Cyber security as a board and institutional risk-management question

Cyber security is the institutional risk-management discipline that protects an organisation's digital assets, personal data and operational continuity.

For South African public entities and complex private bodies, treating digital resilience as a board-level oversight duty rather than a technical IT problem is what safeguards public resources and upholds legal compliance.

Why cyber security is a board question, not an IT problem

Cyber security is fundamentally an enterprise risk question that reaches organisational strategy, financial stability, legal compliance and public reputation. In many complex South African institutions, cyber resilience is improperly treated as an operational task left to technical IT staff. That creates real governance exposure, because the technical team maintains infrastructure while executive leadership stays legally accountable for institutional risk, asset protection and statutory compliance.

Under the PFMA as administered by National Treasury, public-sector governance is built around an outputs- and accountability-driven approach rather than narrow administrative compliance. A breach or system compromise is therefore not merely a technical failure; it is a breakdown in organisational risk governance.

When boards and accounting authorities view cyber security strictly through a technical lens, they miss how digital vulnerabilities threaten the core operational capability, the service-delivery mandate and financial sustainability. A major incident disrupts operations, destroys administrative data, compromises confidential records, and inflicts financial damage through interruption and recovery cost. Boards, executives, accounting officers, accounting authorities and information officers have to take active ownership of cyber risk, embedding digital resilience in the institution's overall risk-management framework. Treating cyber security as an executive responsibility keeps the protection of technology aligned with the legal duties, the strategy and the governance.

Safeguarding personal data and privacy obligations

A critical part of cyber risk is protecting the personal data held in an institution's systems. POPIA sets out to promote the protection of personal information processed by public and private bodies, establishing conditions that set minimum requirements for lawful processing. Under POPIA, a responsible party is obliged to keep personal information protected and safeguarded against unauthorised access, loss, damage or unlawful processing. When a cyber incident compromises personal records, it engages POPIA directly and brings in the oversight of the Information Regulator of South Africa.

Established in terms of section 39 of POPIA, the Information Regulator is an independent body, subject only to the Constitution and the law and accountable to the National Assembly. Empowered to monitor and enforce compliance under both POPIA and the Promotion of Access to Information Act, the Regulator oversees how institutions handle personal data. In terms of section 55 of POPIA, a responsible party must register its information officer on the Regulator's Information Officer Portal before that officer assumes their duties.

The registered information officer has a central role in maintaining data-privacy standards, supervising compliance and liaising with the Regulator. And where platforms process or transfer personal information across borders, the institution has to hold to the POPIA rules on cross-border data flows.

Protecting public assets and operational continuity

Beyond privacy, cyber security reaches the protection of public assets, financial management and operational continuity. The PFMA as administered by National Treasury promotes good financial management that maximises service delivery through the efficient use of limited resources. Its objectives include modernising public financial management, holding managers accountable, ensuring the timely provision of quality information, and eliminating waste in the use of public assets.

Under the PFMA as administered by National Treasury, public-sector governance is built around an outputs- and accountability-driven approach rather than narrow administrative compliance.

— Synthesis of South African regulatory guidance

A severe attack — ransomware, unauthorised system manipulation or infrastructure sabotage — is a major failure of financial control and asset protection. When the digital network is disrupted, the institution's ability to operate basic systems, maintain internal controls and execute financial transactions is immediately impaired. A system outage halts service delivery, prevents accurate performance reporting against predetermined objectives, and forces the organisation to spend scarce public funds on emergency remediation. Protecting the networks and the digital repositories against cyber threats is therefore a direct part of the PFMA duty to operate basic systems, preserve internal controls, and prevent fruitless and wasteful expenditure.

Embedding cyber risk in controls and audit oversight

To manage cyber risk, leadership has to fold digital security into the institution's internal-control structures and oversight. Under Chapter 9 of the PFMA, National Treasury obligates the appointment and composition of audit committees across public-sector bodies. The audit committee reviews financial management, the effectiveness of internal control, and the risk exposure. Cyber risk belongs squarely in that line of sight, with structured reporting and independent verification rather than superficial technical updates.

The internal controls over the digital systems — access management, privileged access, network segregation and change procedures — are the backbone of financial and operational integrity. The audit committee should evaluate independently whether those controls are properly designed and operating, so that institutional assets and data pipelines are protected. Independent technology assurance and IT-audit testing give the committee, the board and the accounting officer objective evidence on the cyber-defence capability and the control gaps. Embedding cyber risk in the internal-audit plan and the committee's agenda is how digital threats get identified, monitored and mitigated systematically.

Statutory accountability and non-delegable duties

Ultimate accountability for cyber risk rests with the board, the executive authorities and the head officials, and cannot be delegated to the IT department or an external supplier. The PFMA sets a clear division of responsibility between the political head, who owns policy and outcomes, and the accounting officer or accounting authority, who owns outputs, implementation, basic systems and budget. Accounting officers and accounting authorities carry non-delegable fiduciary duties to operate basic financial management systems, enforce internal controls, protect public assets, and report on performance against predetermined objectives.

Under the PFMA as administered by National Treasury, an accounting officer or accounting authority who acts negligently or fails to meet these duties faces strict disciplinary sanctions, up to dismissal, and potential prosecution for financial misconduct. In a digital environment, neglecting cyber risk, ignoring a known control weakness, or failing to protect a critical data system is a clear breach of those duties. Boards, accounting officers, accounting authorities and registered information officers must direct the cyber-security strategy actively, set the risk tolerance, and make sure adequate resources are allocated to protect the operation.

What good looks like

Exemplary cyber-security governance in a complex South African institution is marked by active executive oversight, robust internal controls and full statutory alignment. Well-governed organisations treat cyber security as a risk-management discipline that protects public assets, eliminates waste and holds operational continuity in line with the predetermined objectives under the PFMA. They keep all personal information protected and safeguarded under the POPIA conditions, enforce the controls over cross-border transfers, and keep their information officer registered on the Information Officer Portal of the Information Regulator under section 55.

Accounting officers, accounting authorities, information officers and the Chapter 9 audit committees hold rigorous oversight, embedding independent technology assurance and internal controls into the enterprise risk framework. Grounding digital resilience in the legal duties and the fiduciary accountability is what lets a South African institution protect its assets, maintain service delivery, and keep public trust in an increasingly connected environment.

Related insights

• Digital Disruption in South African Banking
• ERP transformation: the governance, finance and data-migration agenda
• IT governance: linking technology accountability to institutional objectives