Where we work · Nigeria
ISO and GRC certification consulting in Nigeria
Achieve ISO and GRC certification in Nigeria with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Lagos office team
- Effivity and Academy included
Sectors that ask for certification in Nigeria
Clients include
ISO and GRC certification in Nigeria at a glance
Nigeria's data protection law now has its own regulator: the Nigeria Data Protection Commission, set up under the Nigeria Data Protection Act, 2023, which gives 12 June 2023 as its commencement date and reaches organisations outside Nigeria that process the personal data of people in Nigeria. The Commission's 2025 implementation directive adds annual audit returns for major data processors and names the ISO 27000 series among the frameworks it grades security against. Around that, the Central Bank of Nigeria issues cybersecurity frameworks for banks and payment firms, NAFDAC registers food, drugs and medical devices, the Standards Organisation of Nigeria runs the MANCAP and SONCAP programmes and the Bureau of Public Procurement keeps the federal contractor database. The Nigeria National Accreditation System is the national accreditation body, and certificates come from accredited certification bodies, never from Sterling. Demand comes from banks, fintechs, BPO and IT firms, telecoms, oil and gas contractors, food and FMCG makers, pharmaceutical firms and public-sector suppliers. Sterling's Lagos office serves clients in Nigeria on-site where the work needs it and remotely otherwise, bringing 20+ years and 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Nigeria
Each page covers who needs the standard in Nigeria, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Nigeria (13)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Nigeria Data Protection Act, 2023 (NDP Act) Nigeria Data Protection Commission (NDPC), established by section 4 of the Act as an independent body with its head office in the Federal Capital Territory | Applies to processing of personal data by automated means or not where the controller or processor is domiciled in, resident in or operating in Nigeria, where processing occurs in Nigeria, or where a controller or processor outside Nigeria processes the personal data of a data subject in Nigeria (section 2). Sets processing principles, lawful bases, consent, a duty to inform, data privacy impact assessment for high-risk processing, written agreements with processors, rights of data subjects, security measures that may include encryption, resilience and regular testing (section 39), breach notification to the Commission within 72 hours where there is a risk to individuals and to data subjects where the risk is high (section 40), and cross-border transfer rules (Part VIII, sections 41 to 43). Data controllers and processors of major importance must register with the Commission and designate a Data Protection Officer. The Commission may license persons to monitor, audit and report on compliance (section 33). The Act contemplates certification mechanisms as one basis for adequacy in cross-border transfers but creates no certificate of compliance and cites no ISO standard. Where another law is inconsistent with the Act on processing of personal data, the Act prevails (section 63). Penalties are set in sections 48 and 49 and are not restated here. | |
| NDP Act General Application and Implementation Directive (NDP Act-GAID) 2025 Nigeria Data Protection Commission (NDPC) | Sets out how the Commission expects the Act to be applied: general compliance measures (Article 7), designation, registration and classification of data controllers and processors of major importance into Ultra-High, Extra-High and Ordinary-High levels (Articles 8 and 9), annual compliance audit returns (Article 10), Data Protection Officer position and semi-annual reporting (Articles 11 to 13), monitoring and maintenance of data security systems (Article 29), breach notification (Article 33), emerging technologies such as artificial intelligence, Internet of Things and blockchain (Article 43) and cross-border transfer (Article 45). Schedule 2, the template for compliance audit returns, grades data security against recognised frameworks and names the ISO 27000 series alongside the NIST SP 800 series, the NIST Cybersecurity Framework, the CIS Critical Security Controls, COBIT and the HITRUST CSF. The Directive says certain filings are to be made through a Data Protection Compliance Organisation licensed by the Commission. Compliance filings show accountability but do not replace evidence in answer to a complaint (Article 48). | |
