Security Policy, Governance and Compliance Support

Compliance work fails when it produces binders nobody reads. Our governance and compliance support builds a security programme that fits the size of your organisation, satisfies your regulators and auditors, and is still being followed six months after the consultants leave.

For ISO 27001 we run a gap assessment against the 2022 standard, design an information security management system around your real processes, facilitate risk assessment workshops with each department, and write the Statement of Applicability and the policies the standard requires. Before your certification body arrives we carry out an internal audit and a full mock assessment, so nonconformities are found and closed on your timeline rather than theirs.

For the Kenya Data Protection Act 2019 we map the personal data you collect, where it flows and who can access it, then help you register with the Office of the Data Protection Commissioner where required, publish accurate privacy notices, run data protection impact assessments for high risk processing and prepare a breach response procedure that meets the 72 hour notification duty. For businesses that accept card payments we reduce PCI DSS scope first, then help you complete the right self assessment questionnaire or prepare for a QSA audit.

Every policy is written for your tools, your teams and your regulators, whether that is the CBK, CMA, IRA, SASRA or a demanding enterprise customer. Because the same company runs penetration tests and network hardening, the controls we recommend are ones we know how to implement and verify. Organisations that want ongoing support can keep us on a governance retainer that covers monthly risk reviews, policy updates and board reporting, acting as a virtual CISO.

Timelines depend on how mature your existing controls are. A focused Data Protection Act review for a small organisation can take a few weeks; ISO 27001 readiness for a growing company usually takes six to nine months from gap assessment to certification audit. Either way, you receive a roadmap in the first weeks that shows which work comes first and why, so leadership can plan budget and effort with confidence.