Why this matters
Adverts from Ghanaian banks and audit firms mention ISO/IEC 27001, PCI DSS, the Bank of Ghana's Cyber and Information Security Directive, the CSA's CII Directive, NIST frameworks and MITRE ATT&CK. Senior roles ask for deep knowledge, but even juniors are expected to know what each one is for. Understanding them helps you see why your team does what it does.
The NIST Cybersecurity Framework 2.0
Published by the US National Institute of Standards and Technology and used worldwide, the CSF 2.0 organises security into six functions:
- Govern: set strategy, roles and policies.
- Identify: know your assets, risks and suppliers.
- Protect: controls such as access management, training and data security.
- Detect: find attacks and unusual activity.
- Respond: act on incidents.
- Recover: restore normal operations.
It is a useful map: every lesson in this track fits under one of these functions.
ISO/IEC 27001
An international standard for an information security management system (ISMS): a structured way for an organisation to manage security risks, set policies, apply controls and keep improving. Organisations can be audited and certified against it. Bank and fintech adverts in Ghana mention it often, and juniors frequently help collect evidence for audits.