Help Center

FortressSphere helps Nigerian and internationally-facing Micro to large enterprise understand where they stand on data protection and information security, and then close the gaps, without hiring a full-time compliance team or an expensive consultant for every question. You answer a guided set of questions about how your business handles personal data and manages information security. In return, you get an instant compliance score, a plain-language list of what to fix, and on paid plans the actual policy documents, ready to use. Who it's for: small, mid-sized and large businesses in Nigeria (and, for teams with UK operations or customers) and the UK who need to take data protection seriously because a regulator, an investor, a client, or a board is asking, or because it's the right thing to do and they don't know where to start. Frameworks covered: • NDPA 2023: Nigeria's Data Protection Act, and the GAID (its implementing directive) • The Cybercrimes Act (2015 & 2024 Amendment): Nigeria's cybersecurity-relevant obligations • UK GDPR & the Data Protection Act 2018: For businesses with UK operations, customers, or data subjects • ISO/IEC 27001:2022: The international information security management standard, for businesses pursuing security credibility or certification readiness • AI Governance: Covers how your business governs its use of AI and machine-learning systems, with your Nigerian legal baseline always included and the option to also score against UK GDPR, ISO/IEC 42001, the NIST AI Risk Management Framework, and the EU AI Act

1. Take the free Scorecard audit. Pick a framework, answer the guided questions, takes about 15 minutes for most businesses. No account or payment required. 2. See your results. Get your score, your section breakdown, and your full gap list immediately. 3. Get your documents. Ready to move past the scorecard? Purchase the Compliance Pack to generate your Privacy Policy, Data Register, and Breach Response Plan from your own answers. 4. Stay compliant, not just once-compliant. Subscribe to Ongoing Compliance for a live dashboard, a team workspace, and ongoing tracking as your business and the regulatory landscape changes. 5. Bring your whole team in. Invite teammates to your workspace once you are on the Ongoing Compliance plan, everyone sees the same shared picture of where your business stands.

Self-Audit A guided, plain-language self-audit for NDPA 2023 and the Cybercrimes Act, with no legal background required. Answer questions about how your business works, and get an instant overall compliance score, a section by section breakdown of where you are strong and where you are not, and a clear, prioritized list of gaps explained in plain language, not legal jargon. Compliance Document Generation Once you have completed the NDPA 2023 self-audit, generate the real paperwork built directly from your own answers, not a generic template: Privacy Policy, Data Processing Register, Breach Response Plan, and breach notification documents if you ever need to report an incident. Evidence Vault A secure place to store the documents that prove your compliance posture, signed data processing agreements, staff training records, vendor contracts, incident logs, and anything else you'd want on hand if a regulator or a client ever asked. FortressSphere tracks how fresh each piece of evidence is and reminds you before something goes stale. Vendor & Third-Party Assessment Your own compliance is only as strong as your vendors'. Assess a vendor yourself, or send them a secure link to complete their own assessment no account required on their end. Get a risk rating and a clear picture of where a vendor relationship needs attention. Staff Training Track compliance training across your team; assign standard topics or write your own, and see completion status at a glance. Built to scale with your headcount, not just your platform seats. Compliance Calendar A single place to see what's coming up: when your next re-audit is due for each framework, evidence that's about to go stale, and (for NDPA) the filing and reporting deadlines that carry regulatory weight clearly distinguished from FortressSphere's own best-practice reminders. For controls that have a review cycle set, control reviews appear on the calendar from 30 days before they fall due, and stay there while overdue; reviews due further out are listed on Controls Monitoring. Deadline Reminders FortressSphere emails the right person before something falls due: open gaps with a due date, Compliance Calendar deadlines, AI system reviews, and control reviews and expiring exceptions for every framework you monitor. Each person gets one email listing everything newly due for them, not a stream of separate alerts. If an item is still overdue a week after its due date and its first reminder, a follow-up goes to your company admins (or to you, on a solo account). Anyone can turn these emails off in Account Settings, under Communication Settings. Questionnaire Automation & AI Compliance Assistant Received a security or compliance questionnaire from a client or partner? Upload it, and FortressSphere extracts the individual questions and drafts answers grounded in your own evidence, flagging its own confidence honestly so you know exactly which answers need a closer look before you send it back. The same add-on also includes the AI Compliance Assistant: ask questions about your own compliance posture in plain language and get answers grounded in your actual uploaded evidence and audit history, not generic advice. It will also proactively flag something worth your attention (an upcoming deadline, evidence going stale) when you open it. Trust Page A public, shareable page showing your verified compliance posture; a modern alternative to emailing a PDF every time a prospect or partner asks "are you compliant?" Share the link, or embed a live status badge directly on your website or in your email signature. It can also show that your controls are actively monitored, for each framework you monitor. Implementation Guides & Roadmap Every framework comes with a structured methodology guide for closing your gaps, not just a list of what's wrong. On top of that, get a personalized roadmap built from your specific audit results, with your gaps consolidated into a clear, prioritized action plan. Controls Monitoring Every framework you use gets a control register: a Statement of Applicability for ISO 27001 and ISO 42001, and a control register for NDPA/GAID, UK GDPR, the Cybercrimes Act and the NIST AI RMF. Each control starts from your self-audit answers. Give it an owner, a review cycle and, where you accept a gap for now, a compensating control with an expiry date; every change is kept in the control's history, with who made it and when. The Controls Monitoring page compares your frameworks and shows each one's implementation rate, reviews overdue or due soon, exceptions expiring, and controls without an owner, with a summary card on your dashboard and each framework's implementation rate tracked on Compliance Trends. NDPA/GAID and the Cybercrimes Act are included on Compliance Pack and Ongoing Compliance; UK GDPR and ISO 27001 come with their add-ons, and ISO 42001 and the NIST AI RMF with the AI Governance add-on. AI Governance, ISO 42001 & NIST AI RMF With the AI Governance add-on: the AI Governance self-audit (NDPA section 37, the GAID, UK GDPR and the EU AI Act, scored against the parts you select), an AI System Register with a DPIA for each system, and separate self-audits for ISO/IEC 42001 (with its own Statement of Applicability) and the NIST AI Risk Management Framework (with its own control register).

