01The Central Bank now grades your cyber posture.
The obligations recur, and they have teeth
Nigeria's Risk-Based Cybersecurity Framework is not a one-time filing. Returns recur on a schedule, and BOFIA 2020 attaches personal liability to the officers who sign a false or incomplete one.
The framework asks for more than a form
The Cybersecurity Self-Assessment Tool scores governance, technical controls, monitoring and incident response, against a standard built for institutions with a dedicated security function, not a single IT generalist covering everything.
A CISO nobody can afford
Most fintechs and mid-size institutions cannot justify a full-time, board-level security lead, but the Central Bank expects the output of one: a named owner, a documented programme and evidence on demand.
02Set up once. Defended every month.
Six things we run, continuously, under one retainer:
- Harden. Close the exposures an attacker or an assessor would find first: endpoints, email, admin access, exposed services.
- Monitor. Watch for the signals that matter and escalate the ones that need a human.
- Comply. Keep CSAT and NDPA evidence current instead of rebuilding it under deadline.
- Lead. A named security lead your examiners, auditors and board can actually talk to.
- Respond. A tested incident response plan, and the people to run it when it matters.
- Train. Phishing and awareness training that moves the number that actually predicts a breach.
03Independence is the product.
No vendor conflicts
We hold no reseller agreements and take no commission on the tools we recommend. A control either earns its place in your environment or it does not go in.
Published before it is pitched
Our regulatory reading and our method are public before we bring them to a client, not written to fit a sales conversation.
Delivery, not decks
We configure the controls and produce the evidence ourselves. The retainer buys outcomes an assessor will accept, not a quarterly slide deck.
04Two fixed-price packages. Bank-grade assurance by engagement.
A fixed setup fee and a flat monthly retainer, no hourly billing. Larger institutions are scoped per engagement. Government and public-sector bodies have their own practice, below.
Essential
- Security assessment and hardening review
- MFA and device hardening
- Staff phishing training
- Incident response plan
- CSAT readiness check
- Quarterly plain-language review
Managed
- Everything in Essential
- Full CSAT gap assessment and remediation plan
- ISO 27001-aligned policy suite
- Business continuity and disaster recovery plan
- Compliance matrix, CSAT return preparation, annual data-protection audit return
- Third-party and vendor risk controls
Regulated Assurance
- Full Risk-Based Cybersecurity Framework programme
- Virtual CISO delivery with board reporting
- Risk register and annual risk assessment
- Penetration testing, quoted separately
- 24-hour incident reporting and threat-intelligence support
- Not taken alongside an institution Syndik8 assesses for its regulator
Third-party services (penetration testing, PCI DSS certification, data-protection filing fees) are billed at cost plus a 15% coordination margin, quoted separately.
05Three steps to a defended organization.
06Serving government and public sector separately
Ministries, agencies and states carry a different risk profile, procurement process and engagement model. That practice starts with a fixed-price diagnostic, not a retainer.
07See where your organization is exposed.
A no-cost check of your external exposure, CSAT and NDPA readiness, and monitoring gaps, delivered on one page.
Book your free audit or write to hello@syndik8.com.