Implementing the NIST Cybersecurity Framework
The NIST Cybersecurity Framework (CSF) has become the default way most organisations structure their security programme — including a growing number of South African enterprises. CSF 2.0 added Govern as a sixth function, sharpening the link between strategic oversight and operational execution. This article walks through how to implement the framework in practice, how it […]
Third-Party Risk Management in Cybersecurity
Supplier cybersecurity posture increasingly affects procurement qualification, cyber insurance reviews, operational resilience, and customer trust — particularly where suppliers process sensitive data or support critical operations. Most organisations now depend on dozens or hundreds of third parties for business-critical services. Each one is a potential entry point — and the supply-chain breaches dominating recent headlines […]
Comprehensive Cyber Risk Assessments
A cyber risk assessment turns vague anxiety about cyber threats into a structured, defensible view that the board can act on. Done well, it is the single most useful artefact a security function produces in a year — it sets the agenda for investment, audit, and reporting. Done badly, it produces a heatmap that nobody […]
Achieving ISO 27001 Compliance in South Africa: A Step-by-Step Guide
Many organisations now pursue ISO 27001 not only for governance maturity, but because enterprise customers, procurement teams, insurers, and regulators increasingly expect independently verifiable security governance. ISO 27001 has moved from a nice-to-have to a contractual expectation for many South African organisations — particularly those serving enterprise customers, processing personal information at scale, or operating […]
Why Your Business Needs Regular Information Security Audits
Most organisations know which standards they are held to. Far fewer know — with evidence — where their controls actually sit against those standards on any given Tuesday morning. The gap shows up in regulator engagement, audit findings, insurance underwriting questions, and board reporting. Regular, independent information security audits close that gap. They convert assumptions […]