Powered by Praegis Enterprise
Information Security3 min read
Building an Effective Information Security Management System
What an ISMS is for, and why the best ones are used daily rather than prepared for audits.
Information security. Governance. Assurance.
Security you can prove to auditors.
Build Trust. Stay Ready. Move Forward.
Praegis helps organisations establish effective security programmes, manage risk, meet regulatory obligations and build lasting organisational resilience. We bring advisory expertise, a connected GRC platform and professional development together, built in Africa for a global business environment.
GRC Control PlanePRAEGIS TECHNOLOGY
Praegis is an information security consulting firm. Advisory and Consulting helps organisations build effective security programmes, manage risk and meet regulatory requirements. Praegis Enterprise is a GRC platform that connects obligations, risks, controls and evidence in one place. Praegis Practitioner is a learning platform with GRC Foundations, real-world case studies, career assessments and an AI learning companion.
01 · Information Security Advisory
Security, governance and compliance built for the real world.
Praegis works with organisations to establish, improve and sustain information security and GRC programmes. We start from how your business actually operates, then build the policies, controls, evidence and ownership that let you meet customer, regulatory and board expectations.
Our services run from ISO management systems and assurance readiness to data protection, AI governance, security testing, awareness and regulatory advisory. You can engage us for one service or for a connected programme.
A clear line on certification. Praegis provides gap assessments, implementation, documentation, remediation and readiness support. Independent accredited certification bodies issue ISO management system certificates, and independent auditors issue SOC reports.
Service 1 of 10
Information Security Management Systems
We help you design, implement and operate an ISMS aligned to ISO/IEC 27001, so security is managed through clear risks, owned controls and evidence rather than good intentions. The work is practical and proportionate to the size and complexity of your organisation.
What you receive
- ISO/IEC 27001 implementation and readiness plan
- ISMS gap assessment
- Risk assessment and risk treatment
- Statement of Applicability
- Security policies and procedures
- Internal audit preparation
- Certification readiness support
Who needs it
- Organisations pursuing ISO/IEC 27001
- SaaS and fintech companies answering customer security due diligence
- Businesses with informal security practices that need structure
Expected outcomes
- A documented ISMS that people actually operate
- Clear ownership of risks and controls
- Readiness for an independent certification audit
Service finder
Not sure where to start?
Select everything that applies to you. We will point you to the services that fit, and you can send us the list as your enquiry.
Your recommendations
Select one or more statements on the left and your recommended services will appear here.
Our approach
How a Praegis engagement works, from first conversation to lasting practice.
Select a stage to see what happens and what you receive. Scope and sequence are agreed with you, because no two organisations start from the same place.
Stage 1 of 6
Discover
We learn your business, your customers, your obligations and what you want to achieve. Good scoping saves months later, so we agree objectives, boundaries and who needs to be involved before any work begins.
What you receive
- Context and stakeholder summary
- Objectives and scope agreement
- Engagement plan
02 · Praegis Enterprise · The GRC Operating System
One control plane. Connected governance, risk and compliance.
Praegis Enterprise helps organisations run their GRC activities through connected workflows, centralised evidence, structured controls and intelligent oversight. It is the technology side of Praegis: the GRC Control Plane.
Instead of obligations in one spreadsheet, risks in another and evidence in a shared drive, everything is linked. A requirement points to the risk it addresses, the control that treats it and the evidence that proves the control works.
Governance Management
Policies, roles, decision rights and oversight in one place.
Risk Management
A single risk register linked to controls and treatment.
Compliance Management
Obligations and frameworks mapped to how you comply.
Security Programme Management
Plan and track security work as a managed programme.
Audit and Assurance
Plan audits, track findings and close corrective actions.
Vendor Risk Management
Bring suppliers into your risk and assurance view.
Security Awareness
Manage training and awareness as part of your controls.
Cyber Operations
Connect operational security activity to your GRC picture.
AI Governance
Oversight for how AI is adopted and used.
Evidence Management
Collect, link and seal the evidence behind each control.
Policy Management
Draft, approve, publish and review policies on a cycle.
Regulatory Intelligence
Track what applies to you and what has changed.
Northgate BankplcMission Control
Everything across your entitled engines that needs a decision, ranked by what actually matters right now.
Regulatory deadline · Incident Command · Privacy
Incident #2291: NDPA 72-hour notification window closing
06:12:41 remaining
Awaiting your approval
Close Incident #2288 as resolved
Root cause confirmed, remediation verified, no outstanding regulatory notifications.
proposed by: Abby, Incident Command
Trending toward appetite · Risk Intelligence
Vendor concentration risk: 3 critical vendors, 1 provider
Residual score 16 of 25, appetite threshold 18
Control test failed · Universal Control Mapping
A.8.24: Encryption at rest
Linked risk treatment created automatically. Owner: J. Adeyemi.
Policy review overdue: Remote Working Policy v3.2
Security awareness completion: 94% of staff, Q3 cycle
Powered by Praegis Enterprise
Thirteen graphs, one picture
The graph platform behind the Control Plane.
Praegis Enterprise is built on a federation of connected graphs rather than a separate database per module. That is what lets one view follow a supplier, the application it hosts, the personal data it handles, the controls that protect it and the audit that tested them.
No duplicate objects. One control, one risk, one evidence item, referenced everywhere it matters.
Evidence is reusable. Collect once. Reuse everywhere.
Graph 1 of 13
Knowledge Graph
The enterprise's memory. Policies, procedures, standards, controls, laws, guidance, evidence, training, lessons learned, incidents, assets, risks, suppliers, projects, business units and people. Every AI agent reasons from this graph.
