One workspace for the audit team, the reviewer and the institution, with the Directive's structure built in.
Weighted compliance, rating bands, weakest areas first, and every law and framework side by side.
Largely compliant
Worked example: Example Bank PLC, Tier 1.
Nobody approves their own work. Returned areas come back with a note; approved ones lock.
Auditees get their own portal and see only what you asked them for. Every file is scanned and fingerprinted.
Evidence request · CISD 5(1)
Board-approved information security policy
Due 30 November · from Head of Information Security
Issued as numbered, fingerprinted PDFs, plus the workbook and findings register.
Audit report · v2
Example Bank PLC – CISD 2026
sha256 5493554a0106…
Who changed what, when, and what it was before.
Annex A tiers and alternative controls applied to every requirement, with BoG overrides.
Findings go to management for a response, fixes come back with evidence, and you verify them. Next year starts from where this one ended.
Send gaps to management in one go. Track who's answered, what's being fixed and what's ready for you to verify.
55of 273 closed
What they'll do, who owns it and by when. Their response updates the requirement, the dashboard and the report.
CISD 5(3) · Governance
Appoint a Board Committee on cyber and information security risks
Management response
Agreed. The committee charter goes to the Board in its Q1 sitting, with the CISO as secretary.
Roll forward in one step: same client, scope and team. Open findings and still-valid evidence come along.
Figures from the worked example: Example Bank PLC, Tier 1.
The small things that make a long engagement lighter, for the audit team and the institution alike.
Every applicable requirement, grouped by topic, with what usually satisfies it. Pick, choose who and when, and send. The institution gets one email.
Type a reference like 4(2) and land on the requirement. Engagements, findings and people too, from any page.
Areas waiting for your review, evidence sent back, fixes to verify. Each opens where you act.
Every change saves as you go. If a session ends, sign in again in another tab and what you typed is saved.
Fieldwork on an iPad, review on a laptop, a quick check on a phone. Light, dark, or matching the device.
Each requirement carries its mappings, so a single result counts toward every law and framework it relates to.
Requirements in the CISD 2026 library mapped to each instrument.
Run several CISD engagements at once with one method and a review trail behind every finding.
Know where you stand against your tier before the auditors arrive, and stay there between audits.
TOTP for everyone; Entra ID, Google and Okta sign-in with verified domains.
Every request checked against the caller's organisation, attacked in tests.
Uploads scanned for malware and fingerprinted; reports too.
An append-only activity log with before-and-after values.
Still wondering something? Ask us directly; a person who knows the Directive replies within one working day.
The tier checker takes two minutes. No sign-up.
The Bank of Ghana's CISD 2026 scales by Annex A tier. We work out exactly what applies to the institution, then run the whole audit on it: assess, review, report.
Pick a tier
Tier 1, e.g. Universal Bank735 in full0 alternative control12 out of scope