1.1 Welcome: Your Digital Trust Toolkit (Start Here)

Digital trust is the confidence that customers, staff, suppliers, regulators and the board can place in an organisation’s systems, data and payments. Cybersecurity is how that trust is protected. For a manager, cyber risk is not a technical puzzle. It is the risk that money goes to the wrong account, that customer data leaks, or that the business stops because its systems are locked or down.

This course is part of the EunoiaData Professional Toolkits series. Its point of difference is that it explains cyber risk as business and payment risk, for managers who are not technical, built around the attacks that actually hit organisations in the region: fake supplier emails, SIM-swap and phone scams, ransomware at small sites and data exposed by careless set-ups. It teaches the decisions, questions and controls a manager owns, not technical configuration or attack methods.

What you leave with

Each module ends with a toolkit item, delivered as a table you can copy into Excel or Word and adapt:

Who this course is for

Managers, business owners, finance and HR heads, board members, and auditors who need a manager-level view of cyber risk. No technical background is assumed.

Frameworks used in this course

This course explains these frameworks in its own words. It uses their ideas; it does not reproduce their text.

• NIST Cybersecurity Framework (CSF) 2.0 (2024). Six functions, Govern, Identify, Protect, Detect, Respond and Recover, for organisations of every size. The modules follow them.
• ISO/IEC 27001:2022 (with Amendment 1:2024). The international standard for managing information security through leadership, risk assessment and continual improvement.
• CIS Critical Security Controls v8.1. A prioritised set of safeguards, grouped so that smaller organisations can start with an essential first group. The Lesson 3.4 self-assessment is written in our own words and does not reproduce the Controls.
• Country data protection laws. Breach notice duties for Zimbabwe, Zambia, South Africa, Botswana, Kenya and Nigeria are compared at principle level in Lesson 4.2.

Product names such as Microsoft 365, Google Workspace, WhatsApp and SAP are trademarks of their owners and are used for identification only; EunoiaData is not affiliated with or endorsed by any software vendor. Framework names belong to their issuing bodies; this course explains them in its own words and is not endorsed by them. The course does not prepare you for any certification exam.

The case company

About the case company: Kuvanya Group, its subsidiaries (Kuvanya Bank, KuvaTel, KuvaPay, Kuvanya Mining Supplies and Kuvanya Shared Services), its client “the Power Authority” and every person named in this course are fictional. They were created by EunoiaData for teaching purposes only. Any resemblance to real organisations or people is coincidental. Countries, laws and regulators are real and are described as they stood in 2026.

Kuvanya Group has a bank, a mobile network, a mobile-money business and a mining supplies business in six countries, all on one group ERP. You will meet Brian Otieno, the Group IT Manager, capable but stretched; Tendai Musarurwa, the Group CFO; Thandiwe Moyo, the Group Data Protection Officer; Wanjiru Kamau, who runs KuvaPay’s agent network; and Dr Adaeze Okafor, who chairs the audit and risk committee and wants one-page answers. Named people make mistakes, as people do. Attackers are never named characters: they are outsiders described only by what they do.

How the three views work

Each teaching lesson closes with three short points: as the auditor (what to check), as the manager (the decision or control you own) and as the board (the question to ask). Each module also gives a small-team version, for organisations with an IT manager, a provider and no security department.

Example: At her first meeting as committee chair, Dr Okafor asks Brian a plain question: “If our money went to the wrong account tonight, or our systems stopped, who would know first, and what would they do?” Brian can answer for the network. Nobody can answer for the payments. This course follows Kuvanya as it builds that answer, one tool at a time.

Three views

• As the auditor: start by agreeing which business outcomes cyber controls protect, before testing any technical setting.
• As the manager: treat cyber risk in your area as part of running it: payments, data and systems you depend on are yours to protect.
• As the board: ask how the organisation would know, tonight, that money, data or systems had been compromised.

Check before you act: Framework editions here are as at October 2026 and are expected to change. Confirm the current edition with the issuing body (NIST, ISO or the Center for Internet Security) before you rely on it.

Key takeaway

Digital trust is protected by managers’ decisions as much as by technology; this course gives you a tool for each stage, from knowing your crown jewels to governing the response.