Our approach to managing data security

At Airtel Africa, data security is fundamental to our business and essential to maintaining the trust of our customers – and we remain vigilant in protecting our digital ecosystem.

To counter cyber threats, we deploy industry-leading security technologies:

• Web application firewalls and anti-DDoS solutions to safeguard our infrastructure
• Network detection and response to proactively identify threats
• Endpoint detection and response for enhanced device security
• 24/7 security incident response, supported by specialised partners, ensuring real-time action
• Brand protection and takedown services to combat fraudulent activities.

We continuously monitor the cyber threat landscape, including the dark web, to stay ahead of emerging threats. We employ advanced data loss prevention (DLP) technology to protect sensitive information across our network and engage external security experts to respond to incidents rapidly and build resilience.

We track performance against KPIs which are reviewed regularly by our chief information security officer (CISO). Any deviations trigger immediate corrective action plans. 

1

Our commitment to data security and privacy establishes us as a trusted leader, proactively anticipating and mitigating risks to uphold the highest standards of information security for customers, partners and regulators.

2

Prashant Nair

Chief information security officer

Risk management

Risk management is a key aspect of our approach to data security. We conduct information security risk assessments at multiple levels, including: 

• Continuous evaluation of critical external-facing assets
• Ongoing threat identification through vulnerability and penetration testing, prioritised by asset criticality
• Application security assessments conducted before code implementation
• Annual Group-wide security assessments
• Our risk assessment procedure evaluates risks by classifying assets based on confidentiality, integrity, availability and privacy. Threats are assessed and rated by likelihood, ranging from very low to very high
• Threat hunting and intelligence tools help us detect vulnerabilities before they escalate.

Key risk indicators are assessed monthly and reported to the chief information officer (CIO). Compliance with ISO 27001 and ISO 22301 frameworks provides additional security.

Training 

We ensure a robust data security culture through employee training, including phishing simulations across all OpCos. Employees who fail simulations undergo mandatory security training, reinforcing our commitment to data protection.

To extend our security awareness initiatives beyond internal teams, we also introduced specialised security training mailers for our Board of directors at selected OpCos, tailored to meet regulatory requirements. Additionally, in July 2024, we launched a security awareness programme for key partners and vendors, reinforcing security best practices across our wider ecosystem.

Governance

Data security is a standing agenda item at quarterly Executive Risk Committee (ERC) meetings, where the CISO presents the state of information security, emerging threats and mitigation strategies. The CISO also reports quarterly to the Audit and Risk Committee on outstanding audit issues and material security risks. In addition, the CIO, CISO and OpCo IT directors review data security matters monthly. The information security team includes specialists from various cybersecurity domains and a dedicated security expert from a trusted third-party provider.

We’ve also established comprehensive information security (IS) and business continuity (BC) governance structures, comprising two main governing channels.

Group-level governance

The Group-level information security team, led by the CIO and supported by the CISO, is responsible for strategic decision-making, governance, overall implementation and monitoring of data security controls across 14 OpCos.

This governing body includes:

• Chief information officer (CIO) – chair
• Chief technology officer (CTO)
• Chief compliance officer (CCO)
• Chief information security officer (CISO)
• OpCo representatives and, as and when required, domain specialists in application security, vulnerability management, third-party risk, network security, endpoint security, security operations, identity and access governance, threat intelligence and risk compliance.

OpCo-level governance

At OpCo level, governance is managed by a dedicated information security and business continuity working group comprising the country managing director, information security manager, functional head, technical team leaders and representatives from multiple departments who are responsible for implementation of information security controls in each OpCo. This working group is chaired by the CISO.

These governance bodies work closely with the Group information security team, ensuring alignment and compliance with Group-wide security strategy.

Policies and frameworks

Our data security framework is guided by key internal policies, including:

• Group information security policy
• Data protection and privacy policy
• Third-party risk management framework
• Ransomware protection policy

These policies ensure a structured, proactive approach to safeguarding data across Airtel Africa.