Standards and regulatory mastery
International rigour, calibrated to regional mandates. Frameworks that turn security into accountable governance.
Governance you can implement, measure and evidence
Security governance is not only having policies in place. It is a structured approach that can be implemented, measured, evidenced and continuously improved.
Govern
Set direction, roles and risk appetite.
Identify
Know your assets, risks and obligations.
Protect
Put the right safeguards in place.
Detect
Find events and anomalies early.
Respond
Act on incidents and report them.
Recover
Restore services and learn.
Map once, comply many times
Most controls satisfy several frameworks at once. Mapping them together removes duplicated effort and makes audits faster.
One control, every framework
Choose a requirement to see where it lands in each standard and in Ghanaian law.
Only the right people, with the right access
Who can reach which systems and data, and how that is approved, reviewed and removed.
- ISO/IEC 27001:2022
- Annex A 5.15, 5.18, 8.2
- NIST CSF 2.0
- PR.AA
- SOC 2
- CC6.1 to CC6.3
- PCI DSS v4.0
- Requirement 7
- GDPR
- Article 32
- HIPAA Security Rule
- §164.312(a), access control
- Ghana
- Data Protection Act, 2012 (Act 843): appropriate technical and organisational safeguards for personal data.
Suppliers held to your standard
Due diligence, contract terms and monitoring for vendors and processors that touch your data.
- ISO/IEC 27001:2022
- Annex A 5.19 to 5.22
- NIST CSF 2.0
- GV.SC
- SOC 2
- CC9.2
- PCI DSS v4.0
- Requirement 12.8
- GDPR
- Article 28
- HIPAA Security Rule
- §164.308(b), business associate contracts
- Ghana
- Data Protection Act, 2012 (Act 843): duties when a third party processes personal data on your behalf.
Detect, escalate, notify, learn
A rehearsed process for handling security events and telling the right people at the right time.
- ISO/IEC 27001:2022
- Annex A 5.24 to 5.28
- NIST CSF 2.0
- RS.MA, RS.CO
- SOC 2
- CC7.3 to CC7.5
- PCI DSS v4.0
- Requirement 12.10
- GDPR
- Articles 33 and 34
- HIPAA Security Rule
- §164.308(a)(6), security incident procedures
- Ghana
- Data Protection Act, 2012 (Act 843): notifying the Data Protection Commission and affected people after a security compromise.
Critical services stay up
Impact analysis, recovery plans and testing so operations survive a disruption.
- ISO/IEC 27001:2022
- Annex A 5.29, 5.30, and ISO 22301
- NIST CSF 2.0
- RC.RP
- SOC 2
- A1.2, A1.3
- PCI DSS v4.0
- Requirement 12.10.1
- GDPR
- Article 32(1)(c)
- HIPAA Security Rule
- §164.308(a)(7), contingency plan
- Ghana
- Bank of Ghana ICT directives: continuity and recovery expectations for regulated financial institutions.
Illustrative crosswalk for orientation. References are to ISO/IEC 27001:2022, NIST CSF 2.0, SOC 2 (2017 Trust Services Criteria), PCI DSS v4.0, GDPR and the HIPAA Security Rule. Confirm against current versions before relying on them.
International standards
- ISO/IEC 27001:2022Information security management systems
- A structured framework for establishing, implementing and continually improving an information security management system.
- ISO 22301Business continuity management
- Supports organisational resilience and preparedness for disruptive events.
- PCI DSSPayment Card Industry Data Security Standard
- Security requirements for organisations that store, process or transmit payment card information.
- SOC 2Service organisation controls
- Security and trust requirements for organisations that provide services and handle customer data.
- NIST CSFCybersecurity Framework
- A structured approach to managing and improving cybersecurity risk.
- COBITIT governance and management
- Supports governance, management and alignment of enterprise information and technology.
Privacy and regulatory compliance
- GDPREuropean data protection
- Data protection and privacy requirements, relevant where you hold data on people in the EU.
- HIPAAHealth information protection
- Healthcare information protection and privacy requirements.
- Data Protection Act, 2012 (Act 843)Ghana
- Data protection and privacy requirements that apply in Ghana, including registration with the Data Protection Commission.
- Cybersecurity Act, 2020 (Act 1038)Ghana
- Ghana's national cybersecurity legislation, relevant to public-sector bodies and operators of critical information infrastructure.
- Bank of Ghana ICT directivesFinancial sector
- Technology and information-security requirements for regulated financial institutions.
Frameworks aligned to your sector
| Sector | Relevant frameworks |
|---|---|
| Financial services | Bank of Ghana ICT directives, AML/KYC, ISO 27001 |
| Healthcare | HIPAA, data protection, ISO 27001 |
| Telecommunications | National Communications Authority requirements, ISO 27001 |
| Technology and SaaS | SOC 2, ISO 27001 |
| Education | Data protection, ISO 27001 |
| Government | Data protection, NIST, ISO 27001 |
Not sure which framework applies to you?
Talk to us and we will map the rules that actually govern your organisation.