| Constitution of the Federal Republic of Nigeria, 1999 — right to privacy Courts; the NDP Act names the Constitution as the source of the rights it safeguards (section 1(a)) and the Directive issues under section 37 | Provides the constitutional footing of the NDP Act and its Directive. It cites no standard and creates no certificate. | |
| Central Bank of Nigeria (CBN) Deposit money banks, payment service banks, payment service providers and other financial institutions | CBN's circulars listing records a series of cybersecurity and information-security frameworks: 'Central Bank of Nigeria Risk-Based Cybersecurity Framework and Guidelines for Deposit Money Banks and Payment Service Banks' (reference BSD/DIR/PUB/LAB/017/008, dated 31 May 2024); the earlier 'Issuance of Risk-Based Cybersecurity Framework and Guidelines for Deposit Money Banks and Payment Service Providers' (BSD/DIR/GEN/LAB/11/25, dated 10 October 2018); 'Issuance of Risk-Based Cybersecurity Framework and Guidelines for Other Financial Institutions (OFIs)' (OFI/DOA/CON/ACT/004/155, dated 29 June 2022); and the 'Guideline on Nigerian Payments System Risk and Information Security Management Framework' (PSM/PSI/GEN/CWD/01/028, dated 6 January 2020). Titles, references and dates are as listed on CBN's own circulars list; the framework texts were not opened, so what they say about ISO/IEC 27001 or any other standard is not recorded. | |
| Central Bank of Nigeria (CBN), Banking and Payment Systems departments Deposit money banks, switches and processors | Circular on the Timeline for PCIDSS Certification by all Deposit Money Banks, Switches and Processors (reference BPS/DIR/GEN/CIR/01/004, dated 24 April 2014) — title, reference and date as listed on CBN's circulars list; the circular text was not opened, so the timeline it sets is not recorded. | PCI DSS |
| Central Bank of Nigeria (CBN) Banks, selected other financial institutions and participants in the Nigerian payments system | Two 2026 items on CBN's circulars list: 'Deployment Of Cybersecurity Self-Assessment Tool (CSAT)' (reference CMD/DIR/PUB/ESSD/001/2026, dated 30 March 2026, a letter to banks and selected other financial institutions) and 'Introduction of Market Structure Requirements, Data Localisation, Ultimate Beneficial Ownership Disclosure, and Systemic Oversight' (PSS/DIR/PUB/CIR/001/004, dated 15 June 2026). Titles, references and dates only; the texts were not opened. | |
| National Agency for Food and Drug Administration and Control (NAFDAC) Food, drugs, cosmetics, medical devices, chemicals and packaged water | NAFDAC's laws page lists the NAFDAC Act (Cap. N.1, Laws of the Federation of Nigeria 2004), the Food, Drug and Related Products (Registration) Act (Cap. F.33), which it describes as prohibiting the manufacture, sale, distribution and advertisement of unregistered food, drug, drug product, cosmetic, medical device or water, and the Counterfeit and Fake Drugs and Unwholesome Processed Foods (Miscellaneous Provision) Act (Cap. C.34). NAFDAC's services pages cover product registration and facility inspection including GMP inspections, and its food pages list guidelines on food hygienic practices. NAFDAC states that a certificate of registration is issued after registration review. | |
| Standards Organisation of Nigeria (SON) Locally manufactured and imported goods; standards, metrology and laboratories | SON states it was established by the SON Act No. 14 of 2015, which repeals the Cap. S9 Act of 2004. SON's mandate page lists the mandatory SONCAP programme for imported goods, the mandatory MANCAP programme for locally manufactured products and mandatory product registration, and powers to designate and approve standards, organise tests, and maintain reference standards for calibration. SON's MANCAP FAQ calls MANCAP a product certification scheme for locally manufactured products, with a certificate valid for a set period and regular factory inspections. | |
| National Environmental Standards and Regulations Enforcement Agency (NESREA) Industry, manufacturing and any activity affecting the environment | NESREA's site lists the NESREA Act and an amended NESREA Act, describes the Agency as responsible for protection and development of the environment and for enforcement of environmental standards, regulations, rules, laws, policies and guidelines, and lists environmental permits, environmental audit and environmental consultant certification among its services. The Act texts were not opened. | |
