Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
South Africa
Manual penetration testing and security consulting scoped against the frameworks South African organizations actually get assessed on, POPIA, the Cybercrimes Act, and King IV, not a generic international template.
Cybercrime costs South Africa ~R2.2 billion a year.
SABRIC's own estimate for the annual cost of cybercrime to the South African economy.
SABRICSouth African organizations increasingly need to demonstrate real, evidenced security testing , not just a policy document, whether that's driven by POPIA 's expectation of appropriate technical safeguards, the Cybercrimes Act's reporting obligations, or King IV's technology and information governance principle for JSE-listed boards. A generic penetration test report doesn't map cleanly onto any of these, what does is testing that's actually scoped with the relevant framework in mind from the start.
The Information Regulator, established under POPIA, is the body responsible for monitoring and enforcing compliance, its guidance is the most direct source for what "appropriate technical measures" is expected to mean in practice, and it's what we scope engagements against.
This runs on the same manual, adversary-emulated methodology behind our core Penetration Testing service, applied with South Africa-specific frameworks and reporting expectations in mind.
The South Africa-specific regulations and governance codes our engagements are most often scoped around.
The Protection of Personal Information Act, enforced by the Information Regulator, sets minimum conditions for lawfully processing personal information, its expectation of appropriate technical safeguards is exactly what a penetration test provides real evidence for.
Information Regulator South AfricaIn force since December 2021, criminalizing unlawful access to and interference with data and computer systems, and setting out reporting obligations for certain categories of cyber incident.
Cybercrimes Act 19 of 2020, full textThe Institute of Directors in Southern Africa's corporate governance code. Its technology and information governance principle expects boards at JSE-listed and King IV-aligned organizations to oversee IT risk, real, independent security testing is part of demonstrating that oversight.
IoDSA, King IVThe international information security management standard, widely used across South African organizations as a baseline or complementary certification alongside sector-specific requirements.
ISO/IEC 27001POPIA & King IV, evidenced
Unencrypted personal information, a Cybercrimes Act-relevant access gap, and a King IV board-oversight shortfall, closed in one pass.
Checking technical safeguards over personal information
$ aws s3api get-bucket-encryption --bucket demo-corp-customers-za
ServerSideEncryptionConfiguration: not found
Customer ID numbers and contact details, stored unencrypted at rest.
An illustrative walkthrough of how an engagement actually runs, not footage from a real client environment.
Yes, we scope engagements with POPIA's technical safeguard expectations in mind, and our reporting can support the evidence an organization needs for its own compliance and Information Regulator obligations, though formal legal compliance sign-off should still come from your own counsel or POPIA officer.
Yes, for JSE-listed and King IV-aligned organizations, we can structure findings and reporting to support board-level evidence of IT risk oversight, alongside our standard penetration testing methodology.
We work across sectors including financial services, technology, and professional services in South Africa, tell us your sector and any specific regulatory context (POPIA, King IV, sector-specific) during scoping.
Our South Africa work anchors our wider Africa engagement, and our engagements are remote-capable across the continent, tell us your specific location and regulatory context during scoping and we'll confirm fit.
Talk to us about scoping an engagement around your specific regulatory context, POPIA, the Cybercrimes Act, or King IV.
