A practical guide to cyber-risk analysis for African states

A risk analysis begins with an inventory of critical assets: what the state must protect first, from vital infrastructure to citizens' sensitive data.

Then comes the assessment of threats and vulnerabilities, followed by prioritization. Without this step, budgets scatter across poorly calibrated emergencies.

The method matters less than its regularity: a living, re-evaluated framework beats a one-off audit filed away in a drawer.