Where we work · South Africa
ISO and GRC certification consulting in South Africa
Achieve ISO and GRC certification in South Africa with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Johannesburg office team
- Effivity and Academy included
Sectors that ask for certification in South Africa
Clients include
ISO and GRC certification in South Africa at a glance
South Africa's demand for ISO and GRC certification is driven less by statute than by buyers, regulators and supply chains. The Information Regulator oversees the Protection of Personal Information Act (POPIA) and the Promotion of Access to Information Act, while the Financial Sector Conduct Authority and the Prudential Authority issue Joint Standard 2 of 2024 on cybersecurity and Joint Standard 1 of 2023 on IT governance for financial institutions. POPIA and the Joint Standards do not name an ISO standard, so clients ask suppliers for independent evidence instead. The Occupational Health and Safety Act, the National Environmental Management Act and the HACCP regulations add duties for employers, polluters and listed food processors, and the Central Supplier Database and the cidb register shape government supply. Certificates come from accredited certification bodies, and SANAS is the national accreditation body. Demand comes from financial services, insurance and fintech, IT, BPO and managed service providers, the mining supply chain, manufacturing and automotive components, food and agro-processing, construction, healthcare and medical devices, and government suppliers. Sterling's Johannesburg office brings 20+ years and 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in South Africa
Each page covers who needs the standard in South Africa, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in South Africa (14)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Protection of Personal Information Act (POPIA) Information Regulator (South Africa), established in terms of section 39 of POPIA | A responsible party must secure the integrity and confidentiality of personal information by taking appropriate, reasonable technical and organisational measures; it must identify foreseeable risks, establish and maintain safeguards, regularly verify them and keep them updated, and have due regard to generally accepted information security practices and procedures (section 19). The Act also covers notification of security compromises, automated decision making and transfers of personal information outside the Republic. The Regulator states that Information Officers take up their duties only after being registered with it (section 55(2)). The Act does not cite any standard or require certification. | |
| Promotion of Access to Information Act (PAIA) Information Regulator (South Africa) — dual mandate for POPIA and PAIA | Access to records held by public and private bodies; the Information Regulator states it has a dual mandate covering POPIA and PAIA. | |
| Financial Sector Conduct Authority (FSCA) and Prudential Authority (PA) Financial institutions specified in the Joint Standard (banks, insurers, market infrastructures, financial services providers and others) | Joint Standard 2 of 2024: Cybersecurity and cyber resilience — requirements for sound practices and processes relating to cybersecurity and cyber resilience, including that information assets managed by third-party service providers receive protection commensurate with their sensitivity and criticality. The Joint Standard does not name ISO/IEC 27001; the Authorities' consultation report responds that it 'is derived from internationally recognised standards such as NIST, ISO, CPMI-IOSCO etc.'. | |
| Financial Sector Conduct Authority (FSCA) and Prudential Authority (PA) Financial institutions specified in the Joint Standard | Joint Standard 1 of 2023: Information Technology (IT) Governance and Risk Management — principles for IT governance and IT risk management; its IT resilience and business continuity section requires recovery priorities with RTOs and RPOs for critical services, a geographically separate disaster recovery site and a business impact assessment. No ISO standard is named. | |
| Department of Employment and Labour All employers (workplaces outside the mining sector) | Occupational Health and Safety Act 85 of 1993 — section 8(1): every employer shall provide and maintain, as far as is reasonably practicable, a working environment that is safe and without risk to the health of his employees. The Act does not cite ISO 45001. | |
| Environmental authorities under NEMA Any person who causes, has caused or may cause significant pollution or degradation of the environment | National Environmental Management Act 107 of 1998 — section 28 duty of care: such a person must take reasonable measures to prevent such pollution or degradation from occurring, continuing or recurring. The Act does not cite ISO 14001. | |
| National Department of Health Food handling enterprises in sectors listed by the Minister of Health | Regulations relating to the application of the Hazard Analysis and Critical Control Point System (HACCP system), Government Notice No. R. 908 of 27 June 2003, under the Foodstuffs, Cosmetics and Disinfectants Act, 1972 (Act No. 54 of 1972) — 'HACCP certification' is defined as the issuing of documentary evidence by a certifying body accredited to do so by SANAS, based on the results of an external HACCP audit. The 2018 amendment (No. R. 607, 14 June 2018) lists processors of ready-to-eat heat-treated meat products and ready-to-eat heat-treated poultry products as defined in SANS 885. | HACCP |
| National Department of Health Food premises and transport of food | Regulations governing general hygiene requirements for food premises, the transport of food and related matters (Foodstuffs, Cosmetics and Disinfectants Act, 2018; Government Notice 638) — title verified; content not reviewed. | |
| Medicines regulatory authority under the Medicines and Related Substances Act (the regulations refer to the Council and the Registrar) Manufacturers, distributors and wholesalers of medical devices and IVDs | Regulations relating to medical devices and in vitro diagnostic medical devices (IVDs), Government Notice 1515 (Government Gazette 40480) — a licence application must include acceptable documentary proof of 'certification to a Quality Management System for medical devices and IVDs as determined by the Council'. The regulations do not name ISO 13485. | |
| Criminal offence under the Prevention and Combating of Corrupt Activities Act 12 of 2004 (PRECCA) Private-sector organisations and incorporated state-owned entities | Section 34A of PRECCA, inserted by the Judicial Matters Amendment Act, 2023 (Act 15 of 2023): failure by members of the private sector or incorporated state-owned entities to prevent corrupt activities by associated persons; no offence where adequate procedures designed to prevent such gratification were in place. The Act does not cite ISO 37001. | |
| Financial Intelligence Centre (FIC) Accountable institutions under the Financial Intelligence Centre Act | Directive 12 on submissions of risk management and compliance programmes (web notice, 4 September 2026) — notice page reviewed; the Directive text itself was not retrieved. | |
| South African Reserve Bank (SARB) and PayInc (functions transitioned from the Payments Association of South Africa) Payments industry | PASA states its functions transitioned to the SARB and PayInc in accordance with the SARB Directive issued on 2 June 2026. PASA's documents page links the PCI SSC PCI DSS quick reference guide; no local mandate to validate PCI DSS was found on these pages. | PCI DSS |
| National Treasury (regulations under section 12L of the Income Tax Act, 1962); SANEDI Taxpayers claiming the energy efficiency savings allowance | Regulations in terms of section 12L of the Income Tax Act, 1962, on the allowance for energy efficiency savings (No. R. 971, 9 December 2013) — savings are measured and verified under SANS 50010 by a measurement and verification body accredited by SANAS. The regulations do not cite ISO 50001. | |
| Department of Communications and Digital Technologies Developers and users of artificial intelligence | The Draft South Africa National Artificial Intelligence (AI) Policy (Government Notice 3880, Government Gazette 54477, 10 April 2026) was withdrawn in its entirety by Notice 3978 of 2026 (Government Gazette 54840, 12 June 2026). No national AI policy or AI law was found in force. |
Accreditation and recognition
- South African National Accreditation System (SANAS): National accreditation body — recognised by the Accreditation for Conformity Assessment, Calibration and Good Laboratory Practice Act 19 of 2006 as the only accreditation body in the Republic for the accreditation of conformity assessment and calibration and the monitoring of good laboratory practice.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Cities
Tenders and procurement
- Central Supplier Database (CSD) (South African government (organs of state)): The CSD maintains a database of organisations, institutions and individuals who can provide goods and services to government and serves as the single source of key supplier information for organs of state. The landing page does not list ISO certificates; any certificate requirement is set in the individual tender.
- cidb Register of Contractors (Construction Industry Development Board (cidb)): Applies to contractors who wish to work in the public sector; the Construction Industry Development Regulations bind public-sector clients to award construction contracts only to cidb-registered contractors. Contractors are graded from 1 to 9 on financial capability and track record by class of works; the published grading requirements do not include ISO certification.
Economic zones
- Tshwane Automotive Special Economic Zone (TASEZ): automotive manufacturing
- OR Tambo SEZ: beneficiation of precious and semi-precious metals and minerals, light export-oriented manufacturing
- Coega SEZ (Coega IDZ): agro-processing, automotive, aquaculture, energy, metals, logistics, business process services, pharmaceutical and vaccine precinct (expansion)
- Dube TradePort: air cargo and logistics, warehousing, agriculture
- East London IDZ: automotive, agro-processing, aquaculture
- Richards Bay IDZ: minerals beneficiation, export-oriented manufacturing
- Atlantis SEZ: green technology manufacturing, renewable energy components
- Saldanha Bay IDZ: oil and gas services, marine repair, fabrication and logistics
Sterling in South Africa
Sterling delivers in South Africa from its Johannesburg office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in South Africa, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions South African clients ask
Which accreditation should a certification body hold for South Africa?
A certification body serving South Africa should hold SANAS accreditation. The Accreditation for Conformity Assessment, Calibration and Good Laboratory Practice Act 19 of 2006 recognises SANAS as the only accreditation body in the Republic for that work. SANAS also signs the IAF MLA, with management-systems sub-scopes listed for ISO 9001, ISO 14001, ISO/IEC 27001, ISO 22000, ISO 13485, ISO 50001, ISO 45001 and FSSC 22000. Check the current recognition scope before you quote it.
Does POPIA require ISO 27001 certification?
No. POPIA section 19 asks a responsible party to take appropriate, reasonable technical and organisational measures, with due regard to generally accepted information security practices and procedures. The Act cites no standard and requires no certificate, so ISO 27001 is a choice, not an obligation. Whether your safeguards are adequate is judged under the Act; confirm your position with your counsel or the Information Regulator.
Are certification audits in South Africa conducted in English?
English is the usual language of business and of certification audits here. The Constitution lists twelve official languages, including South African Sign Language, but English is the working language of audits. When you apply, agree the audit language and the language of your controlled documents with the certification body, so no one is surprised on the day.
Do South African government tenders require ISO certificates?
