Frameworks · bring your own
Your bank's questionnaire is a framework too
A CBN circular, a customer's 180-row security review, a parent company's internal standard. Paste the requirements in and Asiri maps each one onto controls you already hold — or tells you plainly that nothing covers it.
- CBN RBCF
- Buyer review · 180 rows
- Group standard · v6
CBN Risk-Based Cybersecurity Framework
Board-approved cybersecurity policy
§3.1
Annual penetration test by a third party
§5.4
Cyber incident reported within 24 hours
§7.2
Cybersecurity awareness for all staff
§4.6
Your existing control
Policy register · approved 14 Feb
Approval minute attached
Security measures · pen test 2026
Report on file, dated
Incident register · 72-hour clock
Clock exists, threshold differs
No control covers this
Training register is empty
Four steps, no consultants
From a spreadsheet nobody wanted to a mapped framework
The questionnaire arrives as a spreadsheet, a PDF, or a portal you have to retype. All three end up in the same place.
Step one
Paste the requirements
A spreadsheet column, a PDF, or rows typed in. Each becomes a requirement with its own reference so the answer can cite it back.
Step two
Asiri proposes the mapping
Each requirement is matched to controls you already hold, with the evidence behind them. You approve or reject every line.
Step three
The gaps are named
Anything nothing covers is listed as uncovered, with what would cover it. No silent stretching.
Step four
Answer once, send often
The next buyer asking the same question gets the same evidence, dated to when you send it rather than when you wrote it.
What people actually bring us
Six regulators and one very long spreadsheet
Nigerian companies answer to more than one supervisor, and each has its own paperwork. These are already recognised in Asiri — you can map to them without building the framework yourself.
CBN Risk-Based Cybersecurity Framework
RecognisedBanks, payment companies and OFIs. Overlaps the Act heavily on security, and adds a 24-hour incident clock.
NITDA guidelines
RecognisedPublic-sector procurement and ICT providers. Largely satisfied by NDPA work already done.
NAICOM and SEC circulars
RecognisedInsurers and capital market operators. Sector-specific reporting rather than new controls.
NCC consumer data rules
RecognisedTelecoms and licensees. Where they conflict with the Act, Asiri shows both obligations rather than picking one.
Anything else
CustomA parent standard, a customer questionnaire, an internal policy set. Build it once and reuse the same evidence.
Three rules on custom frameworks
A framework you invented cannot certify you
Custom frameworks are for answering people, not for making claims. Asiri keeps that line bright, because the alternative is a badge nobody can check.
Rule one
No badge, ever
A custom framework produces an answer set you can send, not a seal you can display. Nothing external issued it.
Rule two
Evidence is shared, not copied
A control mapped to six frameworks is still one control. Fix it once and every answer set updates — including the ones already sent, which are versioned.
Rule three
An unmapped row stays unmapped
Asiri will not attach a requirement to an adjacent control to make the coverage figure look better. It marks it uncovered and tells you what would cover it.
Send us the questionnaire you are dreading
We will map it against what you already hold and tell you how many rows you can answer today — before you commit to anything.