NDPA modules · How you protect it
Twelve measures. Every one of them self-assessed.
Six are in place, three are partial, three were never built. Each carries an owner, a date it was last tested, and the evidence behind it — and the twelfth measure is the one that would check the other eleven.
- At rest
- In transit
- Redaction
- Roles
- Two-step
- Audit log
- Agent notice
- Restore
- Deletion
- Paper
- Training
- Who checks
- In place · 6
- Partial · 3
- Never built · 3
The measures, by what they are for
Grouped by the question they answer, not by the tool that does it
"Appropriate technical and organisational measures" is the Act’s phrase and it is deliberately open. What it is not is a product list — so each measure here says what it protects against, who owns it, and when it was last actually tested.
Keeping it unreadable
2 of 3 in place- Data encrypted where it sits
If a disk or a backup walks out of the building, encrypted data is not a breach you have to report.
AWS KMS key policy, screenshot and config exportSegun Okoro · tested Apr 2026In place - Data encrypted while it moves
Everything you send to a processor crosses a network you do not own.
TLS scan, all endpoints A or betterSegun Okoro · tested Apr 2026In place - Sensitive numbers stripped from tickets
Customers paste both. What you catch is redacted; what you miss sits in Zendesk in the United States.
Pattern matching catches cards, not BVNsNgozi Eze · tested May 2026Partial
Limiting who can see it
2 of 2 in place- Access limited by role
The wrong-merchant export happened because a support role could pull the whole customer table.
Role matrix, last reviewed FebruaryNgozi Eze · tested Feb 2026In place - Two-step sign-in for staff
The 16% without it are mostly branch staff, who are also the ones phished most often.
84% of staff enrolledSegun Okoro · tested Jun 2026In place
Knowing what happened
1 of 2 in place- Every read and change is logged
Without this you cannot answer the only question that matters after an incident: who saw what.
Audit log retained 12 monthsSegun Okoro · tested May 2026In place - Agents are told what their app records
Monitoring 3,100 agents without telling them is not a security measure — it is the thing a security measure is supposed to make honest.
Nothing on fileUnassigned · tested neverNever built
Getting it back
1 of 1 in place- Backups that have been restored from
Availability is part of protection. A backup nobody has restored from is a hope, not a control.
Restore drill, 41 minutes to full recoverySegun Okoro · tested Mar 2026In place
Not keeping it forever
0 of 2 in place- Retention rules that run themselves
Three rules still rely on somebody remembering, and the marketing activity has no deletion date at all.
Runs on 6 of 9 retention rulesTunde Adeyemi · tested Jun 2026Partial - Paper destroyed under certificate
Branch forms carry BVNs and signatures. Collections continued after the contract lapsed, so nobody can say where three months of paper went.
Certificates stopped arriving in AprilAdaeze Nwosu · tested Jan 2026Never built
The people part
0 of 1 in place- Staff have signed the rules
Coverage sits at 48%, and the group with the weakest coverage is the group with the most access.
1,721 of 3,609 have signedNgozi Eze · tested Feb 2026Partial
Checking it works
0 of 1 in place- Somebody audits the measures above
Every control above is self-assessed. An audit will ask who checked, and the honest answer today is nobody.
Nothing on fileUnassigned · tested neverNever built
The measure that is missing
Every control above is marked in place by the person who owns it
An audit will ask who checked. Today the honest answer is nobody — there is no internal audit of these measures and there never has been. Asiri prints that as its own line on the register rather than letting the six that are in place imply an assurance nobody performed.
Nobody has audited these measures
No internal audit exists, has ever been scheduled, or has an owner. It is the twelfth line on the register precisely because leaving it off would make the other eleven look stronger than they are.
Two more measures were never built at all
The notice to agents and destruction of paper under certificate. Each is marked missing rather than partial, because partial would imply somebody started.
A test date ages in public
February is recent in February. Asiri shows the date rather than a tick, so a control tested eighteen months ago cannot pass as current.
Evidence is named, not asserted
A restore drill that took 41 minutes, a TLS scan, a role matrix. Each measure points at the artefact an auditor would ask to see.
A measure nobody has tested is a hope with an owner
Asiri keeps the test date beside every measure and ages it in public. Connect your systems and the ones that have drifted surface on their own, rather than at the audit.