Where we work · Namibia
ISO and GRC certification consulting in Namibia
Achieve ISO and GRC certification in Namibia with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 20 standards, one team
- Accredited certification route
- Johannesburg office team
- Effivity and Academy included
Sectors that ask for certification in Namibia
Clients include
ISO and GRC certification in Namibia at a glance
Payment providers meet the most specific cyber rules in Namibia. The Bank of Namibia's determination on operational and cybersecurity standards, published in Government Gazette No. 8968, applies to payment service providers and payment system operators and asks for board oversight, annual penetration tests and assurance over outsourced services, where independent third-party certifications are one accepted route. Its earlier determination on localisation of core banking systems keeps banks' core systems inside the country. The Communications Regulatory Authority of Namibia hosts NAM-CSIRT, whose 2026 incident management guidelines point organisations to ISO/IEC 27001 and PCI DSS, while the Namibian Standards Institution develops national standards under the Standards Act, 2005. Demand also comes from mining and quarrying, agriculture and fisheries, manufacturing, energy, logistics and tourism. Namibia has no national accreditation body; SADCAS serves it, and certificates come from accredited certification bodies, never from Sterling. Sterling's Johannesburg office serves Namibian organisations on site where the work needs it and remotely otherwise, with 8,100+ client engagements in 60+ countries, 20+ years of experience, and Effivity and Sterling Academy included.
ISO and GRC standards Sterling delivers in Namibia
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Namibia (10)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Bank of Namibia Payment service providers, payment system operators and their suppliers | Determination on the Operational and Cybersecurity Standards within the National Payment System (PSD-12), issued under section 45 of the Payment System Management Act, 2023 (Act No. 14 of 2023) and published in Government Gazette No. 8968 of 3 July 2026 (General Notice 501), effective on publication. It applies to payment service providers and payment system operators and, by its scope paragraph, to financial market infrastructures, non-bank financial institutions, participants and retail payment systems such as electronic funds transfers, payment cards and e-money. It asks the board to own information security, cybersecurity and operational resilience; a security officer with reporting access to the board; a framework reviewed at least once every three years or after a significant change and checked through independent audits; regular vulnerability assessments and penetration tests at least annually; security monitoring through a Security Operations Centre or equivalent; a cyber incident response plan tested annually and aligned with recovery objectives; and third-party assurance, where alternatives include independent third-party certifications and compliance attestations. It names no ISO or PCI standard. | ISO/IEC 27001, ISO 22301, SOC 2, PCI DSS, ISO/IEC 20000-1 |
| Bank of Namibia Banks and other banking institutions | Determination on Localization of Core Banking Systems (BID-19), issued by the Governor under the Banking Institutions Act, 1998 (Act No. 2 of 1998) and effective on 11 August 2008, listed among the Bank's determinations on its site. Banking institutions locate and maintain their fault-tolerant core banking systems, where accounting and other banking records are kept, in Namibia, and the systems meet payment system oversight requirements, a high degree of security and operational reliability, acceptable contingency arrangements and Namibian clearing and settlement cut-off times. It names no ISO standard. | ISO/IEC 27001, ISO 22301, ISO/IEC 20000-1 |
| Communications Regulatory Authority of Namibia (CRAN), with NAM-CSIRT Operators of critical information infrastructure, communication service providers and digitally dependent organisations | CRAN is the independent regulator established under section 4 of the Communications Act (No. 8 of 2009) for telecommunications, broadcasting, postal services and radio spectrum; its site also lists the Communications Amendment Act (No. 6 of 2020), and it hosts the Namibia Cyber Security Incident Response Team (NAM-CSIRT). NAM-CSIRT's National Cyber Security Incident Management Guidelines, 2026 (first published April 2026) are described as non-binding but highly instructive, apply to government bodies, operators of critical infrastructure and private entities that rely on digital platforms, encourage alignment with ISO/IEC 27001, PCI DSS and the NIST Cybersecurity Framework 2.0, and ask operators to notify NAM-CSIRT of major incidents. The Electronic Transactions Act, 2019 (Act No. 4 of 2019) names CRAN as the Authority. | ISO/IEC 27001, PCI DSS, ISO/IEC 42001 |
| Namibia Financial Institutions Supervisory Authority (NAMFISA) Insurers, retirement funds, capital markets, microlenders and other non-bank financial institutions | Namibia Financial Institutions Supervisory Authority Act, 2001 (Act No. 3 of 2001) — NAMFISA supervises financial institutions and services, advises the Minister of Finance, and supervises, monitors and enforces compliance with the Financial Intelligence Act, 2012 (Act No. 12 of 2012) for the accountable and reporting institutions under its supervision; its site names capital markets, friendly societies, insurance and medical aid funds, microlending and retirement funds among the industries it regulates and offers a regulatory sandbox. Its mandate page names no management system standard. | ISO 37301, ISO 37001 |