| Nigeria Social Insurance Trust Fund (NSITF) Employers (work-related injury, disease and death compensation; workplace safety) | NSITF states its mandate rests on the Employees' Compensation Act 2010 and lists compensation, prevention (occupational safety and health audits, inspections and awareness campaigns), rehabilitation and employer compliance among its services. The Act text was not opened. | |
| Independent Corrupt Practices and Other Related Offences Commission (ICPC) Public and private bodies exposed to bribery and corruption risk | ICPC describes itself as established under the ICPC Act 2000 to investigate and prosecute offenders, improve public sector systems and educate the public, and lists a System Study and Review of MDAs among its activities. The Act text was not opened. | |
| National Automotive Design and Development Council (NADDC) Automotive assemblers and component makers | NADDC states it was established by Act No. 6 of 30 May 2014 as a statutory parastatal of the Federal Ministry of Industry, Trade and Investment, and refers to the Nigerian Automotive Industry Development Plan and to its own accredited testing laboratories. The Act and Plan texts were not opened. | |
| Nigerian Civil Aviation Authority (NCAA) Airlines, aviation maintenance and aviation-related operators | NCAA states it became autonomous under the Civil Aviation Act 2006 and lists the Civil Aviation Act 2022 and the Nigeria Civil Aviation Regulations (Nig.CARs) 2023 on its site. The texts were not opened. |
Accreditation and recognition
- Nigeria National Accreditation System (NiNAS): National accreditation body — NiNAS states on its own site that it is Nigeria's national accreditation body, accrediting conformity assessment bodies against the relevant ISO standards and guides; it describes itself as the sole national accreditation body charged with accreditation of conformity assessment activities (the site uses both 'Nigeria National Accreditation System' and 'Nigerian National Accreditation System').
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Cities
Tenders and procurement
- Federal public procurement and the national database of contractors, consultants and service providers (Bureau of Public Procurement (BPP), established by the Public Procurement Act 2007): BPP states the Public Procurement Act 2007 established it as the regulatory authority for monitoring and oversight of public procurement, publishes revised standard bidding documents and a list of debarred vendors, and runs a registration system for federal contractors. Its published registration procedure asks for company, compliance, directors, parent company, business category, professional association, financial, personnel, completed jobs and equipment information and does not list ISO certificates; any certificate requirement sits in the individual bidding document.
- Nigerian Oil and Gas Industry Content Joint Qualification System (NOGIC JQS) (Nigerian Content Development and Monitoring Board (NCDMB), established under the Nigerian Oil and Gas Industry Content Development Act, 2010): The NOGIC JQS site says the system was created under section 55 of the Act as the sole system for Nigerian content registration and pre-qualification of contractors in the oil and gas industry, verifying capacities and capabilities and ranking companies on capability and Nigerian content. Its registration requirement lists corporate documents and permits and does not list ISO certificates.
Economic zones
- Free zones licensed and regulated by the Nigeria Export Processing Zones Authority (NEPZA): export manufacturing, oil and gas, agribusiness and agro-allied, logistics, ICT
- Lekki Free Zone:
- Calabar Free Trade Zone (CFTZ):
- Ladol Free Zone:
Sterling in Nigeria
Sterling delivers in Nigeria from its Lagos office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in Nigeria, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions Nigerian clients ask
Which accreditation should a certification body hold for Nigeria?
Look for accreditation by the Nigeria National Accreditation System, which describes itself as the national accreditation body. Global ACI lists it as a mutual recognition signatory, with management systems recognition from October 2025 for ISO 9001, ISO 14001, ISO 45001 and ISO 22000. ISO/IEC 27001 and several other standards appear there without a recognition date, so ask the certification body to show its accreditation certificate and scope for yours.
