Cybersecurity Assessment in Rwanda
A structured review of what you're running and where the real risk sits.
A cybersecurity assessment is a structured, independent review that tells you where your real security exposure sits and what to fix first. Any organisation without a recent review, or one that suspects gaps but can’t say where, needs it before spending more on security products. This page covers the security-specific review. For a broader look at your network and systems, including performance, capacity and design, see the IT infrastructure assessment under IT Consultancy.
What is a cybersecurity assessment, and who needs it
It’s a review of your network, devices, identities, email, cloud services, backups and policies, judged against how attacks actually succeed. The output is a risk-ranked report and a prioritised plan. It suits organisations that have never had an independent review, those preparing for an audit or a regulator’s visit, and those that have just had an incident and want to know what else is exposed. It’s also the first step of most of our cybersecurity work.
The problem it solves
Security spending without an assessment tends to go to whatever is easiest to buy or best marketed, rather than to what is most at risk. In practice, the biggest risks are usually basic: multi-factor authentication not enforced, unpatched servers, shared administrator passwords, backups an attacker could reach. An assessment redirects money and effort to those gaps first, and gives you evidence to show a board, donor or regulator that risk is being managed deliberately.
The frameworks we assess against
We don’t invent our own checklist. Assessments are structured around two widely used, freely available frameworks.
The CIS Critical Security Controls (version 8.1) set out 18 controls, grouped so that smaller organisations start with the safeguards known as essential cyber hygiene: an inventory of devices and software, secure configuration, account and access management, and data recovery.
The NIST Cybersecurity Framework 2.0, published in 2024, organises security into outcomes. Its new Govern function covers strategy, roles and oversight, which is useful when reporting to a board.
For regulated institutions, findings are also mapped to the National Bank of Rwanda’s cybersecurity regulation, and for personal data, to Rwanda’s data protection law.
What the work involves
- Scoping. We agree which sites, systems, cloud services and sensitive data are in scope, and what testing you permit.
- Interviews. Short conversations with management, finance and whoever runs IT, about how things really work.
- Technical review. Firewall and network configuration, endpoint protection coverage, patch levels, user and administrator accounts, Microsoft 365 or other cloud settings, email security and backups.
- Safe testing. Confirming that a finding is actually exploitable where that can be done without risk to live systems.
- Risk ranking. Each finding is scored by likelihood and impact, and given a recommended fix and rough effort.
- Report and walkthrough. We present the findings and agree priorities with you.
What’s included and what’s not
Included: the full review, a written report with risk ranking, and a prioritised recommendation list.
Not included unless separately scoped: active penetration testing (simulated attacks against live systems, which carries its own risk and requires explicit agreement) and remediation of findings (available separately once priorities are agreed).
Typical timelines and what drives cost
A single-office assessment typically takes three to five working days. Cost depends on organisation size, the number of sites, systems and cloud services in scope, and depth: a focused technical review costs less than a full audit that also examines policies, processes and supplier access.
Tools typically used
Configuration reviews of firewalls, switches and Microsoft 365 or Google Workspace settings; authenticated vulnerability scanning of servers and workstations, run at agreed times; checks of external exposure, meaning what your organisation looks like from the internet; reviews of user and administrator accounts against your staff list; and a test restore from backup. Tools are chosen to be safe on live systems. The report records exactly what was tested and what wasn’t, so its limits are clear.
Common mistakes we see
Spending on the most visible security product rather than the highest-risk gap. Treating an assessment from years ago as still current despite new systems, staff and threats. Filing the report without a remediation plan, so known risks stay open. And scoping the assessment to the office network only, while email and cloud services, where most attacks now start, go unexamined.
.tROgf8a5_1dqydg.webp)
Cybersecurity
Related services
-
Network Security
Segmentation, monitoring and controls that stop a single compromised device becoming a network-wide breach.
-
Firewall Configuration
Firewall rules and policies built around your traffic, not a vendor default left running for years.
-
Endpoint Security
Protection on every laptop, desktop and server endpoint, managed centrally rather than device by device.
Insights
Related reading
-
.axBI9cHA_Z1CMqlS.webp)
, 4 min read
Cybersecurity Assessment: How Long It Actually Takes
A cybersecurity assessment's timeline depends on organisation size and depth — here's a realistic breakdown of what to expect.
-
, 4 min read
How Much Does a Cybersecurity Assessment Cost in Rwanda?
A cybersecurity assessment's cost depends on organisation size and assessment depth — here's what actually drives the number.
Frequently asked questions
What does a cybersecurity assessment actually involve?
A structured review of your network, devices, user accounts, email, cloud services, backups and existing security controls, checked against the ways attackers actually get in. Findings are confirmed where it's safe to do so, then ranked by real risk. You receive a written report with a prioritised fix list, rather than a raw scanner output listing every theoretical issue.
How long does an assessment take?
A single-office assessment typically takes three to five working days, covering interviews, technical review, safe testing and the written report. Larger or multi-site organisations take longer, depending mainly on the number of sites, systems and cloud services in scope. We agree the scope and timeline in writing before starting, so there are no surprises midway.
Will the assessment disrupt our systems or operations?
No. The assessment is mostly configuration review and observation, plus carefully limited testing agreed in advance. It isn't active penetration testing, which simulates real attacks and carries some risk to live systems. If you want penetration testing as well, we scope it separately, agree timing and limits with you, and run it in a controlled window.
What happens after the assessment — do you just hand over a report?
You get the report and a walkthrough of the findings with your management and technical leads. Many organisations then move straight into fixing the priority items with us. Others use the report to brief their own team, set a budget or instruct a different provider, and we're comfortable with that. The report is written so anyone competent can act on it.
Is this different from an IT infrastructure assessment under IT Consultancy?
Yes. An infrastructure assessment looks at your network and systems broadly: performance, capacity, age and design. A cybersecurity assessment looks specifically at security controls and how an attacker could get in and move around. They answer different questions, and organisations planning a major IT investment often benefit from both, ideally run together to save time.
How often should we repeat an assessment?
At least once a year, and after any significant change: a new office, a major system going live, a move to the cloud, a restructuring that changes who has access to what, or a security incident. Your exposure changes as your environment and the threats aimed at it change, so last year's report gradually stops describing your real risk.
Not sure where your real exposure is?
Start with an assessment. We’ll show you which gaps matter most before you spend on anything.