Our product
esta
esta runs an organisation's ISO 27001 management system - the scope, the risk register, the controls and the evidence behind them - as a managed cloud service that Bytepath hosts, secures and maintains.
Real esta screens, from a demo tenant
The problem
Evidence collected by hand is stale the moment it is filed.
- Spreadsheets
- Email threads
- Screenshots taken the week before an audit
Compliance evidence in most West African financial and infrastructure organisations is collected by hand, and nobody can say which of it is still true.
The global compliance platforms are built around automated connectors to cloud services, which works well until the systems that matter are an on-premise core banking platform, local middleware, or self-hosted security tooling that no integration catalogue has ever heard of. esta is built around evidence a person attaches and a second person approves, so it covers the systems a connector cannot reach.
How it works
Three stages, one record
Establish
Define the scope, record the risks against a stated methodology, and decide which of the 93 Annex A controls apply - each with a written justification. The Statement of Applicability is versioned and has to be approved by someone other than whoever prepared it.
Evidence
Attach the document, record or link that shows a control is real, against the control itself. Evidence carries a validity period and is approved by a second person, so what counts is attested and current rather than merely uploaded.
Sustain
Internal audits, management reviews, corrective actions and continuity exercises run on the same record, so the management system produces the proof of its own operation that a certification body asks to see.
How it is delivered
Cloud-first, and run by us
A compliance platform is itself part of your security posture. Left unpatched, unmonitored or without tested backups, it becomes the weakest system in the scope it is meant to protect. So esta is a managed cloud service: Bytepath hosts every instance and keeps it patched, monitored and backed up.
Some organisations cannot place configuration, log or access-review data outside their own infrastructure - for a licensed institution that is often a regulatory line, not a preference. For them, esta is available as a managed self-hosted deployment: it runs in your environment, behind your own network controls, and Bytepath still operates and maintains it.
What it covers
One control set, three obligations
ISO/IEC 27001:2022
Clauses 4 to 10 and all 93 Annex A controls, with the Statement of Applicability, risk treatment plan, internal audit and management review the standard requires.
Ghana Data Protection Act, 2012 (Act 843)
Mapped onto the same control set, so a control implemented once is evidenced once and answers to both.
Bank of Ghana Cyber and Information Security Directive
Crosswalked alongside Annex A for regulated financial institutions.
The examiner pack: one export for the questions a regulator asks.
Integrity
Evidence you can defend
esta had automated collectors for AWS, Microsoft 365 and Okta. They returned passes they had not verified, so they were removed rather than shipped. Evidence in esta is attached by a person and approved by another one - slower than a green dashboard, and considerably harder to argue with.
Every piece of evidence carries who attached it, who approved it, and the period it is valid for. The same separation applies to the Statement of Applicability, to risk acceptance and to the continuity plan: whoever prepared a thing cannot be the one who authorises it. An auditor asking "who signed this off, and when" gets an answer from the record rather than from somebody's memory.
Currently in user acceptance testing.
It is being run end to end against a full ISO 27001 implementation - scope, risk register, Statement of Applicability, evidence, internal audit and management review - by testers working through the same task backlog a real organisation would. A pilot case study will follow once the environment it runs in can be described.
Run esta against your own scope
Tell us where your ISO 27001 programme stands and what your regulator expects of it. We'll come back with either three questions or a proposed 30-minute call.
Book a scoping call