1. Proposal to provide cybersecurity
services
Accra & Abidjan

2. Content
Background
Your requirements
Our Promise
About Afrik Santa Cruz
Our differentiating factors
Our key clients
Team experiences
Quality assured
Clear and continuous communication
Our team and affiliates
Contact details
Annexure I – Our methodology
Annexure II – Why you need cybersecurity
Annexure III – Service Catalogue

3.  Afrik Santa Cruz is an indigenous engineering
service company with affiliates in Africa, Americas
and Asia. It offers wide range of services in the
petroleum, housing and IT sectors.
 It is managed by highly experienced professionals
focused on tailored engineering solutions for
optimum customer satisfaction.
About us
 Highly practical and advanced hybrid delivery
model.
 Strong delivery capability to take on any complex
project as far as it is cybersecurity related.
 We prefer holding hands to shaking hands.
 Cybersecurity solution is our main focus.
Theory of change
 We are a true local company but with our global
reach, we offer a very high level practical
experience, know-how, contacts, and
confidentiality.
 Reasonably priced fees commensurate with high
quality delivery.
 Professional delivery as would be expected of a
large multinational.
Value proposition
 Our goal is to change the engineering landscape in
the Sub-Region by bringing, well-thought-out,
innovative and expert driven solutions to our
clients.
 ASC aims to be an emerging market leader in
engineering services. This is evident in its strategic
alliance with top firms like, Alphabet Energy
International and WaterFX, Tectonas Softsolutions
etc.
Mission
Background… know us better…

4. Your requirements
 You require a firm with not only demonstrable skills and experience in your sector,
but also the ability to deliver seamless information security system and business
support services that match your development plans;
 You also want a solution provider that operates on a professional and personal level
resulting in solutions tailored to your needs. While we operate in an environment
that demands honed technical ability and a degree of formality, arising from the
professional standards we observe, we regard ourselves as a flexible and responsive
team that has client relationships at its heart; and
 You need cybersecurity solution relevant for tomorrow's environment
 You want experts who know their trade/specialty and are sincere about projects that
do not fall within the bounds of their capabilities.

5. Our Promise
Our professionalism is demonstrated in our;
 Commitment; our management and staff are absolutely committed to client
satisfaction. We are dedicated to the provision of unique, quality and distinguished
client services. We do this by channeling our best resources to meet clients’ needs.
 Understanding; our approach to services is driven largely by our ability to obtain a
clear understanding of our clients’ specific needs. Our philosophy is to provide only
services beneficial to our clients.
 Support; our unique strength lies in drawing on a pool of specialists worldwide to
supplement skills unavailable at specific locations to ensure total client satisfaction.
 Efficiency; we provide services by riding on efficiency in a co-operative environment.

6. About Afrik Santa Cruz Ltd (ASC)
ASC is a Ghanaian company that provides expert services by localizing international engineering solutions…
To make life easier, it is a well-documented fact that humans are altering the usual ways of communicating
at all scales and unprecedented rate. For this reason, everyone is a major stakeholder in the cyberspace.
Enterprises rely on IT infrastructure to expand operations and enhance productivity. The increasing reliance
on IT systems brings about many challenges from sophisticated IT support system requirement to
increasing IT spending. To tackle these problems ASC adopts an innovative and no-nonsense engineering
centered approach to solving problems.
IT security can be defined as data breach/loss or reduced information system workflow that can adversely
affect the achievement of organisation’s objectives.
IT security issue can be both internally and externally generated. Unlike time past, security issues these days
are fueled by economic reasons. When greed overtakes need, it spells trouble. These can stem from corrupt
employees to shady investors seeking ways to exploit information systems for their advantage.

7. About Afrik Santa Cruz (cont…)
Increased dependence on IT will only enhance the risks of doing business. In today’s world, IT security
risks are not few. The reason companies so often fail to systematically manage these risks is rooted in the
way they define and manage them.
ASC has strong alliance with companies in the US and India to meet IT infrastructure problems. Together
with its affiliate partners, ASC has a team of more than 130 dedicated and highly trained systems
engineers who work on Kernel level modules, Mini Filter drivers, File Systems Drivers, Network drivers to
deliver easy to use and highly secure systems.
We are staffed with qualified professionals viz. BSc, CA, ACCA, CS, CISCO, CISSP, CISA, CRISC, and MSc etc.

8. About Afrik Santa Cruz (cont…)
Products & Services
Our product portfolio encompasses the following broad services;
Under the above broad services, we proffer more than 25 specific cyber security related services. These
explicit solutions are tailored suit clients’ environments.
Our comprehensive service catalogue which spells out service deliverables is available upon request
(Refer to appendix II for the abridged version).
• Secure Remote
Management
• Data Leak Protection
• Forensic and Security
• Patch Management
• Vulnerability assessment
• IT Infrastructure
Management
• Desktop Monitoring
• Asset Management
• Change Management
• Green Management
• Firewall
• IPS
• Anti-Virus
• Content Filtering
• Surveillance System
Management

9. Our Differentiating Factors
• Value for Money
• Strengths in relation to Business Model and Objectives – Track Record of Ethical Practice
• Unique combination of international, senior, hands on industry experience, across all areas of
requirement
• Building enduring relationships with all our clients as trusted business partner
• Strengths in relations to requirements – Track Record in geographical, Professional and Business
areas
• Adding value to client and protection their business is paramount
• Strength in relation to Implementation Plan – Track Record in geographical, Professional areas
Our highly analytical team will help:
• Protect applications implemented on your IT systems
• Protect your data or system’s ability to function
• Enable safe collection and usage of data
• Safeguard technology assets in use

10. Some of our Clients

11. Our Experiences

12. Quality Assurance
Quality control and quality management is of paramount importance
Our team is sufficiently resourced through our rigorous ethical values to develop and deliver quality
services to our clients. Criminal background checks are conducted on employees by the Criminal
Investigation Department of Ghana Police Service.
Personnel adhere to standards of Integrity, Independence, Confidentiality and Objectivity.
Our professionals are required to attend business specific continuing education courses, internal and
external industry trainings.
CONTINUOUS IMPROVEMENT
Quality
culture
Analysis
&
Planning
Our operating policies are based upon and are fully
compliant with International Standards.
In addition, there is a Quality Review Programme which
ensures that our review process is in compliance with
documented policies and procedures.
Quality performance reviews are an integral component
of our system of quality control.
Delivery
Measure
Results
HRM
Processes
Order

13. Clear Continuous Communication
We are well aware of your confidentiality requirements hence we are committed to maintaining strict
code of confidentiality.
Our firm policy requires that affairs of clients be confidentially kept at all times.
At ASC, open and honest communication is a Core Value. Our experience leaves us in no doubt that a
successful relationship is based on trust and candid, proactive communication.
Regular and open two-way communication is fundamental to all aspects of our services. As an initial
priority, we will agree with you the Communication Plan for all our key meetings. This will help ensure
there are formal and informal opportunities for all key stakeholders to be kept informed on issues of
importance.

14. Our Team Credentials
BradleyPate
International Director – Afrik Santa Cruz
 Accomplished Petroleum Engineer and a businessman.
 More than 33 years Project Management and Petroleum Engineering
 More than 25 international experience in every continent except Australia and Asia.
 Led Projects with budget exceeding US$700 million
JohnSelorm
Principal – Afrik Santa Cruz
 Accomplished Chartered Accountant.
 Strong IT background and worked with top accounting firms in the world on client systems.
 Worked with clients in a wide variety of industries including trading, retail and consumer goods, NGO,
manufacturing and banking and finance. Major clients include banks, investment companies,
manufacturing organizations etc

