
It points to them as references. Its IT Governance Guideline applies to banks, electronic payment companies and bank branches, and tells them to build on international practice including ISO 27000, ISO 20000, ISO/IEC 27001, ISO 22301 and PCI DSS. It does not make a certificate compulsory, so confirm what your supervisor asks for in an inspection.
Do oil group tenders in Libya require ISO certificates?
No general rule appears on the tenders page of the National Oil Corporation. Group companies issue calls for works, equipment hire and refinery projects, and each tender document sets its own conditions. Read the document and ask the issuing company whether a quality, safety or environmental certificate is needed for pre-qualification.
Can an audit in Libya be held in English?
English is workable at many Libyan organisations, though Arabic leads at regulators and on most sites. Several public bodies, including the central bank, the food and drug control centre and the economy ministry, run English pages. Fix the audit language, any interpreter and the language of controlled documents with the certification body when you apply.
Which working days should audit dates avoid?
Check the site's own working week first: the accreditation centre and the food and drug control centre publish Sunday to Thursday opening hours. Religious holidays follow the lunar calendar and shift every year, so fix audit dates with the site and the certification body well ahead, never from a Gregorian calendar alone.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- The bank publishes an IT Governance Guideline (دليل حوكمة تكنولوجيا المعلومات) under circular No. 21 of 2023. It applies to all banks, electronic payment companies and bank branches operating in Libya, to the extent that it fits them, and to outsourced providers through their contracts. It tells boards to build on international practice such as Basel, COBIT, ISO 27000 and ISO 20000 (ITIL), and to draw on ISO/IEC 27001/2, ISO 22301, PCI DSS and ISO 31000 when drafting policies. A section covers the security of electronic payment services such as cash machines and payment cards. It presents these standards as references and does not make a certificate compulsory. — cbl.gov.ly (accessed 18 Oct 2026)
- The Centre's tasks page says it inspects and tests locally produced and imported food and issues the permits for its release, inspects medicines, vaccines, pharmaceutical preparations and medical equipment and supplies, tests them and issues certificates of results and release permits, inspects local food and drug producers and their distribution and storage channels, and follows products after they reach the market. Its powers page lists seizure of products that break the rules and closure of producers, distributors and sellers that do. The pages do not name ISO 22000, HACCP or ISO 13485. — fdcc.ly (accessed 18 Oct 2026)
- The Corporation's website lists nine strategic programmes, among them raising oil and gas output, refined products and petrochemicals, renewable and clean energy, upgrading infrastructure, legislation, policies and standards, and raising the Corporation's quality standards. It states sustainability aims of ending oil spills, using renewable energy and cutting gas flaring to near zero, publishes sustainability and regulation and compliance reports, and has a health and safety department among its policy pages. It names no ISO standard. — noc.ly (accessed 18 Oct 2026)
- The ministry's Food Codex page describes the Codex general principles of food hygiene, which apply along the whole food chain, and recommends a hazard analysis and critical control point approach to strengthen food safety. It notes that Codex texts do not replace national legislation. The page does not make HACCP or ISO 22000 certification compulsory. — economy.gov.ly (accessed 18 Oct 2026)
- The ministry publishes the documents it asks for when a foreign company opens a representative office or a branch, and pages on foreign company licences, joint companies and commercial agencies. Foreign-language documents are legalised abroad and translated by a legal translator in Libya. The pages say nothing about management system certificates. — economy.gov.ly (accessed 18 Oct 2026)
- Libyan Accreditation Centre (LIBAC), the Arabic المركز الليبي للاعتماد — libac.gov.ly; arabaccreditation.org (accessed 18 Oct 2026)
- Public tenders published by the National Oil Corporation for its group companies — noc.ly (accessed 18 Oct 2026)
- Msaad Free Zone — mfz.gov.ly (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Dubai team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
uae@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice