Tier 01 · Evidence Readiness Assessment
Know exactly what evidence you are missing, in 5 working days.
Before a bank partner, investor or auditor asks, we map where you stand against SOC 2, ISO 27001, PCI DSS, NDPA 2023 or CBN AML/CFT, and hand you a gap list, owners and a 90-day plan to close it.
What you get
-
01
Kickoff and document request list
A 60-minute kickoff, then a list of the documents and proof we need, built from our control library.
-
02
Framework gap list tied to controls
For the frameworks you pick (SOC 2, ISO 27001, PCI DSS, NDPA 2023, CBN AML/CFT). Each gap names the control and the evidence that would close it.
-
03
Evidence plan with owners
Who in your team owns each item and what proof they need to produce.
-
04
90-day roadmap
The order to close the gaps in, with named owners and dates.
-
05
Short readiness report
A plain summary you can share with investors, a partner bank or your board.
-
06
30 days of email Q&A
Ask us anything about the findings for 30 days after delivery.
How the 5 days work
- Day 1: kickoff, scope and frameworks agreed, document request list sent.
- Days 2 to 4: short interviews with your control owners and a review of what you already have.
- Day 5: we walk you through the gap list, evidence plan, roadmap and readiness report.
- Then: 30 days of answers by email.
Price
Founding clients · first 5 only
₦3,500,000 fixed, or $2,450
50% to start (₦1,750,000), 50% on delivery.
Standard price
$4,900
Applies once the five founding places are taken.
What it is not
It is not a certification, an audit opinion or a regulator approval, and it does not guarantee you will pass an audit. It tells you where you stand and what to do next. Our control library is a draft until named reviewers sign it off, and the report says so.
Pay the deposit
₦1,750,000 to start (50% of the founding price). Prefer to talk first? Book a 20-minute call. Paying in dollars? Book a call and we will invoice you.
Questions
Who is the Evidence Readiness Assessment for?
Fintechs and other regulated technology companies in Africa that need to show security and compliance evidence to a bank partner, an investor, an auditor or a regulator, and want to know what is missing before that conversation.
Will this make us compliant or certified?
No. The assessment tells you where you stand and what to do next. It is not a certification, an audit opinion or a regulator approval, and it does not guarantee that you will pass an audit. Only an independent auditor or the relevant authority can give those.
How do you handle our documents?
StackWeaver's platform has not had its independent penetration test yet. Until it has, we do not upload your documents to it. We work in live sessions and from your own document stores, and you keep control of your files.
What do you need from us?
One person who can make decisions for the kickoff, access to the people who own security, engineering and compliance for short interviews, and the documents on the request list. We expect most teams to spend about 4 to 6 hours in total.
What does the gap list measure against?
Our control library maps SOC 2, ISO 27001, PCI DSS, NDPA 2023 and CBN AML/CFT to common controls. The library is still a draft until named qualified reviewers sign it off, and we say so in the report. The framework texts themselves are the authority.
How do we pay?
The founding-client price is ₦3,500,000 fixed or $2,450, for the first 5 clients only. You pay 50% to start and 50% on delivery. You can pay the naira deposit online by Paystack or by bank transfer below; for dollars, book a call and we will send an invoice.