Cybersecurity and Assurance

Continuity and recovery planning built from a business impact analysis, with recovery objectives that reflect what your infrastructure can actually deliver.

An assessment against the CBN Risk-Based Cybersecurity Framework, producing the evidence base for your annual return.

An incident response plan with scenario playbooks, written so an on-call engineer at 3am can follow it.

A complete information security policy set, sized to your organisation rather than copied from a multinational.

The internal audit an ISO 27001 management system requires before certification or surveillance, conducted against the standard rather than a checklist.

The full documented information set an ISO/IEC 27001:2022 information security management system requires, including all Annex A controls in scope.

Cardholder data environment scoping and a gap assessment against PCI DSS v4.0.1, including the requirements that became mandatory in 2025.

A secure development lifecycle your engineering team will actually follow, with the gates placed where they catch problems rather than where they slow releases.

A readiness assessment mapped to the Trust Services Criteria, telling you exactly what will fail before the auditor tells you at a higher price.

An independent security assessment of one of your suppliers, producing a decision you can put in front of a risk committee.

Schema-driven testing of an API including an authorisation matrix across every role and endpoint — the class of flaw automated scanners consistently miss.

A configuration review of an AWS, Azure or GCP account against CIS benchmarks, covering identity, network, storage exposure and logging.

Software composition analysis and container image scanning, with exploitability triage rather than a raw CVE dump.

Testing of your internet-facing perimeter: exposed services, patch currency, TLS posture and default credentials.

Assumed-breach testing from inside your network: lateral movement, privilege escalation and directory service configuration.

Static and dynamic testing of a mobile application against OWASP MASVS, covering local storage, certificate pinning and the backend it talks to.

Quarterly external vulnerability scanning of your cardholder data environment, delivered through an Approved Scanning Vendor.

A controlled phishing campaign measuring click, credential submission and reporting rates, with follow-up training for those who engage.

A hardening review of a single platform — Active Directory, a database, a Kubernetes cluster or a firewall estate — against CIS benchmarks.

A retest of previously reported findings, producing a validation letter stating what was fixed, what remains and what is new.

Static analysis with manual review of security-critical paths: authentication, authorisation, cryptography and payment handling.

Authenticated and unauthenticated testing of a web application against OWASP ASVS, combining an automated toolchain with manual validation of every critical and high finding by a named consultant.

Assessment of wireless networks at a site: authentication strength, segmentation from corporate systems and rogue access point detection.

Support through Visa, Mastercard, Verve, NIBSS and EMV Level 2 and 3 certification.

End-to-end ISO/IEC 27001:2022 implementation: risk assessment, controls, documentation, internal audit and support through the certification audit.

A managed route to a PCI DSS Report on Compliance: scoping, remediation and evidence assembly, with the assessment performed by a Qualified Security Assessor.

An objective-based adversary simulation testing detection and response, not just whether vulnerabilities exist.

A point-in-time SOC 2 Type I report, usually the fastest route to satisfying an enterprise procurement requirement.

A managed route to a SOC 2 Type II report, covering readiness, the observation period and the audit itself.

Ongoing discovery and monitoring of your internet-facing estate, with alerting on new exposure.

A four-hour response commitment with a pre-agreed team, contract and access model, so the paperwork is done before the incident.

A named senior security leader accountable for your security programme, governance and regulator-facing security obligations.

A managed vulnerability management programme: scanning, triage, tracking and verification of remediation.