Hover, tap or focus a node to trace its connection.
03 · Praegis Practitioner · Professional development
Build the knowledge. Develop the skills. Become a better GRC professional.
Praegis Practitioner is where you learn GRC by doing the work. GRC Foundations takes you through three domains, Governance, Risk Management and Compliance, each with theory, a scored quiz and a genuine deliverable. Missions is a separate track of case studies for people who already work in GRC. Everything you complete builds a record you can show an employer.
Tell us where you are today and see where to start.
Where to start
GRC Foundations
Start with GRC Foundations: three domains, Governance, Risk Management and Compliance, each with theory, a scored quiz and a genuine deliverable, with Abby beside you in every lesson.
THREE DOMAINS: GOVERNANCE, RISK MANAGEMENT, COMPLIANCEPractical activity
Each domain is built around case studies drawn from real organisational business challenges, so every deliverable reads like genuine work, not an exercise.
What you complete in each domain
- Theory
- A scored quiz
- A genuine deliverable that goes into your e-Portfolio
The three domains
Policy, ownership and accountability, learned through a company's own governance gaps.
Identify, score and register real risk scenarios, from vendor concentration to operational failure.
Regulatory mapping and obligation tracking across several regulations at once.
What is available at any time is shown on the Practitioner platform.
Who we work with
Different sectors carry different risks. Praegis starts with yours.
Select a sector to see the pressures we typically help with.
Typical challenges
- Customer trust depends on security and privacy that can be evidenced.
- Several overlapping obligations: data protection, payment security and customer due diligence.
- Fast product change that outpaces documentation.
How Praegis helps
We align ISO/IEC 27001, PCI DSS, SOC 2 readiness and data protection into one control set, so each new customer or regulator question draws on work you have already done.
Typical challenges
- Enterprise customers send security questionnaires and ask for independent assurance.
- Engineering speed versus control discipline.
- Growing interest in how AI is governed.
How Praegis helps
We help you build security and privacy foundations that scale with the product, prepare for ISO/IEC 27001 and SOC 2, and put AI governance in place.
Typical challenges
- Highly sensitive personal data with strict confidentiality expectations.
- Service continuity matters when systems are unavailable.
- Mixed legacy and modern systems.
How Praegis helps
We focus on data protection, access control, incident response and continuity planning that match how clinical and administrative teams actually work.
Typical challenges
- Client confidentiality is the product.
- Clients increasingly audit their advisers.
- Small teams with limited security capacity.
How Praegis helps
We provide proportionate security and privacy programmes, client-ready assurance and security leadership support without building a large internal function.
Typical challenges
- Accountability to the public and to oversight bodies.
- Records, data and procurement obligations.
- Capability gaps and uneven maturity across units.
How Praegis helps
We support governance frameworks, risk management, data protection and capability building, with clear documentation that stands up to review.
Typical challenges
- Informal practices that no longer fit the size of the business.
- Pressure from customers, partners and investors for formal assurance.
- Compliance effort scattered across teams.
How Praegis helps
We build the first working GRC programme, then scale it. Praegis Enterprise can later bring the whole picture into one operating environment.
Insights and resources
Practical perspectives on security, GRC and professional practice.
Plain-language guidance on security, data protection and governance. Open any article to read it in full.
GRC and Risk Management2 min read
Understanding the Difference Between Compliance and Security
They overlap, but meeting a requirement is not the same as being secure.
Data Protection3 min read
What Organisations Should Know About Nigeria’s Data Protection Framework
A plain-language starting point for organisations that process personal data in Nigeria.
ISO Management Systems3 min read
Preparing for ISO/IEC 27001 Certification
The stages organisations typically move through, and where readiness is usually won or lost.
AI Governance3 min read
Why AI Governance Is Becoming a Board-Level Responsibility
AI decisions carry legal, ethical and reputational consequences that boards cannot delegate away.
Regulatory Updates3 min read
How to Track Regulatory Change Without Drowning in It
A simple operating rhythm for keeping up with the rules that apply to you.
Cybersecurity Awareness3 min read
Moving Beyond Annual Security Awareness Training
Why a single yearly session rarely changes behaviour, and what tends to work better.
ISO Management Systems2 min read
Choosing the Right ISO Standards for Your Organisation
Not every standard suits every organisation. How to decide which are worth your effort.
GRC and Risk Management2 min read
What a Risk Register Is Actually For
A register is a decision tool. How to keep it useful.
About Praegis
Africa-born. Globally focused. Practical by design.
Praegis is an information security, GRC and professional development company. We believe effective security and compliance should be practical, connected and sustainable: owned by the people who do the work, not just written down for an audit.
Too many organisations treat security and compliance as a paper exercise, and too many capable people struggle to enter the field. Praegis addresses both: advisory that builds working programmes, technology that connects them, and learning that grows the people who run them.
What problem we solveFragmented security and compliance effort that is hard to evidence, hard to sustain and hard to explain to a board or an auditor.
Our approachUnderstand the business first, design proportionate controls, support implementation, then validate and improve.
Our commitmentTo build security and GRC capability in organisations and in individuals, without exaggerated claims.
Our visionOrganisations that can show they are trustworthy, and professionals equipped to make that possible, across Africa and beyond.
Contact and consultation
Let’s build a stronger security and GRC programme.
Tell us about your organisation and the challenge in front of you. We reply with an honest view of scope, effort and the order we would approach it in.
