Brain · Direction, Risk & Assurance
GUIDE — Advisory, Risk & Assurance
Build Cyber Confidence
Expert-led assessments, audits and strategic engagements aligned with NIST CSF, ISO/IEC 27001, SOC 2, PCI DSS and Ghana's Act 1038, tailored to your industry and risk appetite.
- Assess
- Assure
- Strategize
Executive Summary
- 01Cybersecurity advisory works best when each engagement answers one defined question and ends in a concrete, reusable deliverable.
- 02Map controls once to NIST CSF 2.0, ISO/IEC 27001 and local law, then reuse the evidence for every audit.
- 03Testing earns trust only when scope is authorized and findings are prioritized, fixed and then re-verified.
Why GUIDE
GUIDE prepares institutions for secure transformation. Before anything is built or bought, we establish where you stand, what your obligations require and which investments reduce the most risk, so that every engineering and operations decision that follows has a clear mandate.
What Clients Gain
- Board-level clarity on cyber risk
- Independently validated defenses
- Audit-ready compliance
- A fundable security roadmap
13 GUIDE Services
Advisory, Risk & Assurance
- Cybersecurity Strategy & Advisory
- Governance, Risk & Compliance
- Enterprise Risk Management
- ISO Certification Readiness
- Regulatory Assurance
- Virtual CISO Services
- Third-Party Risk Management
- Business Continuity & Resilience Advisory
- Privacy and Data Protection
- Security Assessments and Audits
- Vulnerability Assessment & Penetration Testing
- Red and Purple Teaming
- Cyber Academy & Training
Perspective
The Context Behind Our Approach
Choose the Right Starting Point
Start with the decision you must make, not the service name. If the board needs a baseline, begin with a maturity assessment against a recognized framework. If a customer or regulator demands proof, start with gap analysis against the specific standard. If you suspect exposure, test first. Each path should end in a defined deliverable: a scored baseline, a control mapping, a findings report with evidence. Ask every provider who owns remediation, how findings are prioritized, and how the work will be re-verified after fixes are made.
How Frameworks Fit Together
Because frameworks overlap, map your controls once and reuse the evidence across them. NIST CSF 2.0 groups its outcomes into six functions: Govern, Identify, Protect, Detect, Respond, and Recover. ISO/IEC 27001:2022 Annex A lists 93 controls in four themes, and ISO/IEC 27002:2022 explains how to implement them. CIS Controls v8 provides prioritized technical safeguards. In Ghana, also account for obligations under Act 1038 and Act 843, along with sector rules such as the Bank of Ghana Cyber and Information Security Directive. A single control set can satisfy several auditors.
What Each Test Actually Proves
A vulnerability assessment lists weaknesses. A penetration test proves which ones an attacker can chain into real access. A red team goes further and tests whether your people and tools notice an intrusion at all. Purple teaming then replays techniques with defenders watching, so detections improve immediately. MITRE ATT&CK Enterprise, with its 14 tactics, gives both sides a shared language. Scope, rules of engagement and written authorization must be agreed before any test begins.
Compliance is a byproduct of well‑run controls. Prove the controls work, and every audit becomes a retrieval exercise.
Glossary
Key Terms
- Risk Appetite
- The amount and type of cyber risk leadership is willing to accept in pursuit of business objectives.
- Statement of Applicability
- The ISO/IEC 27001 document that lists which Annex A controls apply, why, and their implementation status.
- Rules of Engagement
- The written limits, timing and authorization that govern what a tester may do during an assessment.
DAAKYI Cyber Academy
A Capability Path from Awareness to Readiness
Stage 1
Awareness
Security awareness and phishing simulation for the whole workforce.
Behavior change measured campaign by campaign
Stage 2
Skills
Technical cybersecurity training for IT and security teams.
Teams able to operate and harden what we deploy
Stage 3
Certification
Accredited professional certification for security and audit staff.
Recognized credentials through PECB
Stage 4
Readiness
Executive briefings and tabletop exercises on realistic scenarios.
Leaders who have rehearsed their response
Delivery Methodology · GUIDE Stages
GUIDE
- 01Discovery and RequirementsScope, obligations and success measures.
- 02Posture AssessmentMaturity and gaps against frameworks.
- 03Architecture and Program DesignTarget state, roadmap, business case.