Ransomware
Encrypts billing, finance and file servers, then threatens to publish stolen data. Recovery depends on backups the attacker could not reach.
Cyber security for local government, departments and SOEs
Local government cyber security protects the systems that bill residents, pay suppliers and hold citizens' personal information. Arke Technologies, based in Johannesburg, assesses, hardens, monitors and supports those systems for municipalities, government departments and state-owned entities across South Africa, with POPIA-ready incident response and reporting that audit committees can use.
Why cyber security in the public sector is different
Cyber security in the public sector carries obligations a private company does not face. A municipality cannot switch off its billing system while it investigates, a department's breach becomes a public matter, and the Auditor-General's audits test IT general controls such as security management, user access, program change management and IT service continuity.
Budgets follow the medium-term budget cycle, procurement takes months, and smaller municipalities often run their whole ICT function with a small team. Government information security therefore has to be planned in stages, prioritised by risk and documented well enough to survive a change of supplier or staff. This page is part of our public-sector IT services.
Cyber security threats to government
The cyber security threats to government are rarely exotic. They exploit the same gaps as in any sector, with higher stakes, because citizen services and public money sit behind them.
Phishing and payment fraud
Look-alike domains that borrow "gov" or a department's name, fake supplier bank-detail changes and credential-harvesting pages.
Stolen and weak credentials
Shared administrator accounts, no multi-factor authentication, and former staff whose access was never removed.
Unpatched internet-facing systems
Old servers, VPN appliances and web applications running vulnerable programs.
Third-party access
Suppliers and contractors with standing remote access and no logging.
Attacks on citizen services
Website defacement and traffic floods that take portals offline.
Data exposure
Personal information in unprotected shares, mailboxes or backups, which triggers POPIA duties.
Government cybersecurity solutions we deliver
Our government cybersecurity solutions follow one sequence: find out what is exposed, fix the gaps that matter most, then monitor and improve. The full range is on our cybersecurity services page.
Security assessment and audit
Vulnerability scanning, configuration review, policy review and a ranked remediation plan.
Microsoft 365 and identity hardening
Entra ID governance, conditional access and multi-factor authentication.
Email security
Filtering, domain authentication (SPF, DKIM and DMARC) and impersonation protection.
Endpoint and ransomware protection
Managed endpoint protection and isolated, tested backups.
Monitoring and detection
Microsoft Sentinel SIEM deployment, with automated monitoring and alerts that raise tickets.
Penetration testing
Scoped, performed and retested by our team, with help to remediate what the test finds.
Incident response
Containment, recovery, evidence handling and the POPIA notification process.
People and governance
Security awareness training for staff and councillors, and a virtual CISO for policy, risk and committee reporting.
Government information security: the rules that apply
- POPIA. Section 19 requires appropriate, reasonable security safeguards for personal information; section 22 requires notice to the Information Regulator and the people affected when a security compromise occurs. See POPIA compliance.
- Cybercrimes Act. Makes unlawful access, interception and interference with data criminal offences; suspected cybercrime is reported to the South African Police Service.
- Minimum Information Security Standards (MISS). The baseline for handling classified information in the public service.
- PFMA and MFMA. Accounting officers answer for the systems of internal control, and ICT controls are part of them.
- King IV Principle 12. The governing body oversees technology and information risk. See King IV and technology governance.
- National response structures. Government cyber security agencies, including the National Cybersecurity Hub and sector computer security incident response teams, coordinate the national response to major incidents. Your incident plan names who contacts them; the accounting officer decides what to report, and we prepare the facts.
- Frameworks we work to. The NIST Cybersecurity Framework, ISO/IEC 27001, CIS Controls and MITRE ATT&CK. Arke is not certified to ISO/IEC 27001; we align controls with it. See ISO 27001 readiness.
How the service is governed
Each engagement runs under an SLA that fixes scope, response and resolution times, exclusions and on-site policy. Incidents are prioritised from P1 (a critical outage) to P4 (a low-impact request), with response and resolution targets matched to the impact of downtime on your services and agreed in your SLA; out-of-hours cover is available by agreement. Monitoring is automated and continuous, checking each computer every 15 minutes and logging faults as tickets. Human response follows the SLA.
You receive a monthly service review and report covering incidents, vulnerabilities closed, risks still open, changes made and decisions needed, written for an ICT steering committee or audit committee. Production changes go through change control, and a named service lead owns escalation.
Procurement, access and exit
- Level 1 B-BBEE contributor (sworn affidavit available on request), giving 135% procurement recognition.
- Company documents, a bank confirmation letter and completed SBD forms on request, with our CSD supplier number and SARS tax compliance status.
- One contract with Arke Technologies and one accountable team, working on our SLA clock. Every remote session is approved and logged, and everyone with access to your systems is bound by confidentiality and our security controls.
- Your logs, configurations, credentials and documentation stay yours, and we hand them over in full at exit.
See supplier compliance for the public sector, SITA and government IT for departments buying through the State Information Technology Agency, and IT for state-owned entities.
What government cyber security costs
Last reviewed: September 2026.
A security assessment is project work outside the SLA, quoted per project once we know the number of users, sites, servers and internet-facing systems. Ongoing monitoring and hardening then sit inside a managed IT agreement, priced per user per month after that assessment. For context, published South African managed IT rates run from about R180 to R400 per user per month (matnet.co.za, September 2026). Penetration testing is scoped separately; our penetration testing cost guide explains what drives it.
Managed security work our team delivers
Our ongoing managed IT and cybersecurity work for client organisations in South Africa covers Microsoft 365 hardening, Microsoft Sentinel SIEM deployment, Entra ID governance, Linux server administration and POPIA compliance management. See managed security operations.
