Cybersecurity Risk, Resilience & Operational Protection · Technical White Paper
Cybersecurity Risk, Resilience & Operational Protection
A risk-chain model for cyber exposure, a right-sized control architecture, and a remediation sequence ordered by what has to be true before the next step is worth taking.
2 · Framing
An organisational risk, not an IT product category
A cyber event becomes material when it affects something the organisation depends on: cash flow, donor income, banking instructions, service delivery, confidential records, payroll, financial reporting, statutory obligations, stakeholder communications, or the availability of critical systems.
The same technical event therefore carries very different consequences in different organisations. A compromised mailbox used for low-risk internal messages is not the same business risk as a compromised finance mailbox that can request payment changes or correspond with funders.
2 · The risk chain
Four points where management can intervene
Scroll table sideways →
| Stage | What it covers |
|---|---|
| Threat | Phishing, credential theft, malware, ransomware, malicious insiders, opportunistic internet scanning, supplier compromise, accidental disclosure or misconfiguration. |
| Exposure | Weak authentication, public services, excessive privilege, unmanaged devices, insecure configuration, unpatched systems, poor supplier controls, untested recovery. |
| Control | MFA, segmentation, central endpoint management, secure mail, vulnerability management, monitoring, backup, access review and incident procedures. |
| Consequence | Fraud, diversion of funds, data breach, downtime, loss of records, operational disruption, recovery cost, regulatory notification and stakeholder harm. |
Some controls reduce likelihood, some reduce blast radius, some improve detection, and some reduce recovery time or data loss. Knowing which is which is what makes a limited budget go further.
2.1 · Purpose-led environments
NPOs are not a single security category
They should not be described as inherently insecure. They can, however, combine characteristics that need deliberate control: donor and beneficiary information, high-trust external communication, distributed staff or volunteers, reliance on third-party platforms, constrained specialist capacity, multiple funding relationships, and a strong need to keep administration proportionate to mission spend.
That combination makes prioritisation especially important. Security must protect mission delivery without becoming an uncontrolled technology cost.
The same principle applies to smaller commercial organisations. Limited internal security capacity raises the importance of clear ownership, managed services where appropriate, evidence from suppliers, and a short list of controls that are actually operated — rather than a long policy document disconnected from the live environment.
3.1 · Identity
The control plane that matters most
A stolen password can reach mail, cloud files, finance workflows and remote services without the attacker exploiting a single traditional network vulnerability. Awareness training helps users recognise suspicious requests; technical controls must assume some users will still click, disclose or approve something under pressure.
- MFA and strong authentication for remote, privileged and high-risk access.
- Conditional access or equivalent rules considering device, location and risk.
- Least privilege, separate administrator identities, and periodic access review.
- Secure mail filtering and domain-authentication controls, to reduce spoofing and impersonation.
- Out-of-band verification for bank-detail changes, urgent payment requests and other high-consequence instructions.
- Logging of identity events, and a defined process for investigating suspicious sign-ins.
3.2 · Endpoints
Installed is not the same as governed
Antivirus on each computer is not centrally governed endpoint security. Central management is what lets the organisation know whether protection is enabled, whether detection engines are current, whether policies are consistent, whether alerts are being handled, and whether a lost or compromised device can be acted on quickly.
That distinction is exactly what the assessment found in this environment: protection present, central operational view absent.
5 · Why awareness alone is not a strategy
The assessed environment had a phishing-simulation and awareness capability, and it was recorded as an existing control — then qualified rather than ticked.
Awareness reduces the likelihood that a user acts on a malicious request. It does not prevent, detect or respond to an attack that succeeds anyway, and it provides no evidence of either. MFA, mail security, identity controls, logging, verification procedures and incident response do different jobs, and none of them is substitutable for the others.
9 · Remediation sequence
Ordered by what must be true before the next step pays off
Stabilise ownership and emergency access
Confirm responsible executives, IT and security contacts, critical suppliers, privileged accounts, and a route to escalate a suspected compromise.
Protect high-consequence identities
MFA, privileged account separation, secure remote administration, and strong controls over finance and administrator mailboxes.
Establish asset and exposure visibility
Identify critical systems, public services, cloud applications, endpoints, data stores and supplier dependencies.
Close obvious high-risk exposure
Remove unnecessary public services, patch critical known vulnerabilities, correct dangerous misconfiguration, disable unsupported access paths.
Centralise visibility
Move from per-device administration to central policy, health and alerting; collect priority identity and system logs.
Assure backup and recovery
Define recovery requirements, protect backup administration, and perform restoration testing for critical systems and data.
Build routine operations
Recurring scan, triage and retest cycles plus alert handling, with ownership and management reporting.
Exercise incident response
Test account-compromise, ransomware and personal-information breach scenarios, then update procedures from what the exercise showed.
7 · Legal context
The obligation exists whether or not it is resourced
POPIA requires appropriate, reasonable technical and organisational measures to secure personal information, together with an ongoing process of identifying risks, maintaining safeguards, verifying that they are effectively implemented, and updating them where necessary. Section 22 places notification duties on the responsible party where a qualifying security compromise occurs, and the Information Regulator operates an eServices channel for reporting.
The Cybercrimes Act 19 of 2020 criminalises core forms of unlawful access, interception and interference.
Together these reinforce the practical point this assessment makes: controls need to be evidence-based, incidents need to be detectable, and the response process needs to be documented before it is needed.