15. Our Team Credentials
CharlesKane
Chief Information Officer – Afrik Santa Cruz
 Highly experienced IT professional
 Over 13 years in IT resource management experience
 Managed Information System’s projects on oil fields in Ghana, Cote D’Ivoire, Sierra Leonne etc.
 Harvard college trained with diverse IT skills and professional qualification including; CISA, Red hat os/mail,
web, satellite operation and installation, Cisco CCNA etc.
PerryGreene
Principal Consultant – Santa Cruz Energy
 Highly accomplished IT security professional with experience across various industries in USA.
 More than 11 years information security and compliance experience
 Strong in vendor audits on ISO27001 and 27002 control and other compliance frameworks like COSO,
COBIT, NIST, ISO etc.
 Professional trainings include; six sigma, Cisco CCNA, CISSP, CISA, VMWare, Qualys, Archer, Qradar, CRISC,
MCP, Arcserv, SAP PCI HIPAA SOX etc.

16. Our Team Credentials
ShrutiPundalik
Chief Consultant – Santa Cruz Energy
 Accomplished IT security professional with experience in India and USA across various industries.
 Designed and implemented effective and efficient projects similar to Uber booking systems
 Conducted architecture and interface design on the admission system for University of Baltimore, Maryland
and other projects such as Bitcoin.
 Professional trainings include; Matlab, Keil Uvision, Verilog, Khazama, CodeVisionAVR, C++, C, PL/SQL, Eagle
5.6, Multisim etc.
ManaChuri
Chief Consultant – Santa Cruz Energy
 Highly experienced IT security specialist with experience in India and USA across many industries.
 Worked with Dell on security system projects including managing and mentoring different teams.
 Worked as an engineer at CISC Source responsible for remote on-site engineers etc.
 Professional skills include; Kerberos, SSL, IPSec, IDS, IPS, Firewalls, Application Proxy, Wireless Security,
Cisco CCNA, CCNP Routing & Switching, DHCP, DNS, Cisco CCNA, CCNP Routing & Switching, DHCP, DNS,
C++, C, Python etc.

17. Partners Credentials
JoachimNessere
Chief Consultant – Afrik Santa Cruz
 Highly skilled IT security trainer and consultant.
 Served as the IT security training consultant for GIMPA, IPMC, Zentech Ghana etc.
 Designed and implemented advanced server infrastructure across different systems
 Professional accreditations include: Novell Certified Linux Administrator , Net IQ Identity, security etc.
expert, MSPRP member, IAMCT Member etc.
RajeshTripathy
CEO/COO – Tectonas Softsolution
 Accomplished IT security engineer and a businessman.
 Established and run IT security company in India for the past 17 years
 Executed large IT security infrastructure solutions across Asia, Africa and the United States.
 Developed IT security software across key industries in India, Asia etc.

18. Contacts
Afrik Santa Cruz
2nd Fl00r Chataeu Dieu,
Adenta, Estate
Accra, Ghana
Phone: +233 208 703 344
john.selorm@afriksantacruz.com
Santa Cruz Energy
124 Dickens Dr
Coppell, Texas 75019-2104
United States
Phone: +128 170 019 139
Bradley.pate@santacruzenergy.com
Afrik Santa Cruz
Abidjan, Cote d’Ivoire
Phone: +255 045 728 04
Charles.kane@afriksantacruz.com
info@afriksantacruz.com
www.afriksantacruz.com
THANKS

19. ANNEXURE I – OUR METHODOLOGY

20. Our Methodology
Our methodology is comprehensive and systematic which focuses on meeting
clients’ organisational objectives. We fully recognise the need to provide
assurance on your system stability.
The key benefits of our approach are:
o Comprehensive & systematic;
o Focus on areas considered as potentially & most likely to lead to breach in
data or system malfunction;
o Our procedures are based on project planning techniques, including the use
of automated processes and document templates, and the agreement of
objectives, timetables, responsibilities and careful resource planning;
o The focus of our reports are to generate constructive and value added
advice; and
o Identifies performance improvement and cost reduction opportunities
Understanding
Your Business
Risk
Assessment
Planning
Field Work
Critical Issues
Reporting/
Implementation

21. Our Methodology (Cont..)
UNDERSTANDING THE BUSINESS
Our top-down risk-based approach ensures that the focus is on the issues that are of greatest importance
to you and that we are in the most appropriate position to respond to them. Our system audit starts with
a detailed understanding of your industry and business.
Our approach is based on a top-down examination of the key drivers and system workflow of your
business. The output is a balanced picture of how the company interacts with customers and external
industry forces. We consider the implications of this analysis and use it to identify significant risks.
We use industry specific business models to gain information on:
• industry background including major players, regulatory changes and trends,
• risks and drivers,
• geographic issues,
• descriptions of business processes,
• benchmarks and best practice and
• system risks.

22. Our Methodology (Cont..)
RISK ASSESSMENT
In order to run your business, you develop processes in IT systems to manage the factors that drive performance and
help meet your objectives. We focus on those processes and systems to help yield meaningful results. This phase of
our work enables us to obtain information on the processes supporting the achievement of the company’s goals.
STRATEGY AND PLANNING
Based on the understanding of a client’s business we devise a strategy. We then develop detailed programs to
improve and guard your systems.
FIELD WORK
The work flows from strategic planning and risk assessment. The key element is to review and test the high level
controls embedded in your processes, as significant weaknesses in your key processes could cost, both in terms of
data loss and reputational damage.
REPORTING AND IMPLEMENTATION
We identify and discuss all critical issues with management. We then determine whether the Company’s system
stability meet our expectations. We provide report and any other deliverables to management.

23. Our Methodology (Cont..)
Our focused IT audit methodologies and tools also help to evaluate and test whether the Company’s
information systems are configured for data integrity, are secure and are effectively managing the
business needs. Our highly skilled business and IT personnel help identify aspects of IT that pose the
highest risk to the Company.
We then conduct a systematic, detailed review of those areas in which we:
o identify appropriate IT control objectives that map to key business processes;
o identify relevant IT policies and procedures and/or industry IT standards; and
o evaluate the design of controls and test whether they are in place and operating effectively.

24. Our Methodology (Cont..)
METHODOLOGIES
• Continuity management
• System capabilities & availability
• Back and recovery
• Data storage
• Network penetration testing
• Information security assessment
• Enterprise security architecture &
integration
• Ongoing monitoring
• Process documentation
• Control risk analysis
• Control & design implementation
• Project risk assessment
• Quality assurance
• Project management methodology
• Programme management processes

25. Our Methodology (Cont..)
INTELLIGENT USE OF TECHNOLOGY
Technology is only one component of an integrated approach that combines methodology, knowledge and
technology into our tailored service to you. We deliver our system audit services using a fully automated
audit software. This software is designed specifically to integrate knowledge management into the audit
process. Technology can never be a substitute for face-to-face communications and we continue to rely on
meetings with management to identify, resolve and communicate issues.
Technology
Knowledge
Methodology

26. ANNEXURE II – WHY YOU NEED CYBERSECURITY

27. Why you need cybersecurity
In today’s global, digital world, data rule. Many of our daily activities involves data paths. Safeguarding
intellectual property, financial information, and your company’s reputation is a crucial part of business
strategy.
Cybercrime has become a big business. Cybercrime is costing the global economy up to $450 billion
annually and it is expected to exceed 1 Trillion by 2020 (Report by Hamilton Place Strategies).
The report also warns that “if you’re in business today, it’s nearly a guarantee you’ll be hacked at some
point over the next couple of years”, which makes these findings all the more significant.
The TRUTH IS, YOUR DATA HAS PROBABLY BEEN BREACHED WITHOUT YOUR KNOWLEDGE…you will only
be confronted with the consequences in the future.
IT security is about defense in depth. Providing such a security involves physical security as well as a well-
designed network, control over the users and processes on the host itself, and regular maintenance.

