AVeS Cyber Security urges POPIA compliance following landmark Information Regulator fine
3 mins
Information Officers (IOs) and IT Managers are being urged to understand and comply with the Protection of Personal Information Act (POPIA) to safeguard personal data. This call to action follows a substantial fine imposed on the Department of Justice for cybersecurity lapses, highlighting the need for continuous verification and compliance as a journey, not a checklist. AVeS Cyber Security offers tailored solutions and cyber security posture assessments to assist companies in meeting POPIA compliance and ensuring the integrity and confidentiality of personal information. Failure to comply may result in significant fines, making it imperative for organizations to prioritize cybersecurity.
Information Officers (IOs) and IT Managers are urged to comply with the provisions of the Protection of Personal Information Act (POPIA), which was signed into law in 2013, says Cornelis Molenaar, IT Governance Advisor and Implementer at AVeS Cyber Security.
“
It is important that IOs and others fully comprehend their responsibilities under the legislation
.“
says Molenaar, who reveals that a snapshot survey of about a hundred IOs indicated a significant lack of awareness.
Such an alarm bell comes in the wake of the Department of Justice and Constitutional Development receiving a hefty R5 million fine by the Information Regulator for failing to ramp up its cyber security following a 2021 ransomware attack involving personal information records. The fine was levied after the department failed to respond to the notice within the 31 days provided by the Regulator to implement the recommended corrective actions.
“
It definitely has implications for all IOs and IT Managers. There is a misconception that POPIA is just a tick box exercise. Unfortunately, this is a huge misconception because proper compliance requires best practice measures such as regular verification of your information security controls. For example, a minimum requirement would be a yearly assessment to ascertain whether controls that are in place are actually effective or not and whether it can be improved upon, says Molenaar.
.“
Constant verification and updating are critical as new threats evolve and new technologies are developed. “There is a constant need to reconsider the risks identified and carry out a proper review. Compliance is a journey, not a checklist.” Molenaar says the Information Regulator’s latest action sets the tone for future notices and even fines. “It is clear the regulator has teeth and is willing to use its powers to enforce compliance to protect personal information,” he warns.
Any company concerned about their POPIA compliance status is urged to contact a leading solutions provider like AVeS Cyber Security to conduct a cyber security posture assessment. It will look at the procedures in place in order for the IO to deal with any requests from the Information Regulator, and the timeframe for such a response.
“
Our framework has got all of the required processes built into it already to give our clients the assurance that their cyber security posture is fully compliant,
.“
says Molenaar. It implies a certain level of cyber security alertness and readiness to be able to deal proactively with any incidents. But what about those companies that do not as yet have any measures in place?
“The cyber security posture assessment is the first step to check that you have everything in place and then compare yourself as well with the POPIA compliance assessment. Once you know your gaps, you know what priorities to resolve. We offer a host of remediation services that can be customised. We can baseline any steps taken and then improve upon them. Otherwise, if no steps have been taken, we can assist them on their journey from scratch,” says Molenaar.
“The most important thing to remember is that continuously monitoring your cyber security environment is a mandatory security measure and a legislative obligation.” This is clarified in POPIA Section 19 ‘Security measures on integrity and confidentiality of personal information’, paragraphs (1) and (2). Any private company or public body that needs to comply with POPIA must implement controls and continuously monitor for risks and threats to both personal and confidential data in general.
“
“We recommend a comprehensive, robust information security governance and technology strategy that includes raising awareness and providing proper training,” highlights Molenaar. Failure to do so can result in a fine of up to R10 million.
.“
AVeS Cyber Security POPIA Information Security Assessment Benefits
- Improved Consistency: Implement good policies and procedures for clients to improve their governance according to best practice international frameworks and standards.
- Reduced Risk: Provide technology solutions to align with good governance and best practices.
- Increased Efficiency: Ensure data repositories are secured and managed to derive the most value.
- Empowering Employees: Provide people enablement and organisational change management solutions aligned with processes and technology.
- Continuous Oversight: Cyber and information security assurance through managed SOC and SIEM solutions to enable them to operate smartly and respond to incidents appropriately.
Do you like this article? To receive our monthly newsletter sign up for our newsletter here.
Be POPIA ready today!
Ensure your business is POPIA compliant and safeguard personal information. Contact AVeS Cyber Security for a comprehensive cyber security assessment and customized solutions. Don’t wait for fines to knock on your door!