BCEAO Maturity · Information systems security and IS risk management
Your IS security practices positioned against the BCEAO directive, translated into a costed action plan.
10 themes, a 5-level scale. And the action that moves each level to the next.
The framework’s 10 themes, already written from L1 to L5. One company, one business unit, or 300 at once.
BCEAO Maturity · Information systems security and IS risk management
10 themes, 5-level scale.
Nordhavn Industries
53 / 100
They measure their maturity with Datamensio
An example
This could be your situation.
Take one company as an example: three sites, three spreadsheets, no shared answer.
Nobody can consolidate.
Nordhavn Industries, 2,400 people in Hamburg, Lyon and Porto. A client asks where the group stands. Each site answers in its own spreadsheet, with its own scales.
Three weeks, a single base.
One BCEAO Directive on the management of information systems risks for credit institutions, financial companies and decentralised financial systems of the WAMU assessment launched across all three sites at once, from the managers’ interview notes. The framework was already written, its 10 themes and levels L1 to L5 too.
Two costs avoided before being committed.
A score of 53 out of 100, with the gap concentrated on three themes. The AI companion spotted that two actions duplicated those of another audit. The committee report took one sentence to request.
What it saved them
- 3sites measured on the same base, instead of three questionnaires to reconcile
- 2duplicate actions caught before the spend
- 1committee report, with no manual rework
These figures are an example. They could be yours.
The standard imposes processes. Datamensio says where you stand.
01
The framework is already written
Themes, questions and levels L1 to L5, all written. You do not start from an empty spreadsheet.
02
The score lands the same day
Online, by self-assessment link or in interview. Theme by theme, comparable over time.
03
The gap becomes a costed plan
Every step up carries its action. The AI prioritises on expected effect, not on the order of the standard.
04
Progress can be demonstrated
Campaign after campaign, against your target and against your own past. That is what your board asks for.
The maturity scale
One level, the next, and the action that links the two.
It is this mechanism (a level, the level above, and the action connecting the two) that turns a finding into a trajectory.
Are access rights to sensitive applications subject to periodic review?
- N1
No organised review. Rights are granted when the account is opened and never re-examined afterwards.
- N2
Reviews happen during an audit or a reorganisation, on a handful of applications, with no schedule or defined format.
- N3
A periodic review is scheduled and covers sensitive applications. Owners validate the rights and gaps are corrected.
- N4
The review is systematic across the entire scope, tracked, with follow-up on revocations until they are executed and second-level control.
- N5
Reviews are tool-supported and fed by staff movements, recurring gaps are analysed and corrected at source, and assignment rules are revised accordingly.
Action to move from L2 to L3
Draw up the list of sensitive applications with their business owner, set a six-monthly access rights review on the permanent control calendar, and require named validation of rights alongside a deadline for removing unjustified access.
« With Datamensio, we meet our objectives far more efficiently. The ERDF inspection services and our supervising ministry particularly appreciated an approach that gives them reliable data. »
Director, CCI 94CCI Île-de-France
« We believe this is the most suitable solution to scale our transformation project and measure impact according to our needs. »
Maja SucekChief Operating Officer, Interreg Danube
Rarely on its own
Frameworks combine. Put several together to cover your business, or have the AI write yours.
Take your first measurementon BCEAO.
What this framework covers
The BCEAO directive on the management of information systems risks applies to credit institutions, financial companies and decentralised financial systems of the West African Monetary Union. It requires an IS governance framework approved by the governing body, an information security policy, a mapping of IT assets and risks, a security function identified and independent from operational teams, control over IT service providers, incident management with notification to the supervisor, and IT business continuity. Compliance with these requirements is monitored by the WAMU Banking Commission.
In practice, the setup is difficult to steer because it cuts across several departments. A security policy usually exists, but its translation into applicable procedures and verifiable controls remains partial. The practical questions keep coming up: does the mapping of IT assets cover business applications hosted by third parties, or only the internal data centre? Are access rights reviewed on a fixed schedule, or only when an employee leaves? Are security incidents classified against written criteria that support a notification decision, or handled as ordinary operational incidents?
