ISO/IEC 27001
We map controls to Annex A and keep Compliance Manager evidence current, so a surveillance audit is a scheduled review, not a fire drill.
Find out moreCompliance
Built around Kenyan law, not adapted to it
The Data Protection Act 2019 and ODPC breach rules aren't generic checkboxes. We build Microsoft controls around them from day one.
Data Protection Act 2019
The 72-hour clock starts when we configure it to
Breach notification to the Office of the Data Protection Commissioner is due within 72 hours of your organisation becoming aware of it. That clock doesn't wait for someone to notice a phishing email in a shared inbox.
We configure Microsoft Purview and Microsoft Sentinel so the 72-hour clock starts the moment a qualifying incident is detected, not when someone remembers to check. Sentinel analytics rules classify severity; Purview audit logs and eDiscovery build the evidence trail an ODPC notification needs.
Before you process anything high-risk, a new HR system, a customer database migration, a Copilot rollout, we run a Data Protection Impact Assessment to flag what could go wrong and configure controls before go-live, not after a complaint.
Data subject rights, access, correction, deletion, objection, get built into Purview Content Search, so a subject access request is a query your team can run, not a six-week search through email archives.
72 hoursto notify the ODPC
Frameworks
One control set, evidenced against whichever standard you're held to
Kenyan statute isn't the only bar you're held to. We map the same Microsoft configuration to the frameworks your board, auditors or funders already recognise.
NIST Cybersecurity Framework
We assess maturity across Identify, Protect, Detect, Respond and Recover, then use the gaps to prioritise what we build next.
Find out moreMicrosoft Compliance Baselines
Compliance Manager scores your tenant against Microsoft's own regulatory templates, so licence configuration and framework evidence come from the same source.
Find out moreMost breaches don't start with a sophisticated exploit. They start with a gap someone assumed didn't matter.
Ready for your DPA readiness check?
See where your Microsoft tenant stands against the Data Protection Act 2019, and what to configure first.