Know Exactly Where You Stand Before Your Auditor Tells You
A structured assessment against NDPA/NDPC, CBN Cybersecurity Framework, ISO 27001, and other applicable frameworks — with a costed remediation path, not just a list of problems.
WHAT YOU GET
A findings register your auditor would recognise.
Auditors look for evidence that training changes behaviour, not just that it was completed. The assessment records each requirement, where your workforce stands against it, and what closing the gap will cost.
It is a structured assessment, not a training course. The training that closes the gaps runs on the ProtectYourData platform.
Sample dashboard view: See exactly where your team stands before an audit begins.
FRAMEWORKS WE ASSESS AGAINST
Every requirement named, so nothing is left vague.
Built around Nigerian requirements as well as international standards. Relevant to banks, fintechs, government bodies, energy operators and healthcare.
NDPA 2023, enforced by the NDPC
Nigeria Data Protection ActExpects data controllers and processors to protect personal data with appropriate organisational measures. We check whether staff who handle personal data can show they know what that means in their role.
CBN cybersecurity framework
Central Bank of NigeriaSets cyber-risk expectations for banks and payment providers, including the human side of fraud: impersonation, wire redirection and SIM-swap pretexts.
ISO/IEC 27001
Information security managementAsks for documented awareness, education and training: Annex A control 6.3 in the 2022 edition (A.7.2.2 in the 2013 edition). The assessment shows whether your records would satisfy that control.
PCI DSS v4.0
Payment card securityRequires a formal security awareness programme for personnel (Requirement 12.6). We review whether yours is documented, role-appropriate and evidenced.
SOC 2
Trust Services CriteriaLooks for evidence that people are competent and understand their security responsibilities. We check whether your training records would stand up to that request.
THE DIFFERENCE
A costed remediation path, not a list of problems.
The usual scramble
- Generic training that is completed but not retained
- No proof that staff behaviour has changed
- Spreadsheets pulled together when examiners arrive
- Gaps discovered only when the auditor asks
After the assessment
- Gaps found by you, before the auditor
- Results mapped to the frameworks you are measured against
- Evidence your compliance team can hand over
- A remediation path with costs attached
HOW IT RUNS
From first review to a plan you can fund.
Scope and baseline
We agree which frameworks apply to you and review your current training and records against them.
Gap analysis
We assess where your workforce stands against each requirement and record the gaps.
Costed remediation path
You receive a plan with costs attached, so you can close the gaps before your next audit.
Frequently asked questions
How long does a Regulatory Compliance Gap Assessment take?
It depends on your headcount and how many frameworks are in scope. We confirm the timeline when we scope the assessment.
Does this assessment replace our annual compliance training?
No. It shows where your current training falls short of the frameworks that apply to you, so you can strengthen it.
Which frameworks does it cover?
NDPA 2023 (enforced by the NDPC), the CBN cybersecurity framework, ISO/IEC 27001, PCI DSS v4.0 and SOC 2.
Who in our organisation should be involved?
Usually the people responsible for compliance, security, data protection and learning. We agree the right group when we scope the assessment.
The gaps found here are closed on the ProtectYourData platform. See how the training works.
See how the training works →