Programme owner
Sets scope, coordinates responsibilities and keeps the review moving.
Platform / Programmes & requirements
Know what’s required. Know who owns it.
Turn the NDPA, international standards and your own commitments into requirements with a named owner, linked evidence and a review date, so nothing waits for audit season.
Every programme
Pick what you answer to.
Run one programme or several in the same workspace. Each starts from your scope and owners, and shares evidence with the others where their requirements overlap.
Nigerian law
With specialist preparation for the return and the tier.
International standards
Mapped onto the same controls, so evidence is collected once.
- GDPRManagedCheck whether it applies, then map the records you already keep to its requirements.
- ISO 27001ManagedA security scope, risks with owners, controls and the evidence your certification auditor will ask for.
- ISO 27701ManagedRuns on top of ISO 27001: the privacy extension, mapped over the same controls and evidence.
- SOC 2AttestedAgreed scope, control owners and evidence, prepared for your independent practitioner.
- ISO 42001ManagedAI systems, their impacts and who answers for each, including Eri.
- PCI DSSManagedThe card data scope drawn first, with Asiri itself outside the cardholder data environment.
Your own
For requirements no published framework covers.
Certificates such as ISO 22301, NaDPAP and CBN RBCF can be recorded with their expiry tracked. They are not run as programmes, so no coverage is implied. See the full framework catalogue
From a requirement to a working plan
Give every requirement a way forward.
An annual deadline is one moment in a longer programme. Bring privacy, security and company requirements into work your team can own and revisit.
- 01
Start with your scope
Record the purpose, locations and responsibilities the programme covers. Choose a named owner and a review cycle that makes sense for the work.
- 02
Make requirements actionable
Record the requirements that apply to your organisation. Connect the controls and responsible people, keeping unresolved applicability decisions visible.
- 03
Bring the supporting work together
Link evidence and review decisions to the requirements they support. Your reviewers can follow the context instead of piecing it together across separate files.
- 04
Keep the programme moving
Use outstanding work and recorded reviews to decide what needs attention next. Revisit scope and supporting material when your organisation changes.
See the work take shape
A new supplier. An existing security programme.
Koru Commerce brings a hosting supplier into scope. Its team connects the review to the programme it already runs.
Fictional company example
- Requirement
- Review supplier access to company information
- Responsible team
- IT & Security
- Supporting work
- Supplier assessment and access-review evidence
- Review question
- Who owns the outstanding access exception?
Human review
The programme lead asks IT to confirm the exception owner before recording the review decision.
One requirement, its supporting records and the next action stay connected.
Clear responsibilities
Who keeps a programme moving.
An owner sets the scope, control owners supply the context, and a reviewer records the decision.
Control owner
Provides the supporting context and follows up the work assigned to the team.
Authorised reviewer
Examines the available evidence and records the decision within approved access.
What you take forward
A working plan your team can return to.
Keep the programme connected to the records behind it, rather than treating a checklist as the final result.
- Recorded scope and ownership
- Requirements with related controls and evidence
- Review decisions and outstanding work
Before you start
What teams ask when they set up a programme.
Can we run more than a privacy programme?
Yes. Asiri brings privacy, information security and company-authored requirements into scoped programmes. The specialist preparation available in an NDPA programme is distinct from the workflows available for other requirements.
What should we bring to get started?
Start with the purpose of the programme, its owner, the parts of the organisation in scope and the requirements you need to manage. Existing policies and evidence give your team useful context to connect as the programme develops.
Can an external professional work with us?
Yes, through the access your company approves. Agree the engagement and separately authorise the relevant scope. A professional listing or signed agreement alone does not grant access to company records.
Set up one programme, then grow it.
Start with the business scope and requirements that matter to your team. Connect controls, evidence and review decisions, and work with qualified advisers where your programme calls for an independent opinion.