Ethnos Comply runs every compliance engagement end to end — AI-led data mapping, gap reports, policy suites, evidence and board-level risk reporting — on the standards Nigerian businesses answer to.
Mapped to the standards and regulations you answer to
From the first conversation with a client to the pack on their board’s table — every step in one place, every step on the record.
Capture the organisation, its sector, regulators and systems in one risk profile. Pick the standard — or an integrated management system — and say whether this is a new or returning client.
Questions are mapped to clauses. Every answer is judged adequate, partial or inadequate, with follow-ups until there is enough to assess. Clients can answer through a secure portal instead.
Is there an approved information security policy?
Is MFA enforced for remote access?
↳ Follow-up: which systems sit outside MFA?
Are backups tested for restoration?
Clause by clause, grounded in the standard, the law behind it and the answers given — drafted by AI, reviewed by your consultants, accepted by the client.
Documents are generated in order and approved in order. Where standards overlap, they merge into one document with the clause mapping shown.
Requests are drawn from the gaps and collected through a link and access code. Each upload is hashed, timestamped and checked by AI against the standard and the approved policies.
Public information researched by AI and approved by a manager, alongside your own assessments — seven board areas, quarter by quarter, every fact sourced.
The details that make the difference between a compliance tool and a compliance practice.
Every answer is judged against the clause and the law behind it. Thin answers get follow-ups, not a pass.
A private link and an 8-character access code. Save and resume; every attempt logged.
An eligibility wizard recommends the SAQ; a Report on Compliance is routed to a QSA.
Clients comment and upload revisions; AI checks each document is still current against the standard.
A contribution calendar and strengths profile for every consultant, from the audit trail.
Approvals, publications, returned evidence, re-ratings and board packs — who, what and when, in an append-only log.
Significant exposures, limit breaches, non-performing loans, cyber incidents, control weaknesses, regulatory findings and emerging risks — quarter by quarter, benchmarked against the sector. Public facts are researched by AI, cited, and approved by a manager before they count.
The sector regulators’ frameworks sit beside the international standards, so one engagement covers what your supervisor expects.
CBN RBCF · PCI DSS · NDPA
PCI DSS SAQs · CBN · NDPA
NAICOM guidelines · NDPA
PenCom IT & data security
NCC cybersecurity guidelines
NDPA · NDPC audit · GDPR
Ethnos Cyber’s consultants use it to run client engagements, and clients take part through a secure portal — answering questions, reviewing documents and uploading evidence without needing an account.
NDPA (including the NDPC audit questions), PCI DSS with all ten SAQs, ISO/IEC 27001, ISO 22301 and ISO/IEC 20000-1 — individually or as an integrated management system — plus CBN’s Risk-Based Cybersecurity Framework, NAICOM, PenCom, NCC, SWIFT CSP, SOC 2 and GDPR.
No. AI drafts — questions, verdicts on answers, gap reports, documents and evidence checks — and people decide. Every assessment can be overridden with a reason, and nothing reaches a client or a board without a consultant or manager approving it.
SAQ-based assessments run fully in Ethnos Comply, with an eligibility wizard that recommends the right SAQ. Where a Report on Compliance is required, the platform flags it so it goes to a Qualified Security Assessor.
From public sources — regulators, published results, reputable press — researched by AI with every item cited, and approved by a manager before it is used. Control weaknesses come straight from your own assessments.
Role-based access for staff; private links and access codes that lock after repeated failures for clients; every evidence file hashed with SHA-256; and an append-only audit trail of every action.
Thirty minutes, your regulator, your questions. We’ll show you the engagement from first answer to board pack.