Cybersecurity governance and compliance for South African companies
New rules now hold boards accountable for cybersecurity, set 24-hour reporting deadlines for financial firms and make breach reporting to the Information Regulator mandatory. iCloudz turns each obligation into controls, evidence and board reports you can show a regulator.
Take the free JS2 readiness check Book a compliance reviewThe rules in force now, and what we do about each
Updated October 2026. Each card shows what the rule requires and the iCloudz service that covers it.
In force: Regulations from 17 April 2025
POPIA: amended Regulations and mandatory breach reporting
What it requires
- Security compromises must be reported to the Information Regulator through its eServices portal, and to the people affected, as soon as reasonably possible.
- Electronic direct marketing to non-customers needs a positive opt-in; an opt-out does not count as consent.
- People can object, correct or delete their data free of charge by email, SMS or WhatsApp, with a reply within 30 days.
- Appropriate technical and organisational safeguards (section 19), kept continuously improved.
iCloudz service
- POPIA security health check against section 19
- Breach response plan and portal notification support (try our free POPIA breach checklist)
- Marketing consent and data-subject request process review
- 24/7 monitoring to detect breaches early
In force: 1 June 2025, 24-hour reporting from 1 September 2026
Joint Standard 2: cybersecurity and cyber resilience
What it requires
- Applies to banks, insurers, pension funds and administrators, CIS managers and many FSPs.
- A board-approved cyber strategy, an asset inventory (including third parties), MFA on critical and privileged access, risk-based patching, 24/7 monitoring and tested backups.
- Annual penetration testing of internet-facing systems and annual awareness training, including for the board.
- Material cyber incidents reported to the FSCA or Prudential Authority within 24 hours of classification, with an update within 14 days.
iCloudz service
- Fixed-price JS2 gap assessment and board briefing
- Monthly Cyber Resilience Service: SOC, threat intelligence, access reviews and quarterly board reports
- 24-hour incident notification playbook
- Penetration testing and HumanFirewall training
In force: 15 November 2024
Joint Standard 1: IT governance and risk management
What it requires
- The board approves the IT strategy and IT risk framework and reviews them every year.
- A designated IT risk function.
- Backup and restore tested every year, with recovery time and recovery point objectives, and a geographically separate disaster recovery site.
iCloudz service
- IT risk framework and policy pack
- Backup, restore and disaster recovery testing with evidence
- Cloud and data security reviews
Applies to financial years from 1 January 2026
King V Code: data, information, technology and AI
What it requires
- Boards are accountable for data security, privacy and third-party risk, with effective cybersecurity strategies and disaster recovery planning.
- AI must be governed for ethics, transparency and security, with human oversight proportionate to the risk.
- Apply-and-explain disclosure; expected of JSE-listed companies and widely adopted by others.
iCloudz service
- Board cyber and AI governance reporting pack
- AI governance framework aligned with ISO/IEC 42001
- Third-party (supplier) cyber risk reviews
In force: most sections since 1 December 2021
Cybercrimes Act 19 of 2020
What it requires
- Hacking, data interference, cyber fraud, extortion (including ransomware) and malicious communications are criminal offences.
- Police can search and seize data, so evidence must be preserved properly after an incident.
iCloudz service
- Incident response and digital evidence preservation
- Ransomware readiness and response retainer
All sectors
ISO/IEC 27001 and 42001 certification readiness
Why it matters
- Large clients and regulators increasingly ask suppliers for proof of an information security management system.
- ISO/IEC 42001 is the new standard for managing AI responsibly, and supports King V’s AI expectations.
iCloudz service
- Gap assessment, policies and evidence for certification
- AI governance assessments led by our ISO 42001 adviser
The Information Regulator is enforcing. It has fined public bodies R5 million each (both fines are disputed), issued enforcement notices after ransomware attacks and unreported breaches, and received more than 8,000 breach notifications. Notices typically cite unpatched systems, lapsed security tools and no incident response plan: the same gaps our assessments find.
How we work
| Step | What you get | Timing |
|---|---|---|
| 1. Readiness check | The free online JS2 self-check, or a 1-hour call to agree which rules apply to you | Today |
| 2. Gap assessment | Review against the applicable rules, a risk register, a prioritised fix plan and a board briefing. Fixed price | 2 to 4 weeks |
| 3. Fix and evidence | MFA, access reviews, patching, backups, policies, training and penetration tests, with the evidence a regulator asks for | 1 to 6 months |
| 4. Stay compliant | 24/7 SOC monitoring, threat intelligence, 24-hour incident support and quarterly board reports | Monthly |
On the horizon
- Cybercrimes Act section 54: will require electronic communications service providers and financial institutions to report cyber offences to SAPS within 72 hours. Not yet in force; we are preparing clients for it.
- Critical Infrastructure Protection Act: the duties for owners of declared critical infrastructure (security measures and a vetted security manager) are not yet in force.
- National AI policy: the 2026 draft was withdrawn. King V and ISO/IEC 42001 are the practical guides for now.
Start with a conversation, not a sales pitch
Tell us your sector and the rules you are worried about, and we will tell you what applies and what a fix would cost. iCloudz is Level 1 B-BBEE and 100% black women-owned: every R100 you spend with us counts as R135 of B-BBEE procurement.
Take the JS2 readiness check Contact us below WhatsApp usThis page summarises current rules for general information and is not legal advice. Sources: Bowmans on the POPIA Regulations, Moonstone on JS2 incident reporting, Joint Standard 1 of 2023, Bowmans on King V, Michalsons on Information Regulator enforcement.