Security Solution Consultants (SSC) are cyber security consultants for Johannesburg organisations that need to meet POPIA, the Prudential Authority and FSCA Joint Standards, ISO 27001, PCI DSS and ISO 45001 without slowing the business down. We work with mining houses, banks, insurers, healthcare groups and technology companies across Sandton, Rosebank, Midrand and Pretoria, combining practical governance, risk and compliance (GRC) consulting with GRCLens, our own GRC platform.
South Africa was the African country most frequently targeted by ransomware operators in 2024, according to INTERPOL’s 2025 Africa Cyberthreat Assessment. The local numbers explain why boards are asking harder questions:
| Obligation | Who it applies to | What it asks for |
|---|---|---|
| POPIA (Protection of Personal Information Act 4 of 2013) | Every organisation that processes personal information | The eight conditions for lawful processing, security safeguards (s 19), notifying the Information Regulator and affected people as soon as reasonably possible after a compromise (s 22), and a registered Information Officer |
| Joint Standard 2 of 2024, Cybersecurity and Cyber Resilience | Banks, insurers, market infrastructures, pension funds and other listed financial institutions, from 1 June 2025 | A board approved cyber strategy, hygiene controls, regular testing, incident response, and notice of material incidents within 24 hours (Joint Notice 2 of 2026) |
| Joint Standard 1 of 2023, IT Governance and Risk Management | The same financial institutions, from 15 November 2024 | Board accountability for IT risk, IT risk management, service and project management frameworks |
| King IV Principle 12 | JSE listed companies (apply and explain) | The board governs technology and information so it supports the organisation’s objectives |
| Mine Health and Safety Act 29 of 1996, with ISO 45001 | Mines and mining contractors | Hazard identification, risk assessment and a safety management system; ISO 45001 is the common certifiable framework |
| PCI DSS v4.0.1 | Merchants, payment service providers and anyone storing, processing or transmitting card data | Twelve requirement areas; the future-dated requirements became mandatory on 31 March 2025 |
When Sibanye-Stillwater was hit by a cyber attack in July 2024 it isolated its IT systems and later postponed its results. Mines in Gauteng and the platinum belt run hoisting, ventilation, pumping and processing plants on control systems that were never designed to face the internet, yet are now connected to corporate networks, vendors and remote support.
See our operational technology and energy sector security assessments and critical infrastructure and OT security training. GRCLens includes an IEC 62443 module.
Mining fatalities fell to a record low of 42 in 2024 and 41 in 2025, but 49 deaths had been recorded by mid September 2026, and the Minister has called for accountability across the industry. Mines answer to the Mine Health and Safety Act; most other workplaces to the Occupational Health and Safety Act 85 of 1993. ISO 45001, adopted in South Africa as SANS/ISO 45001, gives both a structure auditors and insurers recognise.
We run ISO 45001 gap assessments, hazard identification and risk assessment workshops, integrated management systems with ISO 14001 and ISO 9001, internal audits and certification readiness with a SANAS accredited certification body. Learn more about our ISO 9001, ISO 45001 and ISO 22000 consulting.
Joint Standard 2 of 2024 requires an annual review of the cyber strategy, an annual independent review of the cybersecurity framework, a testing programme that includes at least annual penetration testing of internet facing systems, and remediation tracked to the board. From 1 September 2026, material incidents go to the Prudential Authority or FSCA within 24 hours of being classified, with an update within 14 days, and outsourcing does not move that duty to your provider.
We assess you against every paragraph of Joint Standards 1 and 2, design the testing and assurance programme, prepare board reporting, and support PCI DSS for card issuers, acquirers and payment providers. See our cyber security maturity assessments and PCI DSS compliance advisory.
A credible POPIA programme starts with a registered Information Officer, a personal information impact assessment and a compliance framework that is monitored, not just written. Section 19 then expects safeguards that are identified, implemented, regularly verified and updated, and section 21 makes you answerable for the security of your operators. Since April 2025 security compromises are reported through the Regulator’s eServices portal.
ISO 27001 is the most practical way to show your section 19 safeguards work. We design the scope, run the risk assessment and Statement of Applicability, prepare evidence and support you through Stage 1 and Stage 2 audits. Learn more about our ISO 27001 implementation and advisory, or see the GRCLens ISO 27001 module.
The ransomware attack on the National Health Laboratory Service in June 2024 left about 6.3 million blood tests in a backlog. Health information is special personal information under POPIA, which allows processing only under the conditions in sections 26 to 32. We help hospital groups, laboratories, medical schemes and practices secure clinical systems and evidence their safeguards.
As Johannesburg organisations adopt AI, POPIA section 71 already limits decisions based solely on automated profiling. Our ISO 42001 consulting builds an AI management system that inventories AI use, assesses risk and impact, and keeps humans accountable.
Consulting gets you compliant. GRCLens, the governance, risk and compliance platform we built and use on every engagement, keeps you compliant. It orchestrates your regulatory and legislative compliance in one place, so your risk, compliance and audit teams work from the same controls, evidence and numbers.
See GRCLens for South Africa, or request a GRCLens demo.
We also support organisations in Cape Town, Nairobi, Lusaka and Harare.
We deliver most work remotely and use a local partner firm for on-site interviews, walkthroughs, audits and plant visits in Johannesburg, Sandton, Midrand and Pretoria, so you get specialist GRC expertise without paying for a large local team.
GRCLens is the governance, risk and compliance platform we built and use on every engagement. It holds your obligations, controls, evidence, risks and board reporting in one place. Many clients keep using it after the project to run their compliance programme, but our consulting does not depend on it.
It applies to banks, mutual banks, insurers, market infrastructures, pension funds, section 13B administrators, certain Category I financial services providers, over-the-counter derivative providers and credit rating agencies. It took effect on 1 June 2025.
Most mid-sized organisations are ready for the certification audit within four to nine months, depending on scope and how much is already in place. The certificate is issued by an accredited certification body, not by the consultant.
PCI DSS is a contractual requirement set by the card schemes and enforced by acquiring banks, not a statute. South African law separately expects payment systems to be sufficiently secure, so card data breaches also raise POPIA questions.
You must notify the Information Regulator and the affected people as soon as reasonably possible after you have reasonable grounds to believe personal information was accessed by an unauthorised person. Notifications are made through the Regulator's eServices portal.
Yes. Many of the same people, sites and risk registers are involved, so we plan the OT security assessment and the ISO 45001 programme together and share the governance, document control and internal audit.
Tell us where you are today and what you need to achieve. We will come back with a clear scope, timeline and fixed quote.
Secure your cloud environments & ensure safe migration with compliance-ready.
Stay informed with the latest cybersecurity news and expert tips.
Copyright © 2026 Security Solution Consultants. ABN 87 616 212 063. Tarneit, Victoria 3029, Australia. All Rights Reserved.