Is the Nigeria Data Protection Act in force, and who regulates it?
Yes. The Act gives 12 June 2023 as its commencement date, and the Nigeria Data Protection Commission, which it created, regulates it. The Commission publishes the Act, its 2025 implementation directive, a register of controllers and processors of major importance and a list of licensed compliance organisations. Check current obligations for your organisation with your counsel or the Commission.
Which Central Bank of Nigeria frameworks deal with cybersecurity?
The Central Bank's circulars list records risk-based cybersecurity frameworks for deposit money banks and payment service banks (revised in May 2024), an earlier one for payment service providers in 2018, one for other financial institutions in 2022 and a payments system risk and information security guideline from 2020. In 2026 it also listed a cybersecurity self-assessment tool and a data localisation circular. Read the current texts with the Central Bank before relying on any summary.
Do Nigerian government tenders require ISO certificates?
Not as a blanket rule. The Bureau of Public Procurement's registration procedure for federal contractors asks for company, financial, personnel and completed-jobs information and does not list ISO certificates, and the oil and gas joint qualification system's published requirements list corporate documents and permits. A bidding document may still ask for a certificate, so read the qualification clause of each tender before deciding.
Are certification audits in Nigeria conducted in English?
Yes, normally. Contracts, standards and certification documents are written in English, which the Constitution also makes the working language of the National Assembly and of State Houses of Assembly; Hausa, Ibo and Yoruba are added in the National Assembly when arrangements allow. For interviews on the factory floor, tell the certification body early if staff will answer in another language so an interpreter can be arranged.
Does MANCAP or NAFDAC registration replace ISO certification?
No. MANCAP is a product certification scheme run by the Standards Organisation of Nigeria for locally manufactured goods, and NAFDAC registration is a licence to make or sell regulated products; neither certifies a management system. They can sit alongside an ISO certificate, which an accredited certification body issues. Ask each agency which of its requirements apply to your product line.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Nigeria Data Protection Act, 2023 (NDP Act) — ndpc.gov.ng (accessed 11 Oct 2026)
- NDP Act General Application and Implementation Directive (NDP Act-GAID) 2025 — ndpc.gov.ng (accessed 11 Oct 2026)
- Constitution of the Federal Republic of Nigeria, 1999 — right to privacy — justice.gov.ng (accessed 11 Oct 2026)
- CBN's circulars listing records a series of cybersecurity and information-security frameworks: 'Central Bank of Nigeria Risk-Based Cybersecurity Framework and Guidelines for Deposit Money Banks and Payment Service Banks' (reference BSD/DIR/PUB/LAB/017/008, dated 31 May 2024); the earlier 'Issuance of Risk-Based Cybersecurity Framework and Guidelines for Deposit Money Banks and Payment Service Providers' (BSD/DIR/GEN/LAB/11/25, dated 10 October 2018); 'Issuance of Risk-Based Cybersecurity Framework and Guidelines for Other Financial Institutions (OFIs)' (OFI/DOA/CON/ACT/004/155, dated 29 June 2022); and the 'Guideline on Nigerian Payments System Risk and Information Security Management Framework' (PSM/PSI/GEN/CWD/01/028, dated 6 January 2020). Titles, references and dates are as listed on CBN's own circulars list; the framework texts were not opened, so what they say about ISO/IEC 27001 or any other standard is not recorded. — cbn.gov.ng (accessed 11 Oct 2026)
- Circular on the Timeline for PCIDSS Certification by all Deposit Money Banks, Switches and Processors (reference BPS/DIR/GEN/CIR/01/004, dated 24 April 2014) — cbn.gov.ng (accessed 11 Oct 2026)
- Two 2026 items on CBN's circulars list: 'Deployment Of Cybersecurity Self-Assessment Tool (CSAT)' (reference CMD/DIR/PUB/ESSD/001/2026, dated 30 March 2026, a letter to banks and selected other financial institutions) and 'Introduction of Market Structure Requirements, Data Localisation, Ultimate Beneficial Ownership Disclosure, and Systemic Oversight' (PSS/DIR/PUB/CIR/001/004, dated 15 June 2026). Titles, references and dates only; the texts were not opened. — cbn.gov.ng (accessed 11 Oct 2026)
- NAFDAC's laws page lists the NAFDAC Act (Cap. N.1, Laws of the Federation of Nigeria 2004), the Food, Drug and Related Products (Registration) Act (Cap. F.33), which it describes as prohibiting the manufacture, sale, distribution and advertisement of unregistered food, drug, drug product, cosmetic, medical device or water, and the Counterfeit and Fake Drugs and Unwholesome Processed Foods (Miscellaneous Provision) Act (Cap. C.34). NAFDAC's services pages cover product registration and facility inspection including GMP inspections, and its food pages list guidelines on food hygienic practices. NAFDAC states that a certificate of registration is issued after registration review. — nafdac.gov.ng (accessed 11 Oct 2026)
- SON states it was established by the SON Act No. 14 of 2015, which repeals the Cap. S9 Act of 2004. SON's mandate page lists the mandatory SONCAP programme for imported goods, the mandatory MANCAP programme for locally manufactured products and mandatory product registration, and powers to designate and approve standards, organise tests, and maintain reference standards for calibration. SON's MANCAP FAQ calls MANCAP a product certification scheme for locally manufactured products, with a certificate valid for a set period and regular factory inspections. — son.gov.ng (accessed 11 Oct 2026)
- NESREA's site lists the NESREA Act and an amended NESREA Act, describes the Agency as responsible for protection and development of the environment and for enforcement of environmental standards, regulations, rules, laws, policies and guidelines, and lists environmental permits, environmental audit and environmental consultant certification among its services. The Act texts were not opened. — nesrea.gov.ng (accessed 11 Oct 2026)
- NSITF states its mandate rests on the Employees' Compensation Act 2010 and lists compensation, prevention (occupational safety and health audits, inspections and awareness campaigns), rehabilitation and employer compliance among its services. The Act text was not opened. — nsitf.gov.ng (accessed 11 Oct 2026)
- ICPC describes itself as established under the ICPC Act 2000 to investigate and prosecute offenders, improve public sector systems and educate the public, and lists a System Study and Review of MDAs among its activities. The Act text was not opened. — icpc.gov.ng (accessed 11 Oct 2026)
- NADDC states it was established by Act No. 6 of 30 May 2014 as a statutory parastatal of the Federal Ministry of Industry, Trade and Investment, and refers to the Nigerian Automotive Industry Development Plan and to its own accredited testing laboratories. The Act and Plan texts were not opened. — naddc.gov.ng (accessed 11 Oct 2026)
- NCAA states it became autonomous under the Civil Aviation Act 2006 and lists the Civil Aviation Act 2022 and the Nigeria Civil Aviation Regulations (Nig.CARs) 2023 on its site. The texts were not opened. — ncaa.gov.ng (accessed 11 Oct 2026)
- Nigeria National Accreditation System (NiNAS) — global-aci.org; ninas.ng (accessed 11 Oct 2026)
- Federal public procurement and the national database of contractors, consultants and service providers — bpp.gov.ng; bpp-storage.s3.eu-west-2.amazonaws.com (accessed 11 Oct 2026)
- Nigerian Oil and Gas Industry Content Joint Qualification System (NOGIC JQS) — nogicjqs.gov.ng (accessed 11 Oct 2026)
- Free zones licensed and regulated by the Nigeria Export Processing Zones Authority (NEPZA) — nepza.gov.ng
- Lekki Free Zone — nepza.gov.ng
- Calabar Free Trade Zone (CFTZ) — nepza.gov.ng
- Ladol Free Zone — nepza.gov.ng
Talk to a consultant
Plan your certification with the Lagos team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Lagos office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice