Cybersecurity Services in Rwanda

What this covers

We think of security in four layers, and the services map onto them.

Knowing your exposure. A cybersecurity assessment is where most engagements start: a structured review of what you run, how it’s configured and where the realistic attack paths are. It produces a ranked list of fixes, not a scare report.

Protecting the network. Network security separates systems so one compromised device can’t reach everything else. Firewall configuration hardens the boundary with intrusion prevention, tight rules and useful logging. The routing-and-connectivity side of the same device is covered under IT infrastructure.

Protecting devices and identities. Endpoint security puts managed protection on every laptop, desktop and server. Identity and access management controls who can reach what, enforced by the system rather than trusted to memory. Microsoft Defender deploys and tunes the protection many organisations already own through Microsoft 365.

Keeping it working. Security policies give staff short, specific rules they can follow. Security monitoring watches for the signs that a firewall alone won’t catch.

The obligations Rwandan organisations should know about

Security isn’t only a technical decision here, because two sets of rules may already apply to you.

Data protection. Rwanda’s Law N° 058/2021 on the protection of personal data and privacy applies to any organisation processing personal data. Under it, data controllers and processors register with the National Cyber Security Authority (NCSA). If a breach occurs, a controller must notify the NCSA within 48 hours of becoming aware of it (Article 43). In practice, meeting a 48-hour deadline is impossible without logging, monitoring and an incident procedure already in place before the breach happens.

Financial sector rules. Banks, microfinance institutions and other institutions supervised by the National Bank of Rwanda fall under its Regulation No. 50/2022 on cyber security in regulated institutions. That regulation sets expectations for governance, risk management, technical controls and incident reporting. We align assessments and remediation plans with your obligations, and we work alongside your compliance team rather than replacing it.

We are not lawyers, and we don’t give legal opinions. What we do is make sure the technical controls exist to support whatever your legal or compliance advisers tell you the obligation is.

The gaps we find most often

Across assessments, the same handful of issues come up far more often than sophisticated attacks:

• Multi-factor authentication not enforced on email, so a single phished password opens everything.
• Shared administrator accounts with passwords that haven’t changed since the system was installed.
• Unpatched systems, especially servers and network devices that nobody owns.
• Flat networks, where the guest Wi-Fi can reach the finance server.
• Backups stored on the same network an attacker would encrypt.
• Former staff accounts still active months after the person left.

None of these needs an exotic product to fix. Most need someone to take ownership, change the configuration and check it stays changed.

What a realistic first year looks like

For a typical organisation of 20 to 100 staff with no dedicated security person, the first year usually runs in three stages.

The first month closes the quick, high-value gaps: multi-factor authentication on email, removing stale accounts, changing default passwords on network devices, and moving backups somewhere ransomware can’t reach.

The next three to six months handle the structural work: separating the network into zones, deploying managed endpoint protection everywhere, and writing the handful of policies that make the new controls stick.

The rest of the year is about visibility: centralising logs, setting up alerting that someone actually reads, and running a tabletop exercise so the incident procedure has been practised before it’s needed.

The order matters more than the speed. Each stage makes the next one cheaper and more effective.

How the engagement works

Assess. We review your current controls, systems, user accounts and any past incidents, including minor ones. The output is a prioritised list: what’s urgent, what’s important but can wait, and what’s low risk.

Design. Most organisations can’t fix everything in one project and shouldn’t try to. We plan remediation in phases you can budget for, starting with the changes that remove the most risk per franc spent.

Deploy. We implement the agreed controls in that order, testing each change so security improvements don’t break the systems people depend on.

Secure. Security runs through every step rather than being a separate phase. Each change is checked against the risk it was meant to close.

Support. Monitoring, periodic re-assessment and policy reviews keep pace with changes in your systems and in the threats aimed at them.

Who it’s for

Banks and MFIs operate under specific cybersecurity regulation and handle data attackers actively target.

NGOs and international organisations hold donor and beneficiary data, often across borders and in difficult connectivity conditions.

Schools, hospitals and clinics hold sensitive personal records and often run with minimal IT staff.

Hotels handle guest payment data and identity documents at the front desk.

Government agencies have compliance requirements and are frequent targets.

SMEs often assume they’re too small to be targeted. That isn’t how automated attacks work: they scan for weak configurations, not company size.

What we’ll need from you

• An honest picture of what you run: firewalls, antivirus or endpoint tools, and whether multi-factor authentication is enabled anywhere.
• Any past incidents, even minor ones such as a phished account or an infected laptop.
• A list of the systems that matter most, and the data they hold.
• A contact who can authorise changes to live systems, since some fixes touch things staff rely on daily.
• If you’re regulated, any findings from previous audits or regulator reviews.