Where we work · Somalia
ISO and GRC certification consulting in Somalia
Achieve ISO and GRC certification in Somalia with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 20 standards, one team
- Accredited certification route
- Nairobi office team
- Effivity and Academy included
Sectors that ask for certification in Somalia
Clients include
ISO and GRC certification in Somalia at a glance
Somalia's compliance framework is now being written down by regulators that publish their own rules. The National Communications Authority, set up under the National Communications Law of 2017, licenses communications and ICT operators and has issued a National Cybersecurity Compliance Framework that recommends an ISO/IEC 27001 management system for organisations running Critical Information Infrastructure. The Somalia Data Protection Authority supervises Data Protection Act No. 005 (2023) and asks organisations that process personal data to register and report breaches. The Somali Bureau of Standards develops national standards and states that goods entering the country face a mandatory pre-export conformity control. Demand comes from telecommunications and ICT firms, financial services, importers and traders, food and beverage producers, energy and transport operators, health and education providers and suppliers to public programmes. Certificates are issued by accredited certification bodies and usually carry accreditation from another economy within the international arrangements. From its Nairobi office Sterling brings 8,100+ client engagements in 60+ countries and 20+ years to Somali clients, and every engagement includes Effivity and Sterling Academy. Audits and consulting are delivered remotely, or on site where it is practical and safe to do so.
ISO and GRC standards Sterling delivers in Somalia
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Somalia (6)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Data Protection Act No. 005 (2023) Somalia Data Protection Authority (DPA) | The Authority states that organisations that collect, store, use or otherwise process personal data in Somalia must comply, including government institutions, private companies, NGOs, educational institutions, healthcare providers and telecom operators. Its published duties include lawful, fair and transparent processing, valid consent where required, safeguards, respect for data subject rights, breach reporting, registration with the Authority, impact assessments for high-risk processing and processing records. | |
| Regulations issued under the Data Protection Act Somalia Data Protection Authority (DPA) | The Authority states that the Regulations set procedures for the collection, storage, use and protection of personal data and give it the means to carry out its regulatory, supervisory and enforcement functions. Its guidance page lists the Regulations alongside guidance on cross-border transfers, children's data, automated decision-making and profiling, and data security. | |
| National Communications Authority (NCA) Telecommunications, internet, ICT services and cybersecurity | The NCA is the communications regulator established under the National Communications Law of 2 October 2017, with licensing through its Unified Licensing Framework and application-service and infrastructure licence frameworks. Its cybersecurity department leads national cybersecurity regulation and operates SOMCIRT. The National Cybersecurity Compliance Framework (June 2026) sets a mandatory baseline for organisations that use, own or operate Critical Information Infrastructure, recommends an information security management system in accordance with ISO/IEC 27001 and has designated operators submit an annual risk assessment report to the NCA. The National Cybersecurity Risk Management Framework (June 2026) adopts ISO/IEC 27000 terms and cites ISO/IEC 27005 and ISO 31000. | ISO/IEC 27001, ISO 22301, ISO/IEC 20000-1, ISO/IEC 27701 |
| Somali Bureau of Standards (SOBS), under the Ministry of Commerce, Industry and Resources Producers, importers, exporters and standards users across industry and trade | SOBS states that it was established in 2020 under the Standards and Quality Control Act and is mandated to develop, maintain and enforce national standards (Somali Standards, SOS) for products, services and management systems, with open public inquiry periods for comment on draft standards. It describes its Conformity-Based Customs Assessment as a mandatory pre-export conformity control for goods entering Somalia, effective 15 July 2023, with stronger enforcement from 1 January 2025. It states that it is a member of ISO and ARSO. | ISO 9001, ISO 14001, ISO 22000, HACCP, ISO/IEC 17025 |
| Somalia Data Protection Authority (DPA) Education, health, banking, telecommunications and e-government organisations that process personal data | The Authority lists sector duties: education organisations protect student records, health organisations safeguard patient information, banks secure financial data, telecom operators protect communications data and e-government services secure digital services. It also states that organisations should run data protection impact assessments for high-risk processing and keep processing records, train staff, set up breach procedures and conduct audits. | ISO/IEC 27701, ISO/IEC 27001, ISO 13485, PCI DSS |
| Ministry of Agriculture and Irrigation Crop production, plant protection and food security | The Ministry's departments cover crop production, agricultural technology and innovation, plant protection and research and extension; its Plant Protection Department states that it safeguards crops from pests and diseases through monitoring, control measures and farmer education. The site does not name a food-safety certification requirement. |
Accreditation and recognition
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Ministry of Finance procurement portal (Ministry of Finance): The portal presents public, transparent and competitive procurement opportunities, with active notices, supplier registration, procurement guidelines and contract awards. It sets no general quality-certificate rule; each notice sets its own criteria.
