NDPA modules · How you protect it
A green tick that cannot say what it prevents is decoration.
Twelve measures under Section 39, and every one of them has to answer the same question: what would go wrong without you? Turn each over and there is a specific failure on the back — usually one that already happened.
People can only see what their job needs
What it is for
The wrong-merchant export happened because a support role could pull the whole customer table.
- Owner
- Ngozi Eze
- Last tested
- Feb 2026
- Evidence
- role matrix, last reviewed February
Six families, twelve measures
Grouped by what they defend, not by control number
Because a board can argue about whether paper records are destroyed. Nobody can argue about ISO A.8.24. Two measures have never been tested at all, and both are marked accordingly.
4 of 12 fully in place
Keeping it unreadable
2 of 3 in placeCustomer data encrypted where it is stored
Segun Okoro
If a disk or a backup walks out of the building, encrypted data is not a breach you have to report.
Tested Apr 2026Data encrypted while it moves
Segun Okoro
Everything you send to a processor crosses a network you do not own.
Tested Apr 2026Card numbers and BVNs stripped from support tickets
Ngozi Eze
Customers paste both. What you catch is redacted; what you miss sits in Zendesk in the United States.
Tested May 2026
Limiting who can see it
0 of 2 in placePeople can only see what their job needs
Ngozi Eze
The wrong-merchant export happened because a support role could pull the whole customer table.
Tested Feb 2026Two-step login on anything holding customer data
Segun Okoro
The 16% without it are mostly branch staff, who are also the ones phished most often.
Tested Jun 2026
Knowing what happened
1 of 2 in placeEvery look at a customer record is recorded
Segun Okoro
Without this you cannot answer the only question that matters after an incident: who saw what.
Tested May 2026Agents are told what their app records
No owner
Monitoring 3,100 agents without telling them is not a security measure, it is the thing a security measure is supposed to make honest.
Never tested
Getting it back
1 of 1 in placeBackups exist and have been restored from
Segun Okoro
Availability is part of protection. A backup nobody has restored from is a hope, not a control.
Tested Mar 2026
Not keeping it forever
0 of 2 in placeData is deleted automatically when its time is up
Tunde Adeyemi
Three rules still rely on someone remembering, and the marketing activity has no deletion date at all.
Tested Jun 2026Paper records are destroyed, with proof
Adaeze Nwosu
Branch forms carry BVNs and signatures. Collections continued after the contract lapsed, so nobody can say where three months of paper went.
Tested Jan 2026
The people part
0 of 1 in placeStaff have been trained on handling customer data
Ngozi Eze
Coverage sits at 48%, and the group with the weakest coverage is the group with the most access.
Tested Feb 2026
Checking it works
0 of 1 in placeSomeone independent has tried to break in
No owner
Every control above is self-assessed. An audit will ask who checked, and the honest answer today is nobody.
Never tested
Every measure names the suppliers that depend on it
Your controls stop at your boundary. Your data does not.
Encryption in transit protects what crosses to three suppliers. Paper destruction depends entirely on a fourth, whose contract lapsed in 2023. A control register that does not name its suppliers is describing a building with the doors left off the plan.
Paper destruction · Lagos Data Centre Services
The contract lapsed in 2023 and destruction certificates stopped arriving in April. Three months of branch forms carrying BVNs and signatures are unaccounted for.
Ticket redaction · Zendesk
What the pattern matcher misses sits in the United States, in a system Asiri deliberately never reads. The control and the transfer fail together.
Agent monitoring · Twilio Segment
No owner, no notice, no safeguard on the transfer, and the read failed nine days ago. Four separate registers point at the same feed.
Encryption in transit · three suppliers
The one measure here that is genuinely doing its job across a boundary — and the reason it is testable is that somebody scanned every endpoint rather than assuming.
Never tested · nothing on file
Every measure above is self-assessed
Nobody independent has tried to break in. An audit will ask who checked, and the honest answer today is nobody — which Asiri states on the register rather than letting eleven green ticks imply otherwise.
The other untested measure is worse in a different way: 3,100 agents are monitored by an app that never told them. That is not a security measure at all. It is the thing a security measure is supposed to make honest.
What testing changes
- Before
- Eleven measures, all marked by the people who built them. An auditor treats that as a claim rather than as evidence.
- After
- The same measures, with a date and a firm attached. The register stops saying “we believe” and starts saying “on this date, they tried”.
- What it costs
- Less than the finding it prevents. F-014 lists three suppliers with nothing in force — a test would have found all three in an afternoon.
- What Asiri does
- Marks self-assessed measures as self-assessed, permanently, until somebody independent changes that. There is no box to tick your way out of it.