Where we work · Morocco
ISO and GRC certification consulting in Morocco
Achieve ISO and GRC certification in Morocco with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Casablanca office team
- Effivity and Academy included
Sectors that ask for certification in Morocco
Clients include
ISO and GRC certification in Morocco at a glance
Morocco's rules and buyers shape which certificates matter. Personal data sits under Law No. 09-08, enforced by the CNDP, which takes declarations, grants prior authorisations and controls transfers abroad. DGSSI applies the cybersecurity law, Bank Al-Maghrib issues directives for banks, ONSSA oversees food safety, and AMMPS registers medical devices. Accreditation is run by SEMAC, a government service that Global ACI lists as an Associate Member, while IMANOR is the standards body. Demand comes from automotive and aerospace suppliers, agri-food exporters, textile makers, offshoring and business-services firms, and the industrial zones around Tanger Med. Energy-intensive plants must also commission regular energy audits from approved audit bodies, and exporters can draw on a Ministry support programme for certification. Certificates come from accredited certification bodies, never from Sterling. Sterling's Casablanca office serves clients in Morocco on-site where the work needs it and remotely otherwise, bringing 20+ years and 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Morocco
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Morocco (8)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Law No. 09-08 on the protection of individuals with regard to the processing of personal data Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP) | Covers the processing of personal data of individuals by public and private bodies. Processing is either declared to the CNDP or, for the categories the law lists (including sensitive data), authorised in advance by it (Article 12). The CNDP's FAQ states that a body may start a processing only after receiving the declaration receipt or a written authorisation, and the CNDP keeps a public register of notified processing. Data must be collected for set, explicit and legitimate purposes, with the data subject's consent unless an exception applies, and people have rights to be informed, to access, to correct and to object. The controller must apply appropriate technical and organisational measures and bind any processor by a written contract acting only on the controller's instructions (Article 23). Sensitive and health data carry added controls (Articles 21 and 24). Transfers abroad are allowed only to a state ensuring a sufficient level of protection, or under the listed exceptions, and the CNDP's transfer page adds that an authorisation is granted only when the underlying processing was itself declared or authorised (Articles 43 and 44). The law does not require a data protection officer or a notification of breaches to the regulator, and cites no ISO standard. Penalties are set in the law and are not restated here. | |
| Decree No. 2-09-165 applying Law No. 09-08 CNDP | The decree sets out the rules on the appointment of the CNDP's members and on how the Commission works, beside the practical rules for applying the law. Read it with the law and the forms the CNDP publishes for declarations, prior authorisations and transfers abroad. | |
| Direction Générale de la Sécurité des Systèmes d'Information (DGSSI), the national cybersecurity authority Public entities, vital infrastructure operators, telecommunications operators, internet providers, cybersecurity and digital service providers | Law No. 05-20 on cybersecurity sets security rules for the information systems of State administrations, local authorities and public bodies, for vital infrastructure, and for operators such as telecommunications networks, internet providers, cybersecurity service providers, digital service providers and internet platform publishers. It requires entities to take technical and organisational measures, to audit their systems regularly, to audit a system that offers digital services to third parties before it goes live, and lets the national authority have vital infrastructure audited by the authority or by providers it has qualified. DGSSI also publishes the National Information Systems Security Directive (DNSSI) and a list of regulated services and products. The law and the DNSSI text cite no ISO standard. | |
| Bank Al-Maghrib Banks and credit institutions | Bank Al-Maghrib's prudential rules include Directive No. 47/G/2007 of 31 August 2007 on the business continuity plan of credit institutions, Directive No. 49/G/2007 of 31 August 2007 on the compliance function, and Directive No. 4/W/2022 of 19 May 2022 on minimum rules for outsourcing to cloud providers. The cloud directive expects the provider to hold tested continuity plans and certifications that guarantee the quality and security of the services, and makes outsourcing of significant functions subject to Bank Al-Maghrib's prior agreement. The directives do not name an ISO standard. | |
| National Office for the Sanitary Safety of Food Products (ONSSA) Food businesses, food exporters, feed and animal-health operators, and food laboratories | ONSSA was created by Law No. 25-08. Law No. 28-07 on the sanitary safety of food products requires food establishments and businesses to be authorised or approved on sanitary grounds before they operate. Decree No. 2-10-473 refers to the Moroccan standard NM 08.0.002 on HACCP management systems, or an equivalent system, for food-business self-control, and to private laboratories meeting NM ISO/IEC 17025. ONSSA's Order No. 1597-20 requires laboratories doing self-control analysis to hold accreditation to NM ISO/IEC 17025 and sets a period to obtain it after recognition. ONSSA also issues export certification for food products. | HACCP, ISO/IEC 17025, ISO 22000 |
| Agence Marocaine des Médicaments et des Produits de Santé (AMMPS) Medical device makers, importers and distributors | AMMPS was created by Law No. 10-22. Its medical device registration checklist (applicable from 30 January 2025) lists, among the documents for a registration file, an ISO 13485 certificate or equivalent for class IIA, IIB and III devices. | ISO 13485 |
| Ministry of Energy Transition and Sustainable Development, with the Moroccan Agency for Energy Efficiency (AMEE) as secretariat of the approval committee Energy-intensive industrial and tertiary establishments | Decree No. 2-17-746 requires energy-intensive establishments above set consumption thresholds to have a mandatory energy audit at regular intervals, carried out by energy audit bodies the Ministry has approved. The ministry's page does not name ISO 50001. | ISO 50001 |
| National Authority for Probity, Prevention and Fight against Corruption (INPPLC) Anti-corruption and integrity | The Constitution and Law No. 46-19 give the INPPLC the tasks of coordinating and following up corruption prevention policy, and of publishing reference guides that promote integrity in public services and in public and private organisations. Its published pages do not cite ISO 37001. |
Accreditation and recognition
- SEMAC (Service Marocain d'Accréditation), Ministry of Industry and Commerce: National accreditation body — the Ministry's own page says SEMAC is Morocco's sole accreditation body, a government body placed under the final responsibility of the Ministry of Industry and Commerce, with its quality system built on ISO/IEC 17011 and EU Regulation (EC) No 765/2008.
- IMANOR (Institut Marocain de Normalisation): National standards body — the Ministry of Industry and Commerce describes it as the official Moroccan body for standardisation, producing and publishing Moroccan standards (NM), training on them and representing Morocco in international and regional standards bodies. IMANOR is cited here for its standards role only.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public procurement (the Moroccan public procurement portal and the procurement decree) (General Treasury of the Kingdom, which runs the public procurement portal): The procurement decree states that specifications refer to approved Moroccan standards, or to standards applicable in Morocco or international standards where Moroccan ones are lacking, and that competitors file administrative documents such as tax and social-security certificates. It does not set a general ISO certificate requirement; any certificate sought sits in the individual tender document.
- Support programme for the certification of exporting companies (Ministry of Industry and Commerce (General Directorate of Trade), delivered by IMANOR): The Ministry publishes a call for expressions of interest for technical assistance to exporting small businesses and cooperatives seeking certification that gives presumption of conformity with standards and technical rules of export markets. Eligibility turns on company size, trading history, tax and social-security standing and the company's own contribution; check the current call before relying on it.
Economic zones
- Tanger Med industrial hub, run by Tanger Med Zones: automotive, aerospace, electronics, textile, agri-food, offshoring
- Casablanca Finance City (CFC): financial services, business services
- Industrial zones listed on the Ministry of Industry and Commerce's industrial estate platform:
Sterling in Morocco
Sterling delivers in Morocco from its Casablanca office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Morocco clients ask
Is there a personal data protection law in Morocco, and who enforces it?
Yes. Law No. 09-08, promulgated in February 2009, protects individuals when their personal data is processed. The CNDP, Morocco's data protection commission, receives declarations, grants prior authorisations for listed processing such as sensitive data, controls transfers abroad and keeps a public register. Where an answer turns on your own processing, check it against the CNDP's current forms and guidance.
Does SEMAC sign the international recognition arrangements for management system certificates?
Not according to the listings checked. Global ACI and ILAC both list SEMAC, Morocco's national accreditation service, in their Associate category, not as a signatory of the recognition arrangements. Ask the certification body for its accreditation certificate and scope, and confirm that your customer or regulator accepts the accreditation behind it.
Do Moroccan food businesses have to use HACCP?
Decree No. 2-10-473 points food businesses to the Moroccan standard NM 08.0.002 on HACCP management systems, or an equivalent system, and Law No. 28-07 requires establishments to be authorised or approved on sanitary grounds before they operate. ONSSA is the competent office. Confirm the exact duty for your product category with ONSSA before you plan a certification.
Are there cyber security rules for Moroccan companies?
Yes, for defined groups. Law No. 05-20 applies to public entities, vital infrastructure operators and certain operators such as telecommunications and digital service providers, with DGSSI as the national authority. Banks also follow Bank Al-Maghrib directives on business continuity and cloud outsourcing. A private firm outside those groups should check whether a customer or contract imposes the rules.
