We develop Business Continuity Plans that cover the full range of disruption scenarios — from system outages and cyberattacks to power failures and natural disasters. Our BCPs define clear roles and responsibilities, recovery time objectives, escalation procedures, and communication protocols. We write them in plain language so that the people who need to act in a crisis can do so without confusion. Every BCP we produce is tested before we hand it over.

Technology risk does not disappear on its own — it grows when it is ignored. We conduct structured ICT risk assessments to identify vulnerabilities in your systems, processes, and third-party dependencies. We then work with your team to develop and implement a Risk Management Plan that prioritises threats by likelihood and impact, assigns ownership, and tracks mitigation actions to completion. Our approach aligns with COBIT, ISO 31000, and the requirements of the PFMA for public sector clients.

A security incident in a government department or financial institution can have consequences that go far beyond the technical. We help organisations build ICT security governance frameworks that cover data protection, access control, incident response, and audit readiness. This includes drafting and reviewing acceptable use policies, data classification frameworks, and security standards aligned to the Protection of Personal Information Act (POPIA) and applicable national guidelines. We also conduct security audits to assess whether your current controls are actually doing what they are supposed to do.

Business continuity and disaster recovery are related but distinct. Where a BCP covers how your organisation keeps functioning during a disruption, a Disaster Recovery Plan (DRP) focuses specifically on how your ICT systems and data are restored after a major incident. We develop DRPs that define recovery priorities, data backup strategies, system restoration sequences, and test schedules. We pay particular attention to mission-critical systems — the ones your organisation simply cannot operate without.

A plan that has never been tested is a plan that may not work. We design and facilitate BCP and DRP testing exercises — from desktop walkthroughs with management teams to full simulation drills that test your actual recovery capability. After each exercise, we produce a findings report with clear recommendations to close the gaps identified. Regular testing is also a compliance requirement for many organisations operating under the PFMA and sector-specific regulations.