Sterling in Somalia
Sterling delivers in Somalia from its Nairobi office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Somalia clients ask
Does Somalia have a data protection law, and who enforces it?
Yes. The Data Protection Authority states that it was established under Data Protection Act No. 005 (2023) and that it acts independently in its regulatory, supervisory and enforcement functions. In January 2026 it reported that the Council of Ministers had approved the Regulations issued under the Act. Check the current duties for your processing with the Authority or your counsel.
Must a company register with the Somalia Data Protection Authority?
The Authority says organisations that collect, store, use or otherwise process personal data in Somalia are required to register, and that data protection officers must be designated and registered. It also asks registered organisations to notify material changes. Registration forms are on its site, and counsel or the Authority can confirm whether your organisation falls in scope.
Is ISO 27001 required for Somali organisations that run critical systems?
The framework makes its baseline mandatory, not the certificate. The National Cybersecurity Compliance Framework binds organisations that use, own or operate Critical Information Infrastructure and, for them, recommends an information security management system in accordance with ISO/IEC 27001. Designated operators send the NCA an annual risk assessment report. Ask the NCA whether your systems are designated.
What does the Somali Bureau of Standards import conformity control cover?
It covers goods entering Somalia. The Bureau calls its Conformity-Based Customs Assessment a mandatory control carried out before export, effective 15 July 2023, with stronger enforcement from 1 January 2025. Importers and overseas suppliers should settle product documents and conformity before shipment, and ask the Bureau for the current scope.
Which language are audits and regulator filings handled in?
Usually Somali or English. The Bureau of Standards names both as its languages of communication, and two other regulators publish in both. Fix the audit language, any interpreter and the language of your controlled documents when applying, because the auditor has to read the evidence that you present.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Data Protection Act No. 005 (2023) — dpa.gov.so (accessed 18 Oct 2026)
- Regulations issued under the Data Protection Act — dpa.gov.so (accessed 18 Oct 2026)
- The NCA is the communications regulator established under the National Communications Law of 2 October 2017, with licensing through its Unified Licensing Framework and application-service and infrastructure licence frameworks. Its cybersecurity department leads national cybersecurity regulation and operates SOMCIRT. The National Cybersecurity Compliance Framework (June 2026) sets a mandatory baseline for organisations that use, own or operate Critical Information Infrastructure, recommends an information security management system in accordance with ISO/IEC 27001 and has designated operators submit an annual risk assessment report to the NCA. The National Cybersecurity Risk Management Framework (June 2026) adopts ISO/IEC 27000 terms and cites ISO/IEC 27005 and ISO 31000 — nca.gov.so (accessed 18 Oct 2026)
- SOBS states that it was established in 2020 under the Standards and Quality Control Act and is mandated to develop, maintain and enforce national standards (Somali Standards, SOS) for products, services and management systems, with open public inquiry periods for comment on draft standards. It describes its Conformity-Based Customs Assessment as a mandatory pre-export conformity control for goods entering Somalia, effective 15 July 2023, with stronger enforcement from 1 January 2025. It states that it is a member of ISO and ARSO — sobs.gov.so (accessed 18 Oct 2026)
- The Authority lists sector duties: education organisations protect student records, health organisations safeguard patient information, banks secure financial data, telecom operators protect communications data and e-government services secure digital services. It also states that organisations should run data protection impact assessments for high-risk processing and keep processing records, train staff, set up breach procedures and conduct audits — dpa.gov.so (accessed 18 Oct 2026)
- The Ministry's departments cover crop production, agricultural technology and innovation, plant protection and research and extension; its Plant Protection Department states that it safeguards crops from pests and diseases through monitoring, control measures and farmer education. The site does not name a food-safety certification requirement — moa.gov.so (accessed 18 Oct 2026)
- Ministry of Finance procurement portal — mof.gov.so (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Nairobi team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Nairobi office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice