Information, data and records policies · 04
Information security and acceptable use policy
Describes the technical and organisational measures that make the POPIA security condition real, and what staff may and may not do with the organisation’s systems.
Describes the technical and organisational measures that make the POPIA security condition real, and what staff may and may not do with the organisation’s systems.
Cover access control and the joiner-mover-leaver process; passwords and multi-factor authentication; device and removable-media rules; encryption in transit and at rest; email and internet use; personal device use and what the organisation may do with a personal device it has enrolled; remote access; patching and backup with a tested restore; third-party and cloud service approval; and monitoring, with notice of monitoring given in advance.
Monitoring without prior notice is where an otherwise sound policy becomes evidence against the employer: interception and monitoring of communications must be dealt with squarely and disclosed before it happens. And a backup that has never been restored is not a backup: require a documented test restore at a stated interval, because that is the line an assessor will ask you to prove.
The law it sits under
What governs this instrument.
Section 19 of POPIA requires a responsible party to secure the integrity and confidentiality of personal information by taking appropriate, reasonable technical and organisational measures, and to identify reasonably foreseeable internal and external risks. Section 21 extends the same standard to operators by contract. The Cybercrimes Act 19 of 2020 sits alongside it.
Related pages, tools and documents
Where this instrument sits in the wider set, and the engagement that produces it.
Start here
Tell us the decision your organisation needs to make.
The first conversation is thirty minutes, confidential and free. You will leave it knowing which of our services you need and which you do not.