Self-assessment
Cybercrimes Act Self-Assessment
11 yes/no questions on how the Cybercrimes Act touches your business: not committing cyber offences, protecting systems, preserving evidence, reporting, and the extra duties of electronic communications service providers and financial institutions. You get a score for each area and a list of gaps with what to do about each one.
1. Staying on the right side of the offences
1. Do your staff know that unlawful access to a computer system or data, interception of data, and interfering with data or systems are criminal offences?
(Cybercrimes Act Chapter 2)
2. Do your staff know they must not use or share passwords, access codes or software designed to break into systems, or use others' credentials without permission?
(Cybercrimes Act Chapter 2)
3. Do your staff know that sending messages that incite violence or damage to property, or threaten people, or share intimate images without consent, can be a crime?
(Cybercrimes Act Chapter 2, malicious communications)
4. Do you avoid cyber fraud, forgery and extortion in your own dealings, including fake invoices and misleading online messages?
(Cybercrimes Act Chapter 2)
2. Protecting systems and keeping evidence
1. Do you protect your systems with sensible security measures, such as access control, updates, backups and monitoring, so that you are not easily used to commit a crime?
(POPIA s19, good practice)
2. If you suffer a cyber attack, do you know to keep logs and other evidence, and not to wipe or alter affected systems before the evidence is secured?
(Cybercrimes Act Chapter 8, preservation)
3. Do you know that a court or the police can order you to preserve, disclose or hand over data in a cybercrime investigation, and who deals with such an order?
(Cybercrimes Act Chapter 4)
4. Do you keep a contact list for reporting incidents to the South African Police Service, the Information Regulator and your insurer?
(Cybercrimes Act, POPIA s22)
3. Reporting duties
The Cybercrimes Act puts a reporting duty (section 54) on electronic communications service providers and financial institutions that become aware their systems are involved in certain offences. Sources disagree on whether section 54 is yet in force, and one reported a 72-hour reporting window that I could not confirm. Check the current position. Answer Not applicable if you are neither.
1. If you are an electronic communications service provider or a financial institution, do you know the reporting duty and the offences it covers?
(Cybercrimes Act s54)
2. If you are covered, can you report to the South African Police Service within the time allowed and preserve information that may help them?
(Cybercrimes Act s54)
3. Even if you are not covered by section 54, do you report personal data breaches to the Information Regulator and the people affected, as POPIA requires?
(POPIA s22)
Sources
- Cybercrimes Act 19 of 2020 (gov.za)
- Cybercrimes Act section 54: obligations of electronic communications service providers (Acts Online)
- The Cybercrimes Act: cyber fraud and private sector reporting obligations (Cliffe Dekker Hofmeyr)
- Unpacking the Cybercrimes Act (Mondaq)
- Entities will be required to report cybercrime within 72 hours (Engineering News)
Turn these gaps into tracked tasks
Assign owners and due dates, keep the evidence, and show your progress to clients and auditors.