GRC & training
Governance that works every day, and people who know what to look for.
Certification, policies, risk and compliance that fit how your organisation runs, and training that turns your people into your first line of defence.
What we do
From certification to the people on the front line.
Take one service or build a complete programme. Open any service to see what it covers.
01 ISO 27001 & ISO 22301 certificationThe full journey, from gap assessment to your certification audit.
We build information security and business continuity management systems that fit how your organisation works, and support you through the audit with an accredited certification body.
- Gap assessment and roadmap
- Scope, risk assessment and Statement of Applicability
- Internal audit and management review
- Support through Stage 1 and Stage 2
You receive: a working management system, ready for certification.
Full ISO 27001 details02 Policies, risk assessments & treatment plansGovernance documents that people actually use.
Whether or not you are pursuing certification, we write proportionate policies and run practical risk assessments so decisions about security are made deliberately, not by default.
- Information security policy set
- Risk methodology and risk register
- Risk treatment plans with owners
- Acceptable use and supporting standards
You receive: a policy set and risk register tailored to your organisation.
03 Regulatory compliance readiness (PCI DSS, NDPA, CBN)Meet what regulators and card schemes expect.
We map your controls to the requirements that apply to you, close the gaps and prepare the evidence, so assessments and regulatory reviews hold no surprises.
- Applicability and scope assessment
- Gap analysis against each requirement
- Remediation roadmap
- Support during assessments and reviews
You receive: a compliance gap report, roadmap and evidence pack.
04 Business continuity planningKeep critical services running through disruption.
We identify what matters most to your organisation, how quickly it must recover, and put practical plans in place so disruption does not become a crisis.
- Business impact analysis
- Recovery time and point objectives
- Continuity and recovery strategies
- Business continuity and crisis plans
You receive: a business impact analysis and continuity plans ready to test.
05 Security awareness training for staffPractical sessions people remember.
Engaging, practical training that teaches staff to recognise and report threats, tailored to your organisation and the risks your people actually face.
- Sessions for all staff
- Role-specific modules for finance, IT and executives
- Real-world examples relevant to Nigeria
- Attendance records for audits
You receive: training sessions, materials and attendance records.
06 Phishing simulationsMeasure and improve how staff respond to phishing.
Realistic, safe phishing campaigns show how staff respond to suspicious email, and turn mistakes into learning rather than blame.
- Campaign design matched to real threats
- Click, report and credential-entry tracking
- Trend reporting over time
- Results handled discreetly
You receive: campaign reports showing improvement over time.
07 Executive & board security briefingsCyber risk explained in business terms.
Clear briefings that help leadership understand the organisation’s cyber risk, their responsibilities and the decisions only they can make.
- Current threat landscape
- Your risk position in plain language
- Regulatory responsibilities
- Incident decision-making
You receive: a briefing session and a concise leadership summary.
- WORK ALIGNED TO
- ISO/IEC 27001
- ISO 22301
- ISO/IEC 27005
- PCI DSS v4.0.1
- NDPA 2023
- CBN Risk-Based Cybersecurity Framework
- NIST CSF 2.0
Questions
GRC & training FAQs
Do we need ISO certification?
Not always. Certification makes sense when customers, partners or regulators ask for it. Otherwise, a well-run framework aligned to the standard may be enough, and we will help you decide.
Are your policies templates?
No. We start from what you already do and write policies around your systems and people, so they are followed in practice and hold up at audit.
Do you provide legal advice on the NDPA?
No. We help you implement the security and data protection controls the NDPA expects, and work alongside your lawyers where legal interpretation is needed.
Can training be delivered on-site?
Yes. Training can be delivered on-site or remotely, and tailored to different teams.
How is GRC and training work priced?
It depends on scope: the size of your organisation, the standards involved and how much already exists. After a scoping call you receive a written proposal with a fixed scope and price.
Build governance that lasts.
Tell us about your organisation and goals, and we'll set up a scoping call. We respond within 1 business day.