POPIA security safeguards: what sections 19 to 22 require
The four security duties, operator contracts, breach notification and what enforcement looks like.
6-page PDF · free with your work email
Two programmes
One for the people who investigate. One for the people who decide.
For technical teams
CSILab: hands-on investigation labs
Analysts work in a real security console, investigate the alerts from a live-style incident, rebuild what happened and write it up as an incident report.
- Realistic scenarios, from a web exploit that ends in ransomware to a database break-in
- Every conclusion has to be backed by evidence
- Each stage mapped to the MITRE ATT&CK framework
For leaders
Crisis simulation for executives
Your leadership team faces a ransomware attack as it unfolds and decides together what to do at each turn.
- Live voting and scoring on every decision
- Real business trade-offs: pay, restore, disclose, communicate
- A debrief that feeds straight into your own response plan
CSILab
How an investigation lab runs.
- 01BriefAnalysts receive the scenario and the questions they must answer.
- 02InvestigateThey work the alerts in a real security console, as they would in a live incident.
- 03ReconstructThey rebuild the attack step by step and map each stage to MITRE ATT&CK.
- 04ReportThey write it up as an incident report, scored on evidence, not assumptions.
Scenario
Web exploit to ransomware
A public-facing web application is exploited and the attack ends in ransomware. Analysts trace every step back to the first foothold.
Scenario
Database break-in
An attacker reaches a database of customer records. Analysts work out how they got in and what was accessed.
Prove it. Don't assume it. Every conclusion in a CSILab report has to be backed by evidence from the logs.
Crisis simulation
How an executive simulation runs.
- 01The attack beginsYour leadership team receives the first signs of a ransomware attack, as they would on a real morning.
- 02Decide togetherAt each turn the team votes on what to do, live.
- 03Face the trade-offsPay or restore, disclose or wait, and what to tell clients, staff and regulators.
- 04DebriefScores, decisions and lessons, fed straight into your incident response plan.
Built for South African rules. Teams rehearse the notifications that matter here: the Information Regulator under POPIA section 22 and, for financial institutions, the 24-hour notice under Joint Standard 2 of 2024.
Who it's for
From the security console to the boardroom.
IT teams
Build the skills to spot, investigate and contain an attack.
Security analysts
Sharpen investigation and reporting on realistic incidents.
Executive teams
Rehearse the decisions you will face in the first hours of a breach.
Business schools
Bring a live cyber crisis into leadership and MBA programmes.
Go deeper
Read the executive briefing.
A plain-language PDF for your board, with sources. Free with your work email.
Next step
Plan a training simulation.
Tell us who you'd like to train and we'll suggest the right lab or simulation.
Prefer email?
hello@enc0ded.africa