For banks, PSBs and the fintechs that serve them
Penetration testing built to stand up to CBN and NDPA review.
Independent, manual testing of your web, mobile, API and cloud systems, with reports your board, your examiners and your Data Protection Compliance Organisation can actually use.
What the CBN framework asks of your testing
The CBN’s Risk-Based Cybersecurity Framework and Guidelines for Deposit Money Banks and Payment Service Banks (31 May 2024) applies to commercial, merchant and non-interest banks and to payment service banks. It also reaches the fintechs and vendors those banks work with: section 2.3 asks banks to assess their third parties using audits and test results.
| Section | Requirement |
|---|---|
| s.2.2(iii) | Independent third-party penetration test at least once a year Your own team’s testing counts for a lot, but this line needs an outside tester. The appendix also allows more frequent tests on internet-facing financial systems, so your apps, APIs and portals belong in scope. |
| s.2.2(ii) | Vulnerability assessment every year An assessment of what could go wrong and how well your controls hold up. The appendix goes further and asks for an assessment of all IT assets, reported at least every quarter, so plan around the quarterly rhythm. |
| s.2.2(iv) | Internal vulnerability scans every quarter Scans list known weaknesses. They’re a separate requirement from the penetration test, which shows which weaknesses an attacker can actually use. You need both. |
| s.1.1(viii) | Cybersecurity reporting to the board every quarter Board reports must cover vulnerability management and penetration test results, remediation and compensating controls. A report your board can’t read creates work every quarter. |
Source: CBN Risk-Based Cybersecurity Framework and Guidelines for Deposit Money Banks and Payment Service Banks, 31 May 2024.
We act as your independent third-party tester. Every finding is proven by hand, written up in an executive summary your board can read and a technical report your engineers can use, and re-tested free once you’ve fixed it. Your next quarterly report can say fixed, not "in progress".
What the NDPA and GAID 2025 ask of your security
If you’re a data controller or processor of major importance, the GAID 2025 ties your annual Compliance Audit Return to real security work.
- Risk-based audits (Article 10). Identify each point of risk and how often you audit it. Systems where personal data can be reached online must be audited “as frequently as possible”.
- A security schedule (Article 29). It includes vulnerability tests of databases, authentication checks and encryption reviews, vetted by a certified information security officer.
- Your Compliance Audit Return (Article 10, Schedule 2). It asks you to rate your data security against recognised standards. Filing is due by 31 March for most organisations established before 12 June 2023, and Ultra-High and Extra-High Level organisations file through a licensed DPCO. Test early enough to fix and re-test before you file.
Who this is for
- Commercial, merchant and non-interest banks
- Payment service banks
- Fintechs and vendors that banks hold to the same standard
- Data controllers and processors of major importance preparing a Compliance Audit Return
What we test
Web applications and portals
Customer, agent and admin portals, including whether one user can reach another user’s data or money.
Mobile apps
Android and iOS apps and the APIs behind them, tested the way a determined user would.
APIs and integrations
Payment, partner and internal APIs, including authorisation between accounts and roles.
Cloud and external infrastructure
Internet-facing systems and cloud configuration that an attacker sees first.
What you get
- An executive summary your board can read
- A technical report with every finding proven and explained
- Findings mapped to what you report against: CBN framework sections, NDPA/GAID articles, and ISO 27001 or PCI DSS controls where relevant
- A free re-test, so fixes are verified closed
How it works
- 1
Scope
A 15-minute call, then a signed scope. Nothing is touched outside what you’ve authorised in writing.
- 2
Test
Manual testing in agreed windows, with urgent issues flagged to you as soon as we find them.
- 3
Report
An executive summary and a technical report, with findings mapped to your obligations.
- 4
Re-test
Once you’ve fixed things, we re-test free and confirm what’s closed.
Further reading
CBN Risk-Based Cybersecurity Framework: Penetration Testing Guide
A practical guide to CBN cybersecurity framework penetration testing, governance evidence, remediation records and examination readiness for Nigerian financial institutions.
Read the guideNDPA Compliance Audit: Technical Evidence Checklist for 2026
Prepare technical evidence for a Nigerian data protection compliance audit under the NDPA 2023 and GAID 2025, with statutory duties separated from audit practice.
Read the guideFrequently asked questions
Your board report, February self-assessment and Compliance Audit Return all need the same thing: proof.
Fifteen minutes, no obligation. We’ll tell you what to test first.
Book a 15-minute scoping callLoading the booking calendar…
Open it in a new tabPick a time that works for you — a 15-minute call with a senior pentester.
This page summarises parts of the CBN framework and the GAID 2025 for orientation. It isn’t legal advice; confirm your obligations with your compliance team or DPCO.