ISO 27001
ISO/IEC 27001
The international standard for an auditable information security management system.
Compliance
When something breaks,
the regulator's clock starts.
Modern cybersecurity rules do not ask whether you were attacked. They ask how fast you reported, contained and evidenced it. Pneuma gives you the evidence.
The threat picture
Attackers are already in the numbers.
Kenya shown as the illustrative example — the shape is the same across every regulated market. The attack surface is not theoretical. The losses are not hypothetical.
3.37bn
cyber-threat events detected in Kenya, Jan–Mar 2026
Communications Authority of Kenya
96%
were system attacks, mostly on critical infrastructure
Communications Authority of Kenya
KES 1.59B
stolen from Kenyan bank customers in 2024 — almost 4× 2023
Central Bank of Kenya via Business Daily
KES 29B+
lost to cybercrime in Kenya every year, at the least
Interior CS, April 2026
The clock, in hours
Your regulator already set the deadline.
Typical windows across financial-services and data-protection regulators. Exact numbers vary by jurisdiction — the shape is the same everywhere.
2 hrs
Central bank
Systemically-important payment systems — significant incidents must be reported.
24 hrs
Central bank
Other payment service providers — significant incidents.
72 hrs
Data regulator
Personal-data breach reported to the Commissioner.
30 days
Central bank
Notice before outsourcing, cloud included (payment providers).
Target frameworks
The four we lead with.
These come up on almost every engagement. If your regulator or customer requires something else — SOC 2, GDPR, DORA, PDPA — the same approach applies. Reach out and we'll scope it.
PCI-DSS
Payment Card Industry Data Security Standard
Mandatory controls for organisations that store, process or transmit cardholder data.
HIPAA
Health Insurance Portability & Accountability Act
US health-data protection rules that apply wherever protected health information is processed.
CIS
CIS Benchmarks
Consensus configuration baselines for Kubernetes, cloud accounts, Linux and container runtimes.
What regulators ask for
Every obligation, matched to platform evidence.
The law asks
The platform produces
Report incidents in hours
Incident timeline + response targets
Notify breaches in 72 hours
Affected servers, timeline, actions taken
Protect data by design
Controls on every release and server
Monitor and detect
Coverage map + live alerts
Keep a full audit trail
Audit log of every change via Pneuma
Oversee cloud and vendors
Benchmark checks on clusters and servers
One button for the auditor
From compliance profile to evidence pack in one click.
Inside the pack: what the profile requires, findings found and fixed with a CSV, findings past their deadline, accepted risks with reasons, and every change made through Pneuma plus approved manual ones.
- For groups of servers: PCI-DSS · CIS · STIG · your own
- Any period you choose
- A PDF ready for the auditor
Know your exposure before the regulator asks.
Book a free security and compliance assessment against the regulations and standards that apply to you.
Book an assessment →