Skip to main content
010 447 2445Contact
Arke Technologies home
Request a hardware quoteTalk to us
Arke Technologies home
Rail tracks lead into a lit underground mine tunnel.

IT for state-owned entities: governance, security and systems

A state-owned entity (SOE) is an organisation that government owns or controls to run a public service or a commercial enterprise, accountable under the PFMA or the MFMA. Arke Technologies, based in Johannesburg, offers SOEs governed, secure and audit-ready IT: managed operations, cybersecurity, integration and data, reported to management and the board.

Talk to usSee how we report to boards

What is a state-owned entity?

In South Africa, "state-owned entity" is an umbrella term rather than one legal category. It covers companies and agencies that national, provincial or local government owns or controls, in sectors from electricity, rail and ports to broadcasting, development finance and water. What they share is public ownership, a board that answers to a shareholder (a minister, an MEC or a municipal council), and a duty to spend public money under strict financial rules.

The shareholder sets the mandate, usually through a shareholder compact, and the board is accountable for delivering it. That makes technology a board matter: the systems that bill customers, run operations and produce the annual financial statements are the systems the board must stand behind. This page is part of our IT services for government and the public sector.

Engineers in hard hats and hi-vis vests review drawings around a table.

The legal forms of an SOE

Three legal forms sit under the umbrella, and many entities are more than one at once.

FormWhere it is definedExamplesWho is accountable
State-owned company (SOC Ltd)Companies Act, 2008; the name ends in "SOC Ltd"Transnet SOC Ltd, the South African Broadcasting Corporation SOC LtdThe board, under the Companies Act and the PFMA
Public entityPFMA Schedule 2 (major public entities) and Schedule 3 (national and provincial public entities and government business enterprises)Schedule 2 lists the largest entities, such as Transnet and the SABC; Schedule 3 lists agencies and provincial enterprisesThe accounting authority, usually the board
Municipal entityMunicipal Systems Act and MFMAA metro's electricity, water or transport utilityThe board, overseen by the parent municipality (see IT for municipalities)
Workers in hard hats and hi-vis vests work together on an open site.

Why IT in a state-owned entity is different

  • The board carries the duty

    Under the PFMA the accounting authority must keep effective, efficient and transparent systems of financial and risk management and internal control. Those systems run on IT, so IT failures become governance failures.

  • Audit scrutiny

    The Auditor-General, or a registered auditor where the Auditor-General opts not to audit, tests IT general controls such as user access, change management and continuity, and the findings reach the annual report tabled in Parliament, a provincial legislature or a municipal council.

  • Critical infrastructure

    Many SOEs run power, rail, ports or water, where business IT meets operational technology. Assets can be declared critical infrastructure under the Critical Infrastructure Protection Act, 2019, so security design must treat the boundary between IT and operational systems with care.

  • Public procurement rules

    Every purchase must be fair, equitable, transparent, competitive and cost-effective (section 217 of the Constitution), and spending outside a contract's scope can become irregular expenditure.

  • Personal information at scale

    SOEs hold customer, employee and supplier records, so POPIA applies in full, and most are public bodies under PAIA, with a manual and an access-request process to maintain.

  • Continuity across provinces

    Systems must keep running through load-shedding, staff turnover and supplier changes, often across many sites.

Technology governance for the board: King IV Principle 12

King IV asks the governing body to govern technology and information so that they support the organisation in setting and achieving its strategic objectives, and its supplement for state-owned entities explains how the code applies to them, including the relationship with the shareholder. In practice, a board and its audit and risk committee should be able to see:

  • an approved technology and information governance framework and policy;
  • a current IT risk register, tied to the enterprise risk register;
  • security posture reported against a recognised framework (we work to the NIST Cybersecurity Framework, ISO/IEC 27001 and the CIS Controls);
  • tested backup and disaster-recovery results, not only a plan;
  • supplier and third-party risk, including who can reach which systems;
  • POPIA and PAIA compliance status and any incidents;
  • progress on the IT strategy against budget.

Where the framework, policy or risk register does not yet exist, our IT governance, risk and compliance service helps you build it. Our guide to King IV and technology governance explains the principle in more depth.

How Arke supports a state-owned entity

We work alongside an SOE's own IT division and take on the workstreams where it needs capacity or specialist depth. Every engagement follows the same path:

  1. Discovery

    We meet the CIO, IT and risk teams, and read the current audit findings, risk register and IT strategy.

  2. Assessment

    A baseline of infrastructure, security controls, systems and data flows, measured against the NIST Cybersecurity Framework and the CIS Controls.

  3. Proposal

    Scope, deliverables, assumptions and cost, written to fit your procurement process and evaluation criteria.

  4. Service-level agreement

    Response and resolution times, exclusions, reporting cadence, escalation and change control, agreed before work starts. Incidents are prioritised from P1 (critical outage) to P4 (low-impact request), with targets matched to the business impact of downtime; out-of-hours and weekend cover for operational sites is available by agreement.

  5. Onboarding

    Access granted through your approval process, monitoring and documentation baselined, runbooks written.

  6. Monthly service review

    Performance against the SLA, security posture, risks and improvements, reported to the IT executive with a named service lead accountable for each action.

What we deliver for SOEs

  • Managed IT operations

    An ITIL-aligned service desk covering incident, request, problem and change management, with automated monitoring that raises faults as tickets.

  • Integration and data reconciliation

    Connecting ERP, billing, HR and operational systems, reconciling records between them and reporting every exception.

  • Software development

    Web, mobile and reporting platforms, including offline-first apps for field teams, with code and documentation handed over.

  • Private cloud and data in South Africa

    Virtualised infrastructure on VMware, Hyper-V or Proxmox, with hardware sized and supplied through Server Hub, our hardware division, and equipment placed and managed in South African colocation data centres where you need it, so sensitive data stays in the country.

  • Private AI under governance

    Open-weight models deployed on-premises or in-country where they fit, every AI action logged and reviewable, and people making the decisions.

What the board and audit committee receive

Board reporting is part of the service, not an extra. Each month the IT executive receives the service report; each committee cycle, the audit and risk committee can receive a short summary built from it, covering the items in the King IV list above.

  • Monthly

    SLA performance, incidents, changes, restore tests and open risks, with a named owner for each action

  • Each committee cycle

    security posture against the NIST Cybersecurity Framework, IT risks mapped to the enterprise risk register, POPIA incidents

  • On request

    evidence for the auditors, from access reviews to change records

Risks in SOE technology programmes, and how we prevent them

RiskHow it shows upHow we prevent it
Supplier lock-inOnly one supplier can maintain a systemYou own the data, credentials, code and documentation; exit terms are written into the contract
Key-person dependencyKnowledge lives in one engineer's headRunbooks and change records kept current, so no system depends on one person's memory
Scope creep and irregular expenditureWork drifts beyond the contracted scopeChange control: nothing outside scope proceeds without a written variation approved through your process
Data exposurePersonal or operational data leaksLeast-privilege access, encryption in transit and at rest, approved and logged remote sessions
Repeat audit findingsThe same IT control failures return each yearControls built into daily operations and evidenced every month
Uncontrolled third-party accessUnknown parties can reach your systemsOne accountable team; everyone with access is bound by confidentiality and our security controls, and every remote session is approved and logged

Procurement fit and continuity

  • Arke Technologies (Pty) Ltd, registration number 2017/386810/07, VAT number 4750287957, a registered company since 2017.
  • Level 1 B-BBEE contributor, giving 135% procurement recognition (sworn affidavit available on request).
  • Company documents and a bank confirmation letter on request; standard bidding documents (SBD forms) completed when a bid requires them. Central Supplier Database (CSD) number and SARS tax compliance status available on request.
  • PAIA and POPIA requests go to our Information Officer at info@arketechnologies.com.
  • You can buy the way your policy requires: request for quotation, proposal and SLA, purchase order or formal tender response. See procuring from Arke, and SITA and government IT for how departments buy technology.
  • One contract and one accountable team, with runbooks and documentation kept current so the service survives staff changes on either side; at exit we hand over documentation, credentials and data in an orderly way.

Frequently asked questions

What is a state-owned entity? Show answer

A state-owned entity is an organisation that government owns or controls to deliver a public service or run a commercial enterprise. In South Africa the term covers state-owned companies registered as SOC Ltd under the Companies Act, public entities listed in PFMA Schedules 2 and 3, and municipal entities under the MFMA. Each has a board accountable to a government shareholder.

What is the difference between a state-owned company and a public entity? Show answer

A state-owned company is a legal form under the Companies Act, 2008, while a public entity is a category under the PFMA; many organisations are both. Transnet, for example, is a state-owned company and a Schedule 2 major public entity. The Companies Act governs its company-law duties, and the PFMA governs its financial management, reporting and procurement.

How do state-owned entities procure IT services? Show answer

State-owned entities procure IT through their own supply chain management policies, which must meet section 217 of the Constitution, the PFMA or the MFMA, and the preferential procurement rules. Lower-value needs go out as requests for quotation and larger ones as competitive bids, usually advertised on the government's eTender Publication Portal and the entity's own supplier portal.

What does King IV require of an SOE board on technology? Show answer

King IV Principle 12 requires the board to govern technology and information so that they support the organisation's strategic objectives. For an SOE that means an approved governance framework, IT risk on the enterprise risk register, reported security posture, tested continuity and oversight of suppliers. The King IV supplement for SOEs explains how the code applies to them, including the relationship with the shareholder.

Does POPIA apply to state-owned entities? Show answer

Yes, POPIA applies in full to state-owned entities, as it does to any organisation processing personal information in South Africa. An SOE must secure customer, employee and supplier records, have an Information Officer, and report security compromises to the Information Regulator and affected people. Most SOEs are also public bodies under PAIA, so they keep a manual and answer access requests.

Can Arke work alongside our in-house IT division? Show answer

Yes, and co-management is the model we propose for an entity with its own IT division: your IT division keeps ownership and strategy, and we take defined workstreams such as the service desk, security hardening, integration or a project. Responsibilities, escalation and change control are written into the SLA, and every ticket and change is visible to your team in the monthly service review.

How much does IT support for a state-owned entity cost? Show answer

Costs are set after an assessment: managed IT is priced per user per month, and project work outside the SLA is quoted per project. Published South African managed IT rates run from about R180 to R400 per user per month (matnet.co.za, September 2026). Sites, users, systems, security requirements and the depth of board reporting drive the price.

Talk to us about your entity's IT

Tell us about the systems, audit findings and governance reporting you need, and we will propose a scoped first step. Talk to us or email info@arketechnologies.com.

Talk to us