What are the working week and time zone in Morocco?
State administrations work Monday to Friday, and the weekend is Saturday and Sunday. Morocco uses UTC+1 all year, with a return to GMT during Ramadan, so audit hours shift for that month. Religious holidays follow the lunar calendar and move each year, so agree audit dates with the site and the certification body.
Can audits in Morocco be done in English or French?
Often, since regulators publish in French and some Ministry pages are in English, while Arabic and Amazigh are the official languages. Shop-floor interviews may well run in Arabic or Amazigh. When you apply, settle with the certification body which language the audit, the interpreter and your controlled documents will use.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Law No. 09-08 on the protection of individuals with regard to the processing of personal data — cndp.ma (accessed 17 Oct 2026)
- Decree No. 2-09-165 applying Law No. 09-08 — cndp.ma (accessed 17 Oct 2026)
- Law No. 05-20 on cybersecurity sets security rules for the information systems of State administrations, local authorities and public bodies, for vital infrastructure, and for operators such as telecommunications networks, internet providers, cybersecurity service providers, digital service providers and internet platform publishers. It requires entities to take technical and organisational measures, to audit their systems regularly, to audit a system that offers digital services to third parties before it goes live, and lets the national authority have vital infrastructure audited by the authority or by providers it has qualified. DGSSI also publishes the National Information Systems Security Directive (DNSSI) and a list of regulated services and products. The law and the DNSSI text cite no ISO standard. — dgssi.gov.ma (accessed 17 Oct 2026)
- Bank Al-Maghrib's prudential rules include Directive No. 47/G/2007 of 31 August 2007 on the business continuity plan of credit institutions, Directive No. 49/G/2007 of 31 August 2007 on the compliance function, and Directive No. 4/W/2022 of 19 May 2022 on minimum rules for outsourcing to cloud providers. The cloud directive expects the provider to hold tested continuity plans and certifications that guarantee the quality and security of the services, and makes outsourcing of significant functions subject to Bank Al-Maghrib's prior agreement. The directives do not name an ISO standard. — bkam.ma (accessed 17 Oct 2026)
- ONSSA was created by Law No. 25-08. Law No. 28-07 on the sanitary safety of food products requires food establishments and businesses to be authorised or approved on sanitary grounds before they operate. Decree No. 2-10-473 refers to the Moroccan standard NM 08.0.002 on HACCP management systems, or an equivalent system, for food-business self-control, and to private laboratories meeting NM ISO/IEC 17025. ONSSA's Order No. 1597-20 requires laboratories doing self-control analysis to hold accreditation to NM ISO/IEC 17025 and sets a period to obtain it after recognition. ONSSA also issues export certification for food products. — onssa.gov.ma (accessed 17 Oct 2026)
- AMMPS was created by Law No. 10-22. Its medical device registration checklist (applicable from 30 January 2025) lists, among the documents for a registration file, an ISO 13485 certificate or equivalent for class IIA, IIB and III devices. — ammps.gov.ma (accessed 17 Oct 2026)
- Decree No. 2-17-746 requires energy-intensive establishments above set consumption thresholds to have a mandatory energy audit at regular intervals, carried out by energy audit bodies the Ministry has approved. The ministry's page does not name ISO 50001. — mem.gov.ma (accessed 17 Oct 2026)
- The Constitution and Law No. 46-19 give the INPPLC the tasks of coordinating and following up corruption prevention policy, and of publishing reference guides that promote integrity in public services and in public and private organisations. Its published pages do not cite ISO 37001. — inpplc.ma (accessed 17 Oct 2026)
- SEMAC (Service Marocain d'Accréditation), Ministry of Industry and Commerce — mcinet.gov.ma; global-aci.org; ilac.org (accessed 17 Oct 2026)
- IMANOR (Institut Marocain de Normalisation) — mcinet.gov.ma (accessed 17 Oct 2026)
- Public procurement (the Moroccan public procurement portal and the procurement decree) — marchespublics.gov.ma (accessed 17 Oct 2026)
- Support programme for the certification of exporting companies — mcinet.gov.ma (accessed 17 Oct 2026)
- Tanger Med industrial hub, run by Tanger Med Zones — tangermed.ma (accessed 17 Oct 2026)
- Casablanca Finance City (CFC) — casablancafinancecity.com (accessed 17 Oct 2026)
- Industrial zones listed on the Ministry of Industry and Commerce's industrial estate platform — mcinet.gov.ma (accessed 17 Oct 2026)
Talk to a consultant
Plan your certification with the Casablanca team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Casablanca office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice