Secure it · SEC-03
Governance, Risk & Compliance
Certifications that reflect how you actually operate. Not a binder that sits on a shelf.
We get you ready for ISO 27001, PCI DSS, NDPA and CBN audits, and we build security programmes that survive past audit day. Policies people can follow, risk registers that drive decisions, and a virtual CISO when you need senior security leadership without the full-time salary.
What's included
Pick what you need. We'll tell you what you've missed.
ISO/IEC 27001 implementation
Gap analysis, ISMS design, risk treatment, Statement of Applicability, internal audit and certification support from first meeting to certificate.
NDPA & GDPR compliance
Data mapping, DPIAs, privacy notices, lawful basis reviews, data subject request handling and NDPC Compliance Audit Returns.
PCI DSS v4.0
Scoping and segmentation, gap assessment, SAQ support and readiness for QSA assessment for merchants, processors and switches.
CBN & sector regulation
Readiness for the CBN Risk-Based Cybersecurity Framework, NCC, SEC and NAICOM requirements, with the board reporting they expect.
Virtual CISO
Senior security leadership on a part-time basis: strategy, board reporting, vendor decisions and someone accountable for the programme.
Risk assessment & management
Asset-based risk assessments, risk registers and treatment plans that tie security spend to the risks that matter most.
Third-party risk
Vendor security questionnaires, due diligence and contract clauses. Your suppliers are part of your attack surface.
Security awareness training
Role-based training and phishing simulations measured by behaviour change, not completion certificates.
How it runs
The process.
- 1
Assess
Interviews, document review and technical sampling to see where you really stand.
- 2
Plan
A prioritised roadmap with costs, owners and timelines your leadership can approve.
- 3
Implement
Policies, controls and processes rolled out alongside your team, not dumped on them.
- 4
Audit-ready
Internal audit, evidence packs and mock interviews before the certification body arrives.
- 5
Sustain
Ongoing monitoring, metrics and management reviews so you keep the certificate.
What you walk away with
Deliverables.
- Gap assessment against your target standard with a costed roadmap
- Policy set written for your organisation, not a template with your logo
- Risk register and treatment plan
- Records of processing and DPIAs for NDPA
- Internal audit report ahead of certification
- Board-ready security posture reporting
FAQ
Questions we get asked.
How long does ISO 27001 take?
For most mid-sized organisations, 6 to 9 months from gap analysis to certification. It depends on how much you already have in place and how quickly decisions get made.
Does the NDPA apply to us?
If you process personal data of people in Nigeria, almost certainly yes. Organisations processing data at scale are classed as data controllers or processors of major importance and must register with the NDPC and file compliance audit returns.
Can you also be our certification body?
No, and you should be wary of anyone who offers that. Independence matters. We prepare you; an accredited certification body audits you.
Often paired with
Penetration Testing & Red Teaming
We attack your systems the way a real adversary would. With permission, and a report you can act on.
Managed Detection & Incident Response
Someone watching your logs at 3am. And a team ready to move when the alert is real.
Business Continuity & Disaster Recovery
When the data centre floods or ransomware locks everything, you'll already know what to do.
Let's talk about GRC.
Send a few lines on what you need and when. You'll get a reply from a practitioner, not a sales rep, within one working day.