rwotolara-innocent/PaMaa_ISO27001
Domain:
digital infrastructureCreator:
rwo
Host:
ISO 27001 ISMS built for a grassroots NGO in Northern Uganda. Risk register, gap analysis, policies, incident response, and Python risk visualisation - scoped for a real low-resource BYOD environment.
# Pa Maa Education Initiative - ISO 27001 ISMS for Grassroots NGO
**Author:** Rwotolara Innocent - Cybersecurity Analyst & Data Specialist
**Contact:** linkedin.com
**Repo:** github.com
---
**Organisation:** Pa Maa Education Initiative, Northern Uganda
**Standard:** ISO/IEC 27001:2022
**ISMS Owner:** Sophia
**Version:** 1.0 | March 2026
---
## Overview
This repository documents the design and implementation of an ISO 27001-aligned Information Security Management System (ISMS) for Pa Maa Education Initiative - a grassroots NGO protecting and educating vulnerable girls in Northern Uganda.
The project transitioned Pa Maa from a high-risk, unmanaged personal device environment to a structured security framework. The context is deliberately low-resource and BYOD-first: all devices are personal phones and laptops, coordination happens over WhatsApp, and the threat landscape is shaped by the realities of operating in rural Northern Uganda.
> **The core principle:** Security is an act of stewardship for the girls we serve.
---
## How to Read This Repo
- **NGO Leaders / Donors:** Read `README.md` + `07_Reports/CEO_Security_Report_PaMaa.md`
- **Cybersecurity Recruiters:** Read `README.md` + `02_Risk_Management/` (Risk Assessment, RTP, SoA, Gap Analysis)
- **Technical Reviewers:** Read policies (`01_Policy_Documents/`), asset inventory (`03_Asset_Management/`), scripts (`06_Automation_Scripts/`), and training materials (`05_Training`)
---
## Repository Structure
```
PaMaa_ISO27001/
│
├── 01_Policy_Documents/
│ ├── Information_Policy.md # Master security policy
│ └── BYOD_Agreement.md # Staff device usage agreement
│
├── 02_Risk_Management/
│ ├── Risk_Assessment.md # Full ISO 27001 risk register (7 risks)
│ ├── Gap_Analysis.md # Annex A control gap analysis
│ ├── SoA_PaMaa_ISO27001_v1.0.docx # Statement of Applicability (Clause 6.1.3)
│ ├── RTP_PaMaa_I …