| Namibian Standards Institution (NSI) National standards: all sectors | Standards Act, 2005 (Act No. 18 of 2005) — the Institution prepares, issues and promotes Namibian standards (NAMS) in line with Annex 3 of the WTO Agreement on Technical Barriers to Trade, supplies standards information and training, and serves as Namibia's WTO TBT notification authority and enquiry point. Compliance with a Namibian standard is not compulsory unless the Minister declares it compulsory by regulation; the Cement Regulations under the Act (Government Notice 259 of 11 September 2019) are an example. Its National Standardisation Strategy, launched in October 2025 for 2025–2027, lists services, manufacturing, mining and quarrying, agriculture, fisheries and forestry among priority sectors. | ISO 9001 |
| Namibian Standards Council and Namibian Standards Institution Measuring instruments, calibration and legal metrology | Metrology Act, 2022 (Act No. 5 of 2022), promulgated in Government Gazette No. 7953 of 11 November 2022 — provides for the administration and supervision of metrology, legal units of measurement, national measurement standards comparable to international measurement standards, and type approval and verification of measuring instruments, and designates the Namibian Standards Council as governance board for metrology. | ISO/IEC 17025 |
| Ministry of Environment, Forestry and Tourism (Environmental Commissioner) Activities with significant effects on the environment | Environmental Management Act, 2007 (Act No. 7 of 2007) — the Ministry says the Act aims to prevent and mitigate significant effects of activities on the environment through timely assessment, public participation and use of findings before decisions, and that the Environmental Commissioner receives applications for environmental clearance certificates and decides whether a listed activity needs an assessment. Regulations dated 2012 are published on the Ministry's site. | ISO 14001 |
| Labour Commissioner and labour inspectors under the Labour Act, 2007 Workplaces and employers | Labour Act, 2007 (Act No. 11 of 2007), Government Gazette No. 3971 of 31 December 2007 — provides for health and safety representatives and committees, including a committee on request in a workplace with more than 100 employees, and for labour inspectors to enter premises; the Act names no management system standard. | ISO 45001 |
| Namibian Standards Institution (standards role) Food, fish and meat products | The Institution's catalogue and notices list Namibian standards for chilled finfish, marine molluscs and crustaceans, dried abalone, ready-to-eat processed meat, processed poultry meat and dates, and a notice of 15 June 2026 announces newly developed standards on food products and food safety management; the Institution lists food, agriculture and fisheries as the first of its sector services. | ISO 22000, HACCP, FSSC 22000 |
| Namibian Standards Institution (standards role) Energy-using products and energy supply | The Institution lists energy (oil and gas) among its sector services and its catalogue includes NAMS 110:2025 and NAMS 111:2025, adopted from SADC standards on minimum energy performance of air conditioners and refrigerating appliances. | ISO 50001 |
Accreditation and recognition
- Southern African Development Community Accreditation Services (SADCAS): Multi-economy accreditation body, registered in 2005 under the Botswana Companies Act, 2003 and approved by the SADC Council of Ministers in August 2007; SADCAS names Namibia among the thirteen SADC economies without a national accreditation body that it serves.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public procurement through the Central Procurement Board of Namibia (Central Procurement Board of Namibia (CPBN), established by the Public Procurement Act, 2015 (Act No. 15 of 2015)): The Board conducts bidding for public entities for contracts above the prescribed threshold, enters into those contracts and directs and supervises accounting officers in managing them. It publishes open bids, the Act as amended, regulations and a code of good practice, so quality, safety or security certificates are asked for only where a bid document sets them.
Sterling in Namibia
Sterling delivers in Namibia from its Johannesburg office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Namibia clients ask
Does Namibia have a national accreditation body?
Namibia is served by SADCAS rather than a national body. SADCAS was created under the SADC trade protocol for economies without one, names Namibia among them and shows accredited laboratories and inspection bodies on its Namibia page. Its management system scheme covers quality, environmental, occupational health and safety and food safety, so read each certificate's accreditation mark and scope.
What does the Bank of Namibia expect of payment providers on cybersecurity?
Its PSD-12 determination, published in Government Gazette No. 8968, applies to payment service providers and payment system operators. It asks for board accountability, an independent security officer, regular vulnerability assessments, penetration tests at least annually, a tested incident response plan and assurance over third parties. It names no ISO or PCI standard, so ask the Bank how your licence conditions apply.
Where must banks in Namibia keep their core banking systems?
In Namibia. The Bank of Namibia's BID-19 determination, effective on 11 August 2008, requires banking institutions to locate and maintain their fault-tolerant core banking systems, where accounting and other banking records are kept, inside the country, with strong security, operational reliability and contingency arrangements. It covers banking institutions, so other firms should check their own regulator's expectations.
What do the NAM-CSIRT guidelines say about ISO/IEC 27001?
They encourage operators to align with it. The 2026 National Cyber Security Incident Management Guidelines, first published in April 2026, name ISO/IEC 27001, PCI DSS and the NIST Cybersecurity Framework 2.0 as international standards and practices, and describe themselves as non-binding but highly instructive. Notification of major incidents to NAM-CSIRT is a recommended control, so read the guidelines with your sector regulator's rules.
What is the role of the Namibian Standards Institution?
It prepares, issues and promotes Namibian standards under the Standards Act, 2005, and acts as the national WTO TBT notification authority and enquiry point. Compliance with a Namibian standard is voluntary unless the Minister makes it compulsory by regulation. For ISO management system certificates, look to the accreditation of the certification body rather than to the Institution.
In which language are audits carried out in Namibia?
English in most cases, since it is Namibia's official language and the one used in the Acts, gazettes and guidelines. If interviews with mine, farm, plant or supplier staff work better in another language, arrange an interpreter, and decide the language of controlled documents with the certification body at application.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Determination on the Operational and Cybersecurity Standards within the National Payment System (PSD-12), issued under section 45 of the Payment System Management Act, 2023 (Act No. 14 of 2023) and published in Government Gazette No. 8968 of 3 July 2026 (General Notice 501), effective on publication. It applies to payment service providers and payment system operators and, by its scope paragraph, to financial market infrastructures, non-bank financial institutions, participants and retail payment systems such as electronic funds transfers, payment cards and e-money. It asks the board to own information security, cybersecurity and operational resilience; a security officer with reporting access to the board; a framework reviewed at least once every three years or after a significant change and checked through independent audits; regular vulnerability assessments and penetration tests at least annually; security monitoring through a Security Operations Centre or equivalent; a cyber incident response plan tested annually and aligned with recovery objectives; and third-party assurance, where alternatives include independent third-party certifications and compliance attestations. It names no ISO or PCI standard. — bon.com.na (accessed 18 Oct 2026)
- Determination on Localization of Core Banking Systems (BID-19), issued by the Governor under the Banking Institutions Act, 1998 (Act No. 2 of 1998) and effective on 11 August 2008, listed among the Bank's determinations on its site. Banking institutions locate and maintain their fault-tolerant core banking systems, where accounting and other banking records are kept, in Namibia, and the systems meet payment system oversight requirements, a high degree of security and operational reliability, acceptable contingency arrangements and Namibian clearing and settlement cut-off times. It names no ISO standard. — bon.com.na (accessed 18 Oct 2026)
- CRAN is the independent regulator established under section 4 of the Communications Act (No. 8 of 2009) for telecommunications, broadcasting, postal services and radio spectrum; its site also lists the Communications Amendment Act (No. 6 of 2020), and it hosts the Namibia Cyber Security Incident Response Team (NAM-CSIRT). NAM-CSIRT's National Cyber Security Incident Management Guidelines, 2026 (first published April 2026) are described as non-binding but highly instructive, apply to government bodies, operators of critical infrastructure and private entities that rely on digital platforms, encourage alignment with ISO/IEC 27001, PCI DSS and the NIST Cybersecurity Framework 2.0, and ask operators to notify NAM-CSIRT of major incidents. The Electronic Transactions Act, 2019 (Act No. 4 of 2019) names CRAN as the Authority. — nam-csirt.na; cran.na (accessed 18 Oct 2026)
- Namibia Financial Institutions Supervisory Authority Act, 2001 (Act No. 3 of 2001) — namfisa.com.na (accessed 18 Oct 2026)
- Standards Act, 2005 (Act No. 18 of 2005) — nsi.com.na (accessed 18 Oct 2026)
- Metrology Act, 2022 (Act No. 5 of 2022), promulgated in Government Gazette No. 7953 of 11 November 2022 — nsi.com.na (accessed 18 Oct 2026)
- Environmental Management Act, 2007 (Act No. 7 of 2007) — meft.gov.na (accessed 18 Oct 2026)
- Labour Act, 2007 (Act No. 11 of 2007), Government Gazette No. 3971 of 31 December 2007 — nsi.com.na (accessed 18 Oct 2026)
- The Institution's catalogue and notices list Namibian standards for chilled finfish, marine molluscs and crustaceans, dried abalone, ready-to-eat processed meat, processed poultry meat and dates, and a notice of 15 June 2026 announces newly developed standards on food products and food safety management; the Institution lists food, agriculture and fisheries as the first of its sector services. — nsi.com.na (accessed 18 Oct 2026)
- The Institution lists energy (oil and gas) among its sector services and its catalogue includes NAMS 110:2025 and NAMS 111:2025, adopted from SADC standards on minimum energy performance of air conditioners and refrigerating appliances. — nsi.com.na (accessed 18 Oct 2026)
- Southern African Development Community Accreditation Services (SADCAS) — sadcas.org (accessed 18 Oct 2026)
- Public procurement through the Central Procurement Board of Namibia — cpbn.com.na (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Johannesburg team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Johannesburg office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice