Where we work · Mozambique
ISO and GRC certification consulting in Mozambique
Achieve ISO and GRC certification in Mozambique with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 20 standards, one team
- Accredited certification route
- Johannesburg office team
- Effivity and Academy included
Sectors that ask for certification in Mozambique
- Banks, payment providers and other regulated financial institutions
- Data centre, cloud, telecoms and digital platform operators
- Petroleum, natural gas and their contractors
- Mining, mineral processing and electricity producers
- Fisheries, seafood processing and food manufacturing
- Construction and engineering contractors
Clients include
ISO and GRC certification in Mozambique at a glance
Regulators in Mozambique have recently written security, resilience and certification into the rules for banks, data centres and energy operators. The Banco de Moçambique's Aviso n.º 6/GBM/2026 keeps primary bank data centres inside the country and tells credit institutions to contract only providers with accredited, relevant certifications, while INTIC licenses data centre, cloud and digital platform operators and the Cybersecurity Law, Lei n.º 13/2026, is in force. The Petroleum Law and its Regulation of Petroleum Operations put technical, environmental, health and safety rules in the hands of INP, and the Labour Law makes safety committees compulsory in construction, extractive, metallurgy and oil and gas work. Seafood processors follow HACCP-based self-control under Decreto n.º 80/2020, and ANARME has reached WHO maturity level 3 for medicines regulation. There is no national accreditation body, because SADCAS serves Mozambique, so check the mark and scope on every certificate. Sterling's Johannesburg office supports Mozambican clients on site where the work needs it and remotely otherwise, drawing on 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included.
ISO and GRC standards Sterling delivers in Mozambique
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Mozambique (12)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Banco de Moçambique Banks, microfinance banks, e-money institutions and other credit institutions | Aviso n.º 6/GBM/2026, dated 18 August 2026 and published in the Boletim da República, I Série, Número 166, of 31 August 2026 — sets procedures and requirements for data processing and storage by credit institutions and financial companies and for the operators of their data centres; primary data centres and core systems stay in national territory, secondary centres abroad need authorisation, bank information goes only to private clouds, providers need a licence or registration and accredited, relevant certifications, and applications cover cyber and information security and business continuity and disaster recovery; institutions in activity adapt within a transitional period and report an inventory of systems, data centres and cloud contracts; it repeals Aviso n.º 4/GGBM/2003. | ISO/IEC 27001, ISO 22301, ISO/IEC 20000-1 |
| Banco de Moçambique Payment systems and card networks | National Payment System Law, Lei n.º 2/2008 of 27 February — the Bank oversees the National Payment System to promote security and efficiency and reduce systemic risk, following the international Principles for Financial Market Infrastructures. | PCI DSS, ISO/IEC 27001 |
| INTIC (Instituto Nacional de Tecnologias de Informação e Comunicação, IP) Data centres, cloud providers, digital platforms and intermediary electronic service providers | Electronic Transactions Law, Lei n.º 3/2017 of 9 January, with the registration and licensing regulation approved by Decreto n.º 59/2023 and amended by Decreto n.º 44/2025; the Aviso above names a Data Centres Regulation (Decreto n.º 71/2025) and a Cloud Computing Regulation (Decreto n.º 72/2025); INTIC's chair said in June 2026 that about 170 entities were registered and that the first 19 licences had been awarded. | ISO/IEC 27001, ISO 22301, ISO/IEC 20000-1 |
| Ministry of Communications and Digital Transformation, with INTIC and the National CSIRT Cybersecurity and critical information infrastructure | Cybersecurity Law (Lei n.º 13/2026 of 1 July) and Cybercrime Law (Lei n.º 14/2026 of 1 July), both in force according to INTIC's news item, which says the first covers protection of data networks, information systems and critical infrastructure; the national incident response team operates under INTIC within the National Cybersecurity Policy approved by Resolução n.º 69/2021. | ISO/IEC 27001, ISO 22301 |
| INCM (Autoridade Reguladora das Comunicações) Telecommunications and postal operators | INCM states that it regulates, supervises, inspects and enforces rules in the postal and telecommunications sectors; its site offers licensing, type-approved equipment lists and a consumer complaints service. | ISO/IEC 27001, ISO 9001 |
| INP (Instituto Nacional de Petróleo), the Petroleum Regulatory Authority Petroleum and natural gas operations | Petroleum Law (Lei n.º 8/2026 of 3 June) with the Regulation of Petroleum Operations and INP's organic statute approved by the Council of Ministers; the regulation covers technical, economic, environmental, health and safety, inspection, audit and reporting rules; the Local Content Law (Lei n.º 9/2026 of 3 June) has its own regulation and a local content authority. | ISO 45001, ISO 14001, ISO 9001 |
| Ministry of Mineral Resources and Energy (MIREME) Mining, fuels and electricity | The ministry's national directorates cover geology and mines, hydrocarbons and fuels, and energy, and its site publishes legislation, regulations and contracts by area including mining, electricity and renewable energy. | ISO 45001, ISO 14001, ISO 50001 |
| Instituto Nacional de Inspecção do Pescado, IP Fishery products and seafood processing | Decreto n.º 80/2020 of 8 September approving the Regulation for Hygiene and Sanitary Control of Fishery Products — designates the Institute as competent authority and requires operators to run permanent self-control processes based on HACCP principles or equivalent. | HACCP, ISO 22000, FSSC 22000 |
| ANARME, IP (Autoridade Nacional Reguladora de Medicamentos) Medicines and vaccines | MISAU reported in August 2026 that Mozambique reached WHO maturity level 3 for the regulation of imported medicines and vaccines, placing ANARME among African regulators whose systems the WHO assessment rates stable, functional and integrated. | ISO 13485, ISO/IEC 17025, ISO 9001 |
| General Labour Inspectorate Employers in all sectors, with compulsory safety committees in activities of exceptional risk | Labour Law, Lei n.º 13/2023 of 25 August (repeals Lei n.º 23/2007) — workplace hygiene, health and safety duties, prevention of accidents and occupational diseases, and compulsory safety committees in construction, extractive, metallurgy, excavation, oil and gas, explosives transport, electricity, toxic products and quarries. | ISO 45001 |
| Ministry of Land and Environment Activities subject to environmental impact assessment | Decreto n.º 54/2015 of 31 December on the environmental impact assessment process and Diploma Ministerial n.º 118/2022 of 21 November, which requires independent specialist review of category A+ assessments. | ISO 14001 |
| Council of Ministers and the Assembly of the Republic (anti-corruption framework) Integrity of public office-holders and State-linked companies | Lei n.º 6/2004 of 17 June on complementary anti-corruption mechanisms and Resolução n.º 46/2022 of 1 December approving the Strategy for Preventing and Combating Corruption in the Public Administration for 2023 to 2032, which includes an objective to involve the private sector. | ISO 37001, ISO 37301 |
Accreditation and recognition
- Southern African Development Community Accreditation Services (SADCAS): Multi-economy accreditation body, registered in 2005 under the Botswana Companies Act, 2003 and approved by the SADC Council of Ministers in August 2007; SADCAS names Mozambique among the SADC economies without a national accreditation body that it serves.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Petroleum concession rounds run by INP (INP (Instituto Nacional de Petróleo) on behalf of the Ministry of Mineral Resources and Energy): INP announces concession rounds and says applicants need deep technical and financial capacity, a full understanding of the rules and policies in force, and the ability to prepare sound and economically viable proposals. The page does not ask for ISO certificates, so buyers and operators set supplier requirements themselves; the Local Content Law and its regulation shape how national suppliers take part.
Sterling in Mozambique
Sterling delivers in Mozambique from its Johannesburg office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Mozambique clients ask
Does Mozambique have a national accreditation body?
No. SADCAS names Mozambique among the SADC economies without a national accreditation body and serves it instead. Its Mozambique page lists INNOQ as the national focal point and shows laboratories it has accredited. Its management system recognition covers quality, environmental, occupational health and safety and food safety, so read the accreditation mark and scope on any certificate you plan to rely on.
Where must a Mozambican bank keep its primary data centre?
In national territory. Aviso n.º 6/GBM/2026 of the Banco de Moçambique says credit institutions keep primary data centres and core systems in Mozambique, and secondary centres abroad need the Bank's authorisation. Bank information in the cloud goes only to private clouds. Providers need a licence or registration plus accredited, relevant certifications. Put questions on your own set-up to the Bank's prudential supervision department.
Who licenses data centre and cloud operators in Mozambique?
INTIC, the national information and communication technology institute, registers and licenses them under the Electronic Transactions Law and its regulations. Its chair said in June 2026 that about 170 entities were registered and the first 19 licences had been awarded. Operators serving banks also face the Banco de Moçambique's rule that providers hold a licence or registration. Check your own status with INTIC.
Which authority controls the hygiene of fishery products in Mozambique?
The Instituto Nacional de Inspecção do Pescado, IP, which Decreto n.º 80/2020 designates as the competent authority for hygiene and sanitary control of fishery products. The regulation makes operators run permanent self-control processes based on HACCP principles or equivalent, with up-to-date documents and proof of application. It does not make ISO 22000 certification compulsory.
Are workplace safety committees compulsory in Mozambique?
In some activities, yes. Under Lei n.º 13/2023, the Labour Law, safety committees are optional in general but compulsory in activities of exceptional risk, including construction, extractive, metallurgy, oil and gas, electricity, explosives transport and quarries. The General Labour Inspectorate supervises hygiene and safety duties. Ask the Inspectorate whether your activity counts as exceptional risk.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Aviso n.º 6/GBM/2026, dated 18 August 2026 and published in the Boletim da República, I Série, Número 166, of 31 August 2026 — bancomoc.mz (accessed 18 Oct 2026)
- National Payment System Law, Lei n.º 2/2008 of 27 February — bancomoc.mz (accessed 18 Oct 2026)
- Electronic Transactions Law, Lei n.º 3/2017 of 9 January, with the registration and licensing regulation approved by Decreto n.º 59/2023 and amended by Decreto n.º 44/2025; the Aviso above names a Data Centres Regulation (Decreto n.º 71/2025) and a Cloud Computing Regulation (Decreto n.º 72/2025); INTIC's chair said in June 2026 that about 170 entities were registered and that the first 19 licences had been awarded — intic.gov.mz (accessed 18 Oct 2026)
- Cybersecurity Law (Lei n.º 13/2026 of 1 July) and Cybercrime Law (Lei n.º 14/2026 of 1 July), both in force according to INTIC's news item, which says the first covers protection of data networks, information systems and critical infrastructure; the national incident response team operates under INTIC within the National Cybersecurity Policy approved by Resolução n.º 69/2021 — intic.gov.mz; ncsirt.mz (accessed 18 Oct 2026)
- INCM states that it regulates, supervises, inspects and enforces rules in the postal and telecommunications sectors; its site offers licensing, type-approved equipment lists and a consumer complaints service — incm.gov.mz (accessed 18 Oct 2026)
- Petroleum Law (Lei n.º 8/2026 of 3 June) with the Regulation of Petroleum Operations and INP's organic statute approved by the Council of Ministers; the regulation covers technical, economic, environmental, health and safety, inspection, audit and reporting rules; the Local Content Law (Lei n.º 9/2026 of 3 June) has its own regulation and a local content authority — inp.gov.mz (accessed 18 Oct 2026)
- The ministry's national directorates cover geology and mines, hydrocarbons and fuels, and energy, and its site publishes legislation, regulations and contracts by area including mining, electricity and renewable energy — mireme.gov.mz (accessed 18 Oct 2026)
- Decreto n.º 80/2020 of 8 September approving the Regulation for Hygiene and Sanitary Control of Fishery Products — faolex.fao.org (accessed 18 Oct 2026)
- MISAU reported in August 2026 that Mozambique reached WHO maturity level 3 for the regulation of imported medicines and vaccines, placing ANARME among African regulators whose systems the WHO assessment rates stable, functional and integrated — misau.gov.mz (accessed 18 Oct 2026)
- Labour Law, Lei n.º 13/2023 of 25 August (repeals Lei n.º 23/2007) — faolex.fao.org (accessed 18 Oct 2026)
- Decreto n.º 54/2015 of 31 December on the environmental impact assessment process and Diploma Ministerial n.º 118/2022 of 21 November, which requires independent specialist review of category A+ assessments — faolex.fao.org (accessed 18 Oct 2026)
- Lei n.º 6/2004 of 17 June on complementary anti-corruption mechanisms and Resolução n.º 46/2022 of 1 December approving the Strategy for Preventing and Combating Corruption in the Public Administration for 2023 to 2032, which includes an objective to involve the private sector — faolex.fao.org (accessed 18 Oct 2026)
- Southern African Development Community Accreditation Services (SADCAS) — sadcas.org (accessed 18 Oct 2026)
- Petroleum concession rounds run by INP — inp.gov.mz (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Johannesburg team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Johannesburg office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice