Keep the control register
Map controls, owners, evidence, test dates, and exceptions to the institution's approved control framework.
Nigeria / CBN / cybersecurity evidence
Cybersecurity reporting should not start from scratch every quarter.
We build private workflows that keep control records, self-assessment evidence, remediation items, and review packs current for CBN cybersecurity reporting cycles. The workflow organizes the evidence; the institution and its security owners decide what is adequate.
Control evidenceSelf-assessment packRemediation itemsSecurity owner review
Pattern demonstration / same workflow, synthetic material
Fixed-scope setupClient-owned accountsDraft-and-review firstFull handover
Where cybersecurity reporting loses time
The evidence exists, but it is scattered.
A control may be documented, tested, and owned in different systems. The reporting work is assembling them into one defensible record.
Prepare the assessment
Assemble the current control state, supporting records, gaps, and remediation items into a review pack.
Track the open items
Link each gap to an owner, due date, evidence, and follow-up so the next assessment does not restart the work.
The security boundary
The system keeps records. It does not certify security.
No guarantee of protection
The workflow prepares and checks evidence. The institution's security owner and auditors determine whether controls are adequate.
No automatic filing
Self-assessment returns and regulator communications stay with the authorized owner and the official channel.
Current terms only
The relevant CBN circular, such as the Cybersecurity Self-Assessment Tool circular, is verified against the official version before use.
A first cybersecurity evidence workflow
Start with the controls behind one return.
Pick the reporting cycle
Choose the CBN cybersecurity self-assessment or return that the institution must prepare and the owner responsible for it.
Register the controls
List each control, owner, evidence, test date, and exception that supports the assessment.
Run the evidence check
Compare current evidence against the required pack and review missing, stale, or unowned items.
Hand over the review
Prepare the assessment pack, source index, and open items for the security owner and any auditor or regulator review.
A cybersecurity return is easier to prepare when the control and its evidence are one record.
Why trust Pristine3D?
We build and operate production software.
Pristine3D Ltd builds and operates live digital products, and we run private AI workflows internally as part of our own operations. We scope around your real workflow: the documents you own, the questions your team asks, and the access boundary you approve. Based in Lagos, Nigeria, we work remotely with clients worldwide.
We already run live products
Based in Lagos, Nigeria, Pristine3D currently builds and operates smartcards.ng, venu.ng, photoshoot.ng, and ugc.ng in production.
We start with the actual workflow
One input, one output, one test set, and one person who owns the result. We scope a real workflow instead of a transformation programme.
The boundary stays visible
Cloud, model, storage, and messaging accounts stay in your name. The chosen data path, access rules, test record, documentation, and training are part of the agreed scope.
Pricing / fixed scope
Know the starting numbers before you ask.
The final quote follows the workflow. Infrastructure and model bills stay on your accounts.
One Workflow
Starting from$3,500 / ₦2.5m
2 to 3 weeksOne workflow for a small team, with training and handover.
See the one-workflow packageFirm-wide
Starting from$7,500 / ₦8m
4 to 6 weeksMultiple sources, roles, integrations, and admin handover.
See the deploymentAnnual support
Starting from$3,000 / ₦1.5m
per yearStandard care for one delivered workflow. Optional. Larger deployments and active monitoring are separately scoped.
See supportArchitecture review from $500. Standard annual support is $3,000 / ₦1.5m per year for one delivered workflow. New workflows, integrations, active monitoring, and infrastructure are separately scoped; infrastructure, model, storage, and messaging bills stay on client accounts. Full pricing and what changes the quote
Straight answers
Common questions.
Does this guarantee our systems are secure?
No. It organizes control and assessment evidence. Security adequacy is decided by the institution's owners and auditors.
Can it submit the CBN assessment?
No. It prepares the evidence and review pack. Submission and responsibility stay with the institution.
How is this different from the AML/CFT page?
That page organizes customer and transaction evidence for financial crime returns. This page is the security control and self-assessment evidence layer.
Own your knowledge base
The model is not the product. The knowledge base is.
Documents, the retrieval index, access rules, and the workflows built around them are the asset, and they compound. We deploy so the knowledge base stays yours: on your accounts, in the environment you choose, under access rules your team defines. The model behind the answers is a connector, so the knowledge base moves with you, not with a vendor.
Your corpus, your index
The document store, metadata, and retrieval setup live on accounts you own. No vendor holds the corpus.
Models are swappable parts
Change the model provider, move regions, or go local without rebuilding the knowledge base or the workflow.
The knowledge base is the alpha
Every improvement to the corpus improves the answers, and the improvement stays with you, not with a vendor.
Keep exploring
Related setups.
Start with the assessment
Which cybersecurity record is hardest to assemble?
Tell us the CBN return, the control framework, the evidence you hold, and the security owner. We will scope a workflow around the records the institution already uses.