Compliance & Governance

No, and neither can any other IT provider. POPIA compliance is a legal determination that covers far more than technology — how you collect information, what you tell people, your contracts, your retention, your processes. What we can do is align the technical controls, help you evidence them, and support the parts of your obligations that are genuinely IT-related. Your legal advisor determines whether you are compliant. We would rather be clear about that boundary than sell you comfort.

Something much smaller than the word suggests. Knowing what assets you have, who has access to what, which decisions were taken and why, what risks you have accepted deliberately, and reviewing that periodically. Not a committee, not a binder nobody opens — a short set of records that someone owns.

Yes, and this is one of the most common reasons businesses come to us. The questionnaires are broadly similar because they draw on the same frameworks, so the underlying work carries across. Once the controls and documentation exist, answering the next one stops being a crisis.

A CIS assessment measures your technical controls against a specific framework and tells you what to fix. Governance is the layer above it — who decides, what gets recorded, what gets reviewed, and how you show a third party that any of it happened. Most businesses need both, and the assessment is usually the sensible starting point.

You need the ones you will use and can evidence. A policy nobody follows is worse than none, because it documents a standard you are visibly failing. We would rather help you produce a small number that reflect how the business genuinely operates than a library that exists to be pointed at.