{

Problem Statement

}

As Company X expanded its footprint across Nigeria, it quickly became clear that security and compliance were no longer optional—they were essential for growth. Financial partners wanted ISO 27001 certification, regulators required NDPA compliance, and customers expected a secure, PCI DSS aligned payment environment.

Pre-Project Assessment

But when Ethnos Cyber stepped in, here's what we uncovered:

There were no formal policies or procedures; security was handled on a “let's just fix it when it comes up” basis.

Risk weren't being tracked anywhere; they were just discussed informally.

Controls varied from team to team, leaving critical systems exposed without consistency.

Most staff didn't understand their role in protecting sensitive information.

The risk? One breach could erase customer's trust, trigger regulatory penalties, and damage brand reputation.

The Approach

To address this, Ethnos cyber designed a clear, structured compliance roadmap. One that secured leadership buy-in, aligned teams, and guided the organization step by step towards certification

We developed a formal information Security Policy so everyone had a clear reference point.

A dedicated Data Protection Officer (DPO) was appointed to lead compliance efforts.

Risk and Incident management processes were introduced to bring structure and accountability.

A living risk register was created so threats could be documented, tracked, and acted on.

We ran awareness sessions to help staff understand that security wasn't just IT's job, it was everyone's responsibility.

Strengthening Payment Security (PCI DSS)

•We began with a detailed PCI DSS gap assessment to understand exactly where improvements were needed.
•Networks were segmented properly, and firewalls reconfigured to prevent unnecessary exposure.
•Cardholder data was secured end-to-end through encryption.
•We set up quarterly vulnerability scans and regular penetration tests to keep security proactive.
•Incident response procedures were expanded to cover payment data breaches explicitly.

Meeting NDPA Standards

•A comprehensive Data Protection Policy was introduced, along with transparent and customer-friendly privacy notices.
•Data Subject Rights, like access, correction, and deletion, were made operational and easy to manage.
•The organization's DPO was officially registered with the NDPC.
•Staff received practical training so everyone understood their NDPA responsibilities.

The Transformation

With internal audits, certification body collaboration, and QSA-led PCI DSS validation, Company X moved from scattered practices to fully structured compliance, faster than expected.

Result at a Glance

The organization achieved ISO 27001 certification in just six months.

All 12 PCI DSS requirements were met, securing full compliance.

NDPA cpmliance was established with solid policies and governance.

Audit readiness improved by 50%, making assessments smoother and more predictable.

90% of staff became actively involved, helping create a true culture of security.

Fraud risks dropped significantly, boosting customer confidence and trust.

Why it Matters

For company X, this journey wasn't simply about meeting requirements. It meant:

Winning the trust of financial partners.

Protecting customers' most sensitive information.

Standing out with globally recognized certifications that give the company an edge.

With Ethnos Cyber as their partner, Company X didn't just check compliance boxes, they turned security into a strategic advantage .

Recommendations/Next Steps

Continiously monitor risks: Maintain an up-to-date risk register and conduct regular internal audits to identify proactively and address potential threats.

Train staff: Implement ongoing security and data protection training programs to ensure all employees remain aware of their responsibilities.

Update policies: Regularly review and refresh information security, data protection, and incident response policies to stay aligned with evolving regulations .

Strengthens control: Ensure robust encryption, access management, and network defences are consistently applied and tested.

Engage regulators: Maintain open communication with relevant regulatory bodies and ensure timely compliance reporting.

Build customer trust: Leverage achieved certifications and compliance measures to demonstrate stroong security pratices to clients and partners.

plan for future cybersecurity growth: Develop a long-term raodmap to aniticipate emerging threats and align with eveolving cybersecurity standards.