28. Why you need cybersecurity (Cont..)
Some cyber threats your organisation maybe exposed to without cybersecurity include:
Categories of Threat Examples
Deliberate software attacks Viruses, worms, macros, denial-of-service
Technical software failures or errors Bugs, code problems, unknown loopholes
Technological obsolescence Antiquated or outdated technologies
Deliberate acts of information extortion Blackmail of information disclosure
Deliberate acts of espionage or trespass Unauthorised access or data collection
Compromises of intellectual property Piracy, copyright infringement
Acts of human error or failure Accidents, employee mistakes
Forces of nature Fire, flood, earthquake, lightning
Deliberate acts of sabotage Destruction of system or information
Deliberate acts of theft Illegal confiscation of equipment or information

29. Why you need cybersecurity (Cont..)
Some attack replication vectors your organisation maybe exposed to without cybersecurity include:
Vector Description
Web browsing If an infected system has write access to any web page, it makes all web content files
(.html, .asp, .cgi, etc.) infectious, so that users who browse to those pages become
infected.
Simple Network
Management Protocol
Attacking program gaining control of a device due to widely known and common
password employed in early version of protocols.
Virus Infection through common executable files through virus code
Mass mail If an infected email runs through an address book, infected machine infects many
users. Subsequently, mail-reading programs also automatically run the program and
infect other systems.
Unprotected shares Using vulnerabilities in file systems and the way organisations share configure them,
the infected machine copies the viral component to all locations it can reach
IP scan and attack The infected system scans random or local range of IP addresses and targets any of
several vulnerabilities known to hacker from previous exploits such as Code Red,
Back Orifice, or PoizonBox.

30. ANNEXURE III – OUR SERVICE CATALOGUE

31. Service Description When to be Proposed to
Customer/Client
Activity
Incident Tracking and Audit Customer has had a major cyber-security
incident where they may have had data
loss, data corruption or systems not
being available to the
users/customers/partners
Investigate incident and provide
Survey Reports for; affected
users and systems
Cyber Security Audit
Customer wants to implement Cyber
Security Policy as per their defined
Policies in the organization.
Survey of;
• End Points (PCs),
• Servers
• Network Equipment
• BOYD Patterns
• Shadow IT
• User Behaviour
Service catalogue

32. Service Description When to be Proposed to
Customer/Client
Activity
Cyber Security Policy Rollout Customer wants to implement Cyber
Security Policy as per their defined Policies
in the organization.
• IT Systems Survey
• End User Training
• Delivery of Audit Systems
Cyber Security Policy Creation
Customer has no Cyber Security Policy and
wants to start new.
• Detailed Survey of IT Systems
• Identify IT & User Control Points
• Identify Compliance Check
Points
Forensic Audit Customer has no idea of their current
Cyber Security Posture or if they are
compromised or not compromised.
• Log Analysis
• ID Presence of internal/external
malicious agents
• Forensic analysis to assess if IT
systems are compromised or IT
system availability analysis
Service catalogue (Cont…)

33. Service Description When to be Proposed to
Customer/Client
Activity
Cyber Defence Integration Customer has many cyber defense
systems like anti-virus, firewalls etc. And,
these systems are not working in an
integrated manner.
• Integrate disparate systems to single
Dashboard
• Identify Cyber Security Chock Points.
Firewall Induction.
Client does not have a firewall and wants
to implement a firewall.
• Identify make and model of Firewall that best
suits the Clients needs. Acquire, install and
commission the firewall.
Firewall Review and
Configuration
Client has an existing firewall and has
performance and security issues.
• Capacity/Performance of the firewall.
• Check firewall addresses i.e. security +
performance needs of the client.
• Upgrade, changes and recommission the
firewall.
Service catalogue (Cont…)

34. Service Description When to be Proposed to
Customer/Client
Activity
Intrusion Prevention
System (IPS) Induction.
Client does not have a IPS and wants to
implement a IPS.
• Identify make and model of IPS that best
suits the Clients needs. Acquire, install and
commission the IPS.
IPS Review and
Configuration.
Client has an existing IPS and has
performance and security issues.
• Identify make and model of Firewall that best
suits the Clients needs. Acquire, install and
commission the firewall.
Firewall Review and
Configuration
Client has an existing firewall and has
performance and security issues.
• Do a capacity + performance of the IPS, and
check whether the same IPS addresses the
security + performance needs of the client. If
yes, identify changes to IPS configuration.
Upgrade the changes and recommission the
IPS.
Service catalogue (Cont…)

35. Service Description When to be Proposed to
Customer/Client
Activity
Patch Management
Induction.
Client does not have a Patch
Management and wants to implement a
Patch Management.
• Identify make and model of Patch
Management that best suits the Clients
needs. Acquire, install and commission the
Patch Management.
Patch Management
Review and Configuration.
Client has an existing Patch Management
and has performance and security issues.
• Do a capacity + performance of the Patch
Management, and check whether the same
Patch Management addresses the security +
performance needs of the client. If yes,
identify changes to Patch Management
configuration. Upgrade the changes and
recommission the Patch Management.
Proxy Induction. Client does not have a Proxy and wants
to implement a Proxy.
• Identify make and model of Proxy that best
suits the Clients needs. Acquire, install and
commission the Proxy.
Service catalogue (Cont…)

36. Service Description When to be Proposed to
Customer/Client
Activity
Proxy Review and
Configuration
Client has an existing Proxy and has
performance and security issues.
• Do a capacity + performance of the Proxy,
and check whether the same Proxy addresses
the security + performance needs of the
client. If yes, identify changes to Proxy
configuration. Upgrade the changes and
recommission the Proxy.
Singly Sign-on (SSO)
Induction.
Client does not have a SSO and wants to
implement a SSO.
• Identify make and model of SSO that best
suits the Clients needs. Acquire, install and
commission the SSO.
SSO Review and
Configuration.
Client has an existing SSO and has
performance and security issues.
• Do a capacity + performance of the SSO, and
check whether the same SSO addresses the
security + performance needs of the client. If
yes, identify changes to SSO configuration.
Upgrade the changes and recommission the
SSO.
Service catalogue (Cont…)

37. Service Description When to be Proposed to
Customer/Client
Activity
Anti-Virus Induction. Client does not have a Anti-Virus and
wants to implement a Anti-Virus.
• Identify make and model of Anti-Virus that
best suits the Clients needs. Acquire, install
and commission the Anti-Virus.
Anti-Virus Review and
Configuration
Client has an existing Anti-Virus and has
performance and security issues.
• Do a capacity + performance of the Anti-
Virus, and check whether the same Anti-Virus
addresses the security + performance needs
of the client. If yes, identify changes to Anti-
Virus configuration. Upgrade the changes
and recommission the Anti-Virus.
Data Loss Prevention
(DLP) Induction.
Client does not have a DLP and wants to
implement a DLP.
• Identify make and model of DLP that best
suits the Clients needs. Acquire, install and
commission the DLP.
Service catalogue (Cont…)

38. Service Description When to be Proposed to
Customer/Client
Activity
Data Loss Prevention
(DLP) Review and
Configuration
Client has an existing DLP and has
performance and security issues.
• Do a capacity + performance of the DLP, and
check whether the same DLP addresses the
security + performance needs of the client. If
yes, identify changes to DLP configuration.
Upgrade the changes and recommission the
DLP.
Threat Intelligence
System.
Client has existing Security Policy and
Audit Framework and wants pro-active
Cyber Security Threat Information.
• Security Posture Study of the Organization
and Business Vertical.
• Complete capability assessment of Key Cyber
Security Team.
Ransomware Mitigation Client perceives that they can be
targeted or other peer organizations of
the client have been targeted using
Ransomware.
• IT Systems Survey
• User IT usage profile
• User Critical Data/Process Survey
Service catalogue (Cont…)

39. Service Description When to be Proposed to
Customer/Client
Activity
Vulnerability Assessment
and Penetration Testing
Client wants to have a regular
Vulnerability Assessment and Penetration
Testing done of their IT Infra-structure..
• IT Systems Survey.
• Network Survey
Service catalogue (Cont…)
Thanks