The growth of digital financial services across the Union has shifted where the risk actually sits. Electronic money, payment interoperability and the growing reliance on regional or international service providers expose institutions whose IT organisation was sized for a branch network model. One common confusion is worth clearing up: the directive is not limited to technical security. It covers IT risk governance, of which security is only one component, alongside change management, outsourcing and continuity.
The maturity assessment answers a different question from a compliance check. A compliance check asks whether a requirement is met, yes or no, and ends with a finding. The assessment places each practice on a progressive scale and identifies the precise action that moves it up a level. The two are complementary: the assessment prepares for the Banking Commission’s mission and the internal control review, it does not replace them.
Within Datamensio, the framework is ready to use and deploys as is across several entities. You can also adapt it: the AI adjusts the themes, rephrases the questions to fit your organisation, refines the levels, or builds a variant from your existing security policy and procedures.
Reference standard: BCEAO Directive on the management of information systems risks for credit institutions, financial companies and decentralised financial systems of the WAMU
The themes assessed
Information systems governance
Framework approved by the governing body, IT strategy aligned with the institution’s strategy, dedicated committee, roles and responsibilities, allocated resources.
Information security policy
Formalised and validated policy, translation into procedures, scope covered, review frequency, distribution to business lines.
IS asset mapping and risk assessment
Inventory of information and application assets, classification, identification of vulnerabilities, assessment method, prioritisation and acceptance of residual risks.
Identity and access management
Granting and revoking rights, privileged accounts, segregation of duties, periodic review of access rights, access traceability.
Operations and network security
Configuration hardening, patch management, segmentation, protection of workstations and servers, tested backups and restores, logging.
IT change and project management
Production release procedure, separate environments, testing and acceptance, security considered from the design stage, version control and rollback management.
Outsourcing and IT service providers
Register of outsourced services, security and audit clauses, service levels, reversibility, monitoring of critical providers and hosting.
Security incident management
Detection, classification and grading of incidents, notification timeframes and channels to the supervisory authority, root cause analysis, lessons learnt.
IT business continuity
IT contingency plan, recovery objectives, backup site, periodic testing and lessons learnt, alignment with the business continuity plan.
Control, audit and awareness
Permanent controls over the IS scope, IT audit missions, follow-up on recommendations, indicators reported to management, staff training and awareness.
A short version of the framework is available for the online self-assessment.
Frequently asked questions
Does this directive lead to certification?
No. It is a prudential text whose compliance is monitored by the WAMU Banking Commission, not a standard certifiable by an accredited body. Datamensio measures the maturity of your setup and prepares you for the supervisor’s review, it does not issue any certificate.
What is the difference between this assessment and a compliance check?
A compliance check verifies whether a requirement is met and ends with a finding. The assessment places the practice on a maturity scale and identifies the action that moves it up a level. It produces a trajectory, where a compliance check produces a status.
How long does the assessment take?
The short version can be completed in a single working session. The full version, run collaboratively with IT, the CISO, internal control and business lines, typically spans one to two weeks, most of the time being spent gathering evidence.
Can the framework be adapted to our institution?
Yes. You can amend the questions and levels, add your own themes, or start from your own procedures. The AI builds a variant from your security policy, useful for a decentralised financial system whose organisation differs from that of a full-service bank.
Can several subsidiaries of the group be compared?
Yes. The same framework deploys across each entity, with a score by theme and a comparison between business units, as well as against previous campaigns. A cross-entity roadmap consolidates subsidiaries’ action plans and groups common actions together.
How does this assessment connect with internal control and the BCP?
The requirements overlap considerably: IT continuity, outsourcing, permanent control. Results are reusable from one framework to another, and the cross-entity roadmap lets you cross-reference assessments without duplicating actions.
Do respondents need technical expertise?
The questions cover governance and management practices, not configurations. Some require input from a technical contact: collaborative mode lets you assign those questions to the right person.
Where is the data hosted?
In France, with OVH, backed up with Scaleway. No transfer outside the European Union. The AI models used can be selected, including from European solutions.