Authorised only
Nothing begins until you sign a Letter of Authorization. Every test is scoped to your assets, in writing, and nothing outside scope is ever touched.
Cybersecurity Assessment & CTEM
Know your exposure, meet your POTRAZ obligations, and close every gap — safely, confidentially, and with the paperwork done right from day one.
Overview
What it is
Under Zimbabwe's Cyber and Data Protection Act, POTRAZ expects data controllers to register, run data-protection impact assessments, appoint a Data Protection Officer, and report breaches — and to be able to prove the controls behind each one.
We assess your people, systems and data against the Act and against the way attackers actually work, then turn the findings into a Continuous Threat Exposure Management (CTEM) programme that keeps you ahead — not just compliant for a season.
If the idea of being "tested" makes you nervous, that's exactly the right instinct to have — and exactly why we do this carefully. Nothing is ever tested without your written authorisation. Nothing is shared without an NDA. And nothing is left as a scary report with no next step.
Our commitments
How we keep you safe
A security assessment should reduce your stress, not add to it. These six commitments are non-negotiable on every engagement.
Confidential by default
An NDA is in place before a single detail is shared. Your findings live on encrypted systems and never leave without your say-so.
No disruption
We test in agreed windows, never run destructive or denial-of-service tests, and pause the moment you ask us to.
You own the report
The findings are yours — to show POTRAZ, your board, or your insurer. We never hold you hostage with the results.
No judgment
A vulnerability found is a vulnerability closed. We treat findings as a map to a stronger position, never as a verdict on your team.
Lawful & aligned
We work to the Cyber and Data Protection Act and international standards, so your compliance holds up under scrutiny.
What's included
Everything you get
- Gap assessment vs the Cyber and Data Protection Act
- Data Protection Impact Assessments (DPIA)
- POTRAZ data-controller registration support
- Penetration testing & vulnerability scanning
- Security hardening & remediation support
- CTEM programme (scope, discover, validate, mobilise)
- Data Protection Officer (DPO) support
- Breach notification & incident support
- Rules of Engagement, NDA & authorisation paperwork
- Board-level and executive reporting
Supporting Documents
Download the drafts, review them, and send us any questions. Every one of these is designed to protect you before, during, and after the engagement.
Rules of Engagement
How the testing is conducted — scope, boundaries, prohibited actions, windows, and emergency procedure.
Download PDF ↓Mutual Non-Disclosure Agreement
Keeps every detail confidential in both directions — before a single fact is shared.
Download PDF ↓Letter of Authorization
The formal, written permission to test — proof the assessment is authorised and lawful.
Download PDF ↓Data Processing Agreement
Governs any personal data we handle during the work, in line with the Cyber and Data Protection Act.
Download PDF ↓Master Services Agreement
The umbrella terms for the engagement — fees, responsibilities, IP, and liability.
Download PDF ↓Client Onboarding Checklist
A step-by-step run of everything we complete together before testing begins.
Download PDF ↓
Packages
Six ways to start
Every project is built from scratch. Pick the closest fit, or contact us for a quote that matches the job exactly.
Testing
Vulnerability Scan
$150 from
A fast, clear look at the obvious holes an attacker would probe first.
- Automated + manual scanning
- External + internal scope
- Severity-rated findings
- Prioritised remediation list
- 30-day re-scan
Compliance
Compliance Essentials
$200 from
A gap assessment against the Act, with a roadmap you can show POTRAZ.
- Gap assessment vs the Act
- Risk rating & priorities
- Remediation roadmap
- POTRAZ-ready report
- Follow-up call
Most popular
Compliance
Compliance Pack
300 from
DPIA, POTRAZ registration support and a first-pass CTEM baseline.
- Data Protection Impact Assessment
- POTRAZ registration support
- DPO guidance
- Breach-notification procedure
- CTEM baseline (discover + validate)
- Executive report
Testing
Penetration Test
$400 from
A full authorised penetration test, with hands-on remediation.
- Full penetration test
- Web + network + API
- Exploit validation
- Remediation support
- Retest after fixes
- Executive summary
Continuous
CTEM Programme
Quote on request
A continuous threat-exposure programme that keeps you ahead, all year.
- Continuous CTEM cycles
- Quarterly exposure reporting
- Attack-surface monitoring
- Board-level reporting
- Incident-response support
- SLA support
Managed
DPO & Managed Compliance
Quote monthly
Your Data Protection Officer and compliance programme, handled for you.
- DPO-as-a-service
- Annual DPIA refresh
- Regulator liaison
- Breach response
- Staff awareness training
- Policy & controls upkeep
All prices in USD. Every package includes the onboarding paperwork. Custom features and retainer terms can be requested at any tier.
Before you ask
Questions you're probably holding
Is this going to take my systems down?
No. We test in agreed windows, avoid production hours where it matters, and never run destructive or denial-of-service tests. If we ever suspect a test could cause instability, we stop and talk to you first.
What if you find something bad?
That's the point — and it's good news, because you found out from us, in private, before someone else found out and used it. Every finding comes with a fix and a priority, not just a problem.
Is any of this shared outside?
Not without your written consent. An NDA is signed before we start, and your report is yours. We don't name you, your findings, or your systems anywhere without permission.
Am I legally protected while you test?
Yes. The Letter of Authorization you sign is the written proof that the testing is authorised — and it indemnifies our work done within scope. We won't begin without it.
Do I really need this if I'm already "compliant"?
Compliance proves you had the right paperwork; an assessment proves your controls actually hold. POTRAZ expects both, and a breach that happens despite a ticked box is far more painful than one you caught early.
How long does it take?
A gap assessment can be days; a full penetration test typically takes one to three weeks depending on scope. We'll give you a clear timeline before anything starts, and we'll keep to it.
Get in touch
Ready to secure your systems?
Contact us for world class services that address modern threats.
Get in Touch →