South African context, practical guidance

Practical Cyber Safety Guidance for South Africans — Built for Our Reality

Practical steps for local banking scams, WhatsApp fraud, load shedding disruption, POPIA duties, supplier impersonation and incident reporting.

Browse guidance Report an incident
Latest SA threat snapshot Payment fraud pressure Watch for fake SARS refunds, courier fees, "pay and clear" proof and supplier banking-detail changes.
Resilience reality Load shedding matters Power loss can interrupt backups, reset routers, weaken alarms and hide failed recovery processes.
Legal trigger POPIA notifications Businesses should assess breach notices to affected people and the Information Regulator quickly.

Advice by audience

Choose the guidance that matches your situation

You & your family

Banking scams, passwords, phones, home Wi-Fi, children online and what to do after a data breach.

Small & medium organisations

Affordable actions for SMMEs, schools, clinics, NGOs, clubs and professional practices.

Medium to large organisations

Governance, resilience, ransomware readiness, cloud risk and critical supplier assurance.

Self-employed & sole traders

Simple controls for consultants, creatives, tradespeople and micro-business owners.

Public sector

Guidance for municipalities, departments, schools and public entities protecting citizen services.

Cyber security professionals

Operational playbooks, engineering patterns, threat sharing and secure delivery practices.

Common topics

Find the issue you are dealing with

Scam messages and calls Passwords, passkeys and MFA Backups during load shedding Remote work and cloud tools Ransomware readiness Supply chain assurance Citizen data and POPIA Secure development Threat intelligence

When something goes wrong

Report, preserve evidence, then recover

If money was stolen, a crime was committed or you are being extorted, report it to SAPS. If personal information may have been compromised, assess POPIA notification duties and contact the Information Regulator where required. For technical incident coordination, contact South Africa's Cybersecurity Hub.

  • Ask SAPS for a CAS number and keep it with bank and insurer references.
  • Save screenshots, phone numbers, email headers, payment references and timestamps before deleting anything.
  • Businesses should notify affected people and the Information Regulator as soon as reasonably possible where POPIA section 22 applies.
  1. Money or extortion?Bank first, then SAPS.
  2. Personal data exposed?Assess POPIA duties.
  3. Active technical incident?Coordinate containment.
Bank fraud contacts Telco fraud contacts SAPS crime reporting SAPS cybercrime tips Cybersecurity Hub Information Regulator

Resources

Checklist and form starting points

Guidance page

Check exposed online accounts

Use trusted tools to check breach exposure, review saved passwords and secure affected accounts.

 Web form

Cyber incident intake and triage

Route money theft, extortion, data exposure and active technical incidents to the right next steps.

 Form + export

Evidence preservation checklist

Capture screenshots, numbers, headers, payment references, timestamps and owners before evidence disappears.

 Web form

POPIA security compromise assessment

Assess affected data, notification duties, accountable owners and deadline tracking after a breach.

 Form + checklist

Ransomware first-hour triage

Structure isolation, evidence capture, escalation, communications and recovery validation decisions.

 Excel + supplier form

Supplier security questionnaire

Review supplier access, data handling, backups, incident notice paths and contract follow-ups.

 Excel checklist

SMME quarterly cyber review

Track MFA, restore testing, access reviews, incident contacts, insurance and POPIA response readiness.

 Form + checklist

Business email compromise control

Record bank-detail changes, approver trails, suspicious indicators and finance action items.

 Excel checklist

Backup and load-shedding resilience

Check backup coverage, restore tests, UPS gaps, unprotected systems and remediation owners.

 Excel dashboard

Enterprise executive resilience review

Summarise top services, outage tolerance, recovery confidence, supplier dependencies and control gaps.

 Excel checklist

Identity and privileged-access review

Find high-risk accounts, stale access, missing MFA, suspicious rules and urgent remediation tasks.

 Excel register

Cloud shared-drive and SaaS access review

Review public links, external shares, leaver access, encryption gaps and logging coverage.

 Excel checklist

Public-sector service-owner review

Score readiness across owners, admin accounts, backups, contact lists and public messaging.

 Checklist

Household monthly cyber check

Review banking alerts, recovery contacts, updates, backups and recent scam messages as a household.

 Guided form

Data-breach personal response

Build an account response plan for reused passwords, monitoring steps and suspicious follow-up contact.

 Excel checklist

Sole-trader Friday admin review

Check MFA, backups, unpaid invoice threads, updates and client-data cleanup before the next week.

 Excel checklist

Detection-engineering coverage checklist

Map high-value attack paths, missing detections, data-source gaps and engineering backlog items.

 Excel scoring sheet

Vulnerability prioritisation worksheet

Prioritise remediation by exposure, exploitability, asset criticality and business-service dependency.

About this guidance

Built as a practical South African cyber safety portal

This sample site prioritises plain-language advice, local reporting routes and guidance for citizens, sole traders, organisations, public bodies and cyber teams. It links to official South African resources where people need formal reporting or regulatory support.