Security & POPIA-ready IT
Secure by default, and ready for the POPIA questions
The practical IT controls that protect personal information — MFA, patching, backups, endpoint protection, access reviews and a written breach-response plan — documented so your attorney can work with them.
What we put in place
The controls that stop most incidents
Multi-factor authentication
MFA on every account, with legacy authentication switched off — the single biggest win for a small business.
Patching
Windows, browsers and anything internet-facing kept current on a schedule that suits your trading hours.
Backups & restore tests
Backups of mail, files and line-of-business data, with a tested, offline copy and a timed restore.
Endpoint protection
Sensible, monitored protection on laptops and servers — not a subscription you never look at.
Phishing awareness
Short, practical guidance for whoever opens the inbox first, plus filtering that actually filters.
Access reviews
Regular reviews of who can reach what, with least-privilege applied and leavers removed on time.
Breach response
A plan before the bad day
- A one-page runbook: who calls whom, what to isolate, what to preserve
- Evidence handling so an incident is not made worse by panic
- Notification guidance for the Information Regulator and affected people, coordinated with your attorney
- An annual security review with a partner attorney
We help execute the plan; we do not improvise during an incident.
What we do not claim
- We do not say our work makes you “POPIA compliant”.
- We do not give legal advice — that comes from an attorney.
- We do not invent response-time or uptime guarantees.
Frequently asked questions
Does working with you make us POPIA compliant?
No, and anyone who promises that is overselling. POPIA is broader than IT. We implement and document the IT controls that support your compliance; legal advice comes from an attorney.
What is MFA and why insist on it?
Multi-factor authentication means a password plus a second check on your phone. It is the single most effective control against account takeover, because a stolen password alone is no longer enough.
What happens if we are breached?
You get a written runbook before it happens: who calls whom, what to isolate, how to preserve evidence, and when to notify the Information Regulator and affected people. We help execute it, we do not improvise during an incident.
Do you do penetration testing?
Not as a headline offer. We do configuration reviews, access reviews and a one-page risk summary. If you need a formal pen test we will say so and can work alongside a specialist.
See your current risk in one page
The Health Check reviews MFA gaps, admin accounts, backups, patch status and your Microsoft 365 secure score, then hands you a plain-language summary.