Operations technology, Accra
Bytepath designs, builds and operates software for organisations in Ghana and across West Africa - including esta, which runs an organisation's security compliance asa managed cloud service.
Real esta screens, from a demo tenant
Our product
esta runs an organisation's ISO 27001 management system - the scope, the risk register, the controls and the evidence behind them - as a managed cloud service that Bytepath hosts, secures and maintains.
esta runs the whole ISO/IEC 27001 management system: the scope, the risk register, the Statement of Applicability across all 93 Annex A controls, and the evidence behind each one. It maps the same evidence to Ghana’s Data Protection Act and Bank of Ghana directives at the same time, so one control answers to more than one obligation.
Currently in user acceptance testing.
01 Establish
Define the scope, record the risks against a stated methodology, and decide which of the 93 Annex A controls apply - each with a written justification. The Statement of Applicability is versioned and has to be approved by someone other than whoever prepared it.
93
Annex A controls, each decided and justified in writing.
Bytepath keeps every instance patched, monitored and backed up, so the security your ISMS depends on is kept in place rather than left to drift.
Enterprise: managed self-hosted
Risk register
Each risk is scored for likelihood and impact against the methodology you set, then given an owner and a treatment.
02 Evidence
Attach the document, record or link that shows a control is real, against the control itself. Evidence carries a validity period and is approved by a second person, so what counts is attested and current rather than merely uploaded.
Context and scope
Internal and external issues, interested parties and their requirements, and a scope statement that becomes a controlled document once it is approved.
03 Sustain
Internal audits, management reviews, corrective actions and continuity exercises run on the same record, so the management system produces the proof of its own operation that a certification body asks to see.
Your operation runs on a process that no product you can buy actually fits, so it runs on spreadsheets and people remembering.
Closing the month takes four days, and three of them are spent moving numbers between systems by hand.
You have logs nobody reads, a scan report nobody worked through, and a customer starting to ask for evidence.
The site was delivered, invoiced and never touched again - and nobody is certain who holds the domain.
If we cannot say what the problem costs you, we are guessing about the fix.
Often the answer is a configuration change, and we will tell you when it is.
We agree who operates a thing before we agree to build it.
Bytepath is small and recent. If you want to talk to someone who has run the kind of system you are asking about, email hello@bytepaths.io and ask.
Tell us which one, and roughly what it costs you in hours or cedis. We'll come back with either three questions or a proposed 30-minute call.
Book a scoping call