23 October 2026

Cybersecurity basics for South African SMEs and municipalities

You do not need a large IT department to be reasonably safe. Most security incidents in small organisations start with something ordinary: a reused password, a convincing email, an old laptop with the only copy of the books. Fixing those things first is where the value is.

Why POPIA makes this a management issue

The Protection of Personal Information Act expects any organisation that holds personal information to keep it secure and to take reasonable steps against loss, damage and unauthorised access. If you hold staff records, customer details, learner data or ratepayer information, that includes you. When something goes wrong, the question is whether you took sensible precautions, so it helps to be able to show what you did.

Six steps to start with

1. Know what you hold and where it lives

List the systems, shared folders, mailboxes and devices that carry personal or financial information. You cannot protect what you have not listed.

2. Turn on multi-factor authentication

Email and cloud accounts are the front door. A second step at sign-in stops most password guessing and password reuse attacks. Start with administrators and finance staff.

3. Give people only the access they need

Review who can open what. Remove access for people who have left or changed roles, and keep administrator rights for the few who need them.

4. Keep devices and software updated

Switch on automatic updates for operating systems, browsers and office software, and retire machines that can no longer be updated.

5. Back up, then test the restore

A backup you have never restored is only a hope. Keep at least one copy away from your main network, and try to recover a file or a whole machine on a quiet day.

6. Prepare your people and a first-hours plan

Short, regular awareness sessions help staff spot phishing emails and fake payment requests. Write down who to call, who decides, and who tells the Information Regulator and affected people if personal information is compromised.

Municipalities and public entities

Public bodies often run older systems, share devices between staff, and depend on suppliers for hosting and support. Add supplier access to your review, check what your service agreements say about security, and make sure someone owns each system.

Where to begin

A short assessment of your accounts, email, devices and backups will show which of these steps matter most for you, and in what order to tackle them. Keep the findings simple and the actions small enough to finish.