Scorecard: Free See exactly where you stand, at no cost. Full self-audit for NDPA 2023, the GAID, or the Cybercrimes Act; instant score and section-by-section breakdown; plain-language gap list. Compliance Pack: one-time payment Get the paperwork done, once and properly, and unlock the working tools that go with it. Everything in Scorecard, plus: Privacy Policy, Data Register, and Breach Response Plan generated from your own audit answers (regenerate them whenever your answers change); a summary report suitable for a board or investor; Evidence Vault, Vendor & Third-Party Assessment, and personal Staff Training tracking; your personalized Implementation Roadmap; email reminders for your gaps' due dates; controls monitoring for NDPA/GAID and the Cybercrimes Act; your own branding on generated documents. Ongoing Compliance: monthly or annual subscription Stay compliant as your business grows, not just at one point in time. Everything in Compliance Pack, plus: re-run audits anytime and track your score over time; up to 3 team member seats, with a full staff training roster for your whole team; a live Compliance Calendar, Incident Response workflow, and evidence freshness alerts; deadline reminder emails, with a follow-up if something stays overdue; regulatory update tracking, in-app; a public Trust Page with shareable compliance badges. Enterprise: Contact Us For businesses that need more than the standard plan offers. Everything in Ongoing Compliance, plus: team access beyond 3 seats; bundled add-ons and terms tailored to your business; a dedicated point of contact. Add-ons (available on top of Compliance Pack or Ongoing Compliance, each billed monthly or annually): • Questionnaire Automation (includes the AI Compliance Assistant) • UK GDPR Framework Access (includes Controls Monitoring) • ISO 27001 Framework Access (includes the Statement of Applicability and Controls Monitoring) • AI Governance Framework Access (includes the ISO 42001 and NIST AI RMF self-audits, each with Controls Monitoring) Every generated document is built directly from your specific audit answers, not a generic template, a strong first draft for most SMEs. For complex situations (regulated industries, cross-border operations at scale), we recommend a review with FortressSphere's advisory team.