Policy, risk and board reporting
Documents that nobody follows are worse than none
A great deal of security governance in South African organisations exists as a folder of templates downloaded once, adjusted lightly, and never referenced again. It satisfies nobody. Staff do not follow it, auditors see through it, and the board is left believing a control environment exists that does not.
Governance that works is smaller than most organisations expect, written in language people will actually read, and maintained on a cycle that someone owns by name.
Where we typically start
Governance framework
A defined structure setting out who decides what, who is accountable, and how security reaches the board.
Policy set
A right-sized set of policies and standards, adapted to your operations and written in language people will actually follow.
Cyber risk register
A living register with named owners, documented treatment decisions, review dates and an audit trail showing what changed and why.
Management and board reporting
A repeatable report showing posture, movement and decisions required — not a screenshot of a dashboard.
Third-party risk
A proportionate process for assessing and monitoring vendors who touch your data.
Compliance and regulatory alignment
Governance mapped to the obligations and standards that apply to your organisation—including King V, POPIA, Joint Standards 1 and 2, ISO/IEC 27001 and client contractual requirements—so that one control environment can support multiple obligations.
How the engagement runs
Fixed-scope project, then maintained
Governance work is usually delivered as a defined project with a fixed scope and price, then maintained either by your team or under a fractional CISO retainer.
The sequence is consistent: establish what exists, assess it against the standard that applies to you, agree what is proportionate, then write and implement. Documents are handed over in editable form and belong to you.
Where King V, POPIA, Joint Standards 1 and 2 or another sector requirement applies, the governance framework is aligned with those requirements from the outset rather than retrofitted later.