Not as a blanket rule. The Central Supplier Database holds supplier information for organs of state, and its landing page does not list ISO certificates; any certificate requirement is set in the individual tender. The cidb register grades contractors on financial capability and track record. Read each tender document for its own criteria, because those decide what evidence you must supply.
Do the FSCA and Prudential Authority Joint Standards require ISO certification?
Neither names ISO certification. Joint Standard 2 of 2024 on cybersecurity does not name ISO/IEC 27001, and Joint Standard 1 of 2023 on IT governance names no ISO standard either. Both bind the financial institutions they cover, so a provider's certificate is evidence the institution may choose to accept. Confirm what applies to you with your counsel, the FSCA or the Prudential Authority.
How do public holidays affect audit scheduling in South Africa?
Public holidays can narrow audit availability. South Africa observes twelve public holidays under the Public Holidays Act; one falling on a Sunday is followed by a Monday holiday, and further days may be declared by notice. Easter moves each year and the December to January period affects audit availability, so check the official gov.za list for your audit year and book your certification body early.
Cities Sterling covers in South Africa
Each city page sets out the industries, zones and standards that matter locally.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Protection of Personal Information Act (POPIA) — gov.za; inforegulator.org.za (accessed 5 Oct 2026)
- Promotion of Access to Information Act (PAIA) — gov.za; inforegulator.org.za (accessed 5 Oct 2026)
- Joint Standard 2 of 2024: Cybersecurity and cyber resilience — resbank.co.za (accessed 5 Oct 2026)
- Joint Standard 1 of 2023: Information Technology (IT) Governance and Risk Management — resbank.co.za (accessed 5 Oct 2026)
- Occupational Health and Safety Act 85 of 1993 — gov.za (accessed 5 Oct 2026)
- National Environmental Management Act 107 of 1998 — gov.za (accessed 5 Oct 2026)
- Regulations relating to the application of the Hazard Analysis and Critical Control Point System (HACCP system), Government Notice No. R. 908 of 27 June 2003, under the Foodstuffs, Cosmetics and Disinfectants Act, 1972 (Act No. 54 of 1972) — gov.za (accessed 5 Oct 2026)
- Regulations governing general hygiene requirements for food premises, the transport of food and related matters (Foodstuffs, Cosmetics and Disinfectants Act, 2018; Government Notice 638) — gov.za (accessed 5 Oct 2026)
- Regulations relating to medical devices and in vitro diagnostic medical devices (IVDs), Government Notice 1515 (Government Gazette 40480) — gov.za (accessed 5 Oct 2026)
- Section 34A of PRECCA, inserted by the Judicial Matters Amendment Act, 2023 (Act 15 of 2023): failure by members of the private sector or incorporated state-owned entities to prevent corrupt activities by associated persons; no offence where adequate procedures designed to prevent such gratification were in place. The Act does not cite ISO 37001. — justice.gov.za; gov.za (accessed 5 Oct 2026)
- Directive 12 on submissions of risk management and compliance programmes (web notice, 4 September 2026) — fic.gov.za (accessed 5 Oct 2026)
- PASA states its functions transitioned to the SARB and PayInc in accordance with the SARB Directive issued on 2 June 2026. PASA's documents page links the PCI SSC PCI DSS quick reference guide; no local mandate to validate PCI DSS was found on these pages. — pasa.org.za (accessed 5 Oct 2026)
- Regulations in terms of section 12L of the Income Tax Act, 1962, on the allowance for energy efficiency savings (No. R. 971, 9 December 2013) — gov.za (accessed 5 Oct 2026)
- The Draft South Africa National Artificial Intelligence (AI) Policy (Government Notice 3880, Government Gazette 54477, 10 April 2026) was withdrawn in its entirety by Notice 3978 of 2026 (Government Gazette 54840, 12 June 2026). No national AI policy or AI law was found in force. — gov.za (accessed 5 Oct 2026)
- South African National Accreditation System (SANAS) — gov.za; iaf.nu; ilac.org (accessed 5 Oct 2026)
- Central Supplier Database (CSD) — secure.csd.gov.za (accessed 5 Oct 2026)
- cidb Register of Contractors — cidb.org.za (accessed 5 Oct 2026)
- Tshwane Automotive Special Economic Zone (TASEZ) — thedtic.gov.za (accessed 5 Oct 2026)
- OR Tambo SEZ — thedtic.gov.za (accessed 5 Oct 2026)
- Coega SEZ (Coega IDZ) — thedtic.gov.za (accessed 5 Oct 2026)
- Dube TradePort — thedtic.gov.za (accessed 5 Oct 2026)
- East London IDZ — thedtic.gov.za (accessed 5 Oct 2026)
- Richards Bay IDZ — thedtic.gov.za (accessed 5 Oct 2026)
- Atlantis SEZ — thedtic.gov.za (accessed 5 Oct 2026)
- Saldanha Bay IDZ — thedtic.gov.za (accessed 5 Oct 2026)
Talk to a consultant
Plan your certification with the Johannesburg team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Johannesburg office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice