ADVISORY SERVICES
Expert-led compliance and cybersecurity, delivered through your brand
Cyberwin builds and delivers privacy compliance and cybersecurity services exclusively through channel partners. We bring the regulatory expertise; you bring the client relationship. All services are delivered in South Africa, under POPIA and PAIA. Every client-facing deliverable, from the assessment report to the board pack, is supplied under your brand.
R10 million
Maximum POPIA administrative fine that may be imposed in an infringement notice
10 yrs
Maximum POPIA sentence under section 107, for offences including obstructing the Regulator and failing to comply with an enforcement notice
Section 22
Breach notification – “as soon as reasonably possible” after discovery
3 yrs
PAIA section 77K, personal criminal liability for the head of a private body who refuses to comply with an enforcement notice
Every client that holds personal information carries this exposure, and most have never been assessed against it.
Service Portfolio
Two free starting points. Nine services that follow.
Every engagement begins with a free readiness check — security and privacy, or AI governance, or both. Neither is scored: each returns a written summary. The core services then assess, build and switch on the framework; implementation embeds it; managed services keep it that way.
Security & Privacy Readiness Check
Free 40-question review across security and privacy - a written summary of where the client stands, before anything is quoted
→ 40 questions across eight areas - security and privacy together, not privacy alone
→ About 15 minutes to complete, in plain English. “Not sure” is a valid answer
→ Covers accounts and access, devices, backups, email and awareness, documentation, POPIA and cyber insurance
→ About 15 minutes to complete, in plain English. “Not sure” is a valid answer
→ Covers accounts and access, devices, backups, email and awareness, documentation, POPIA and cyber insurance
→ Reviewed by a Cyberwin consultant - not scored automatically
→ A short written summary of where the client stands, which they keep either way
→ A 30-minute walkthrough, flagging anything that would fail an insurer or a customer questionnaire
→ No cost, no obligation. Not an audit or a compliance sign-off
→ A short written summary of where the client stands, which they keep either way
→ A 30-minute walkthrough, flagging anything that would fail an insurer or a customer questionnaire
→ No cost, no obligation. Not an audit or a compliance sign-off
AI Readiness & Governance Check
Free 28-question review of AI use, POPIA alignment and governance - a written summary of where the client stands, before anything is quoted
→ 28 questions across nine areas: AI usage, POPIA alignment, governance, vendors, IP, security, automated decisions, training and strategy
→ About 10 minutes to complete. “Not sure” is a valid answer — and often the most useful one
→ Surfaces shadow AI: the tools already in use that were never formally approved
→ Tests whether personal information is being entered into AI tools, and on what lawful basis
→ About 10 minutes to complete. “Not sure” is a valid answer — and often the most useful one
→ Surfaces shadow AI: the tools already in use that were never formally approved
→ Tests whether personal information is being entered into AI tools, and on what lawful basis
→ Covers s.71 automated decision-making and whether a human reviews outcomes that affect people
→ Reviewed by a Cyberwin consultant, not scored automatically — a written summary and the top three priority actions
→ No cost, no obligation, confidential. Not an audit or a compliance sign-off
→ Reviewed by a Cyberwin consultant, not scored automatically — a written summary and the top three priority actions
→ No cost, no obligation, confidential. Not an audit or a compliance sign-off
A1 CORE - POPIA Assessment, Build, Activation & Training
The full privacy framework - assessed, built, switched on and taught to your staff, in one engagement
→ ASSESS: as-is maturity assessment against all eight conditions, scored for annual repeat
→ Stakeholder interviews and data flow mapping - how information actually moves
→ Responsible party and operator position established for each entity and each flow
→ Risk-rated findings, board executive summary and a sequenced 90-day plan
→ BUILD: 6 documents at 1–25 users, 9 at 26–50, 16 from 51 - written from your gap register
→ Stakeholder interviews and data flow mapping - how information actually moves
→ Responsible party and operator position established for each entity and each flow
→ Risk-rated findings, board executive summary and a sequenced 90-day plan
→ BUILD: 6 documents at 1–25 users, 9 at 26–50, 16 from 51 - written from your gap register
→ Privacy policy and notices, s.17 processing record, DSAR procedure on current Forms 1-5
→ Security compromise procedure routed to the eServices portal, retention schedule, operator agreement template
→ ACTIVATE: Information Officer and Deputy IO registered with the Regulator
→ Client registered on the eServices breach portal; notices and PAIA Form 2 published, superseded forms retired
→ TRAIN: privacy awareness session for your staff, delivered live - POPIA in practice, not in theory
→ Security compromise procedure routed to the eServices portal, retention schedule, operator agreement template
→ ACTIVATE: Information Officer and Deputy IO registered with the Regulator
→ Client registered on the eServices breach portal; notices and PAIA Form 2 published, superseded forms retired
→ TRAIN: privacy awareness session for your staff, delivered live - POPIA in practice, not in theory
A2 CORE - Cybersecurity Assessment, Build, Activation & Training
The full security framework — assessed against what section 19 requires, built, handed over and taught
→ ASSESS: business email compromise exposure — MFA, mailbox rules and forwarding
→ Email authentication across every sending domain: SPF, DKIM and DMARC posture
→ Payment verification, system resilience, segmentation, endpoint, patching and mobile
→ Website, hosting, physical and document security, with a prioritised remediation roadmap
→ Email authentication across every sending domain: SPF, DKIM and DMARC posture
→ Payment verification, system resilience, segmentation, endpoint, patching and mobile
→ Website, hosting, physical and document security, with a prioritised remediation roadmap
→ BUILD: the security standards set written from the findings — six at 1–25 users, twelve from 26
→ Access and privileged access, authentication, backup and restore, patching, email security
→ Payment verification procedure and an incident response plan with named decision-makers
→ ACTIVATE: technical remediation specification handed over with an implementer briefing
→ Incident plan contacts confirmed, so the plan works the day it is needed
→ TRAIN: security awareness session for your staff, delivered live
→ Access and privileged access, authentication, backup and restore, patching, email security
→ Payment verification procedure and an incident response plan with named decision-makers
→ ACTIVATE: technical remediation specification handed over with an implementer briefing
→ Incident plan contacts confirmed, so the plan works the day it is needed
→ TRAIN: security awareness session for your staff, delivered live
Combined Assessment, Build, Activation & Training
A1 and A2 as one engagement — privacy and cyber, cross-referenced, one framework, one roadmap, one price
→ Everything in A1 and A2, run as a single engagement rather than two
→ Cross-referenced findings: where privacy exposure and security weakness compound
→ Cross-referenced findings: where privacy exposure and security weakness compound
→ One document control set and one unified 90-day remediation roadmap
→ Single executive debrief covering both positions
→ Priced 21% below A1 and A2 taken separately at 1–25 users, tapering to 10% at 200
→ Single executive debrief covering both positions
→ Priced 21% below A1 and A2 taken separately at 1–25 users, tapering to 10% at 200
PAIA Section 51 Manual
Section 51 manual, Deputy IO designation and Information Regulator compliance
→ PAIA compliance gap assessment
→ Records identification and access categorisation
→ Section 51 manual — fully drafted, tailored, and published as required
→ Records identification and access categorisation
→ Section 51 manual — fully drafted, tailored, and published as required
→ Deputy IO designation and Information Regulator registration support
→ Current Form 2 request handling and PAIA annual report submission
→ Current Form 2 request handling and PAIA annual report submission
I1 IMPLEMENT - POPIA Framework Implementation
Beyond the activation floor - embedding the framework in day-to-day operations and proving it works
→ Operator agreements issued to your highest-exposure suppliers, with a tracked return list
→ Retention schedule applied — the first disposal run supported and evidenced
→ Data subject request process stood up and dry-run end to end, on every inbound channel
→ Retention schedule applied — the first disposal run supported and evidenced
→ Data subject request process stood up and dry-run end to end, on every inbound channel
→ Privacy awareness training delivered, with a completion register the client can evidence
→ Formal adoption through client governance, not a document sitting on a drive
→ 30/60/90 checkpoints on residual actions, with owners and dates
→ Formal adoption through client governance, not a document sitting on a drive
→ 30/60/90 checkpoints on residual actions, with owners and dates
I2 IMPLEMENT - Cybersecurity Framework Implementation
The standards embedded and the technical changes verified - your team implements, Cyberwin supports and proves it was done
→ MFA and conditional access rollout supported; exceptions documented and approved
→ SPF, DKIM and DMARC progressed to enforcement in staged, monitored steps
→ A backup restore test witnessed rather than reported
→ Payment verification procedure embedded with the finance team
→ SPF, DKIM and DMARC progressed to enforcement in staged, monitored steps
→ A backup restore test witnessed rather than reported
→ Payment verification procedure embedded with the finance team
→ Incident response tabletop exercise with the named decision-makers
→ Verification re-test at 30 days, upgrading findings from attested to observed
→ Closure report and a residual risk register signed off by the client
→ Verification re-test at 30 days, upgrading findings from attested to observed
→ Closure report and a residual risk register signed off by the client
I3 IMPLEMENT - Combined Framework Implementation
I1 and I2 together, following A3 - priced 10% below the two taken separately
→ Everything in I1 and I2, sequenced as one programme
→ Privacy and security actions ordered against each other rather than competing
→ One adoption workshop, one tabletop, one verification pass
→ Privacy and security actions ordered against each other rather than competing
→ One adoption workshop, one tabletop, one verification pass
→ A single closure report evidencing what is actually live
→ The natural bridge from A3 into an M-series retainer
→ The natural bridge from A3 into an M-series retainer
M1 MANAGE - Annual Compliance Retainer
Continuous compliance assurance, retained as a monthly service
→ Quarterly regulatory update briefings on Information Regulator activity
→ Annual full reassessment benchmarked to the prior year
→ Incident response hotline - 4 hour Cyberwin response SLA
→ Annual full reassessment benchmarked to the prior year
→ Incident response hotline - 4 hour Cyberwin response SLA
→ Named Cyberwin account manager
→ Documentation maintenance, PAIA manual currency and annual report submission
→ Documentation maintenance, PAIA manual currency and annual report submission
M2 MANAGE - DIO Support & Advisory Retainer - South Africa
Your employee holds the s.56 Deputy Information Officer designation - Cyberwin carries the operational and advisory workload behind it
Your employee holds the s.56 Deputy Information Officer designation - Cyberwin carries the operational and advisory workload behind it
→ A qualifying employee of the client is formally designated as Deputy Information Officer by the client’s Information Officer, per the Regulator’s Guidance Note
→ Registration with the Information Regulator via the eServices portal, prepared and lodged by Cyberwin on the client’s instruction
→ ROPA maintained; impact assessments run on new systems and platforms before go-live
→ Section 51 manual kept accurate and publicly accessible
→ Registration with the Information Regulator via the eServices portal, prepared and lodged by Cyberwin on the client’s instruction
→ ROPA maintained; impact assessments run on new systems and platforms before go-live
→ Section 51 manual kept accurate and publicly accessible
→ Data subject and PAIA requests received, tracked and actioned within statutory periods
→ Breach assessment, containment advice, and the s.22 notification decision
→ Third-party contracts reviewed for compliant operator terms
→ Monthly compliance report written for a board or exco audience
→ Delivered as two sessions totalling approximately six hours per month
→ Breach assessment, containment advice, and the s.22 notification decision
→ Third-party contracts reviewed for compliant operator terms
→ Monthly compliance report written for a board or exco audience
→ Delivered as two sessions totalling approximately six hours per month
Why Partner with Cyberwin
Fully built service – nothing to develop.
Cyberwin has built, tested and refined every service in this portfolio. The assessments, the report formats, the managed service processes, the regulatory expertise — all ready to go. You don’t invest in building compliance capability; you inherit a complete, professional service that is ready to deliver on day one.
White-label delivery – your brand, our expertise.
All client-facing deliverables – assessment reports, compliance documents, PAIA Manuals, monthly board reports — are supplied under your brand. Your clients see your name. Cyberwin works behind the scenes. You maintain full ownership of the client relationship at every stage of the engagement.
One assessment opens a long-term account relationship.
Every Privacy Compliance Starter or Combined Assessment uncovers remediation needs that translate into downstream managed services: DSAR management, outsourced IO responsibilities, annual retainer. A single initial engagement creates a multi-year account development pipeline — without cold prospecting.
Trusted expertise in a complex regulatory environment.
POPIA, PAIA, the Information Regulator’s guidance notes, the IO framework — these are specialist areas that take years to develop in-house. Cyberwin’s team has that expertise ready. Your clients receive the quality of a specialist firm, delivered through the trusted relationship they already have with you.
Sign the Channel Partner Agreement
A straightforward one-page agreement establishing the partnership. No complex commitments – just a clear, professional framework for how we work together.
Complete partner onboarding
Half a day of self-paced e-learning covering POPIA, the service portfolio and how to position each engagement. Includes client conversation guides and a complete objection-handling reference.
Identify clients from your existing book
We work with you to identify the best-fit accounts. Cyberwin co-delivers the first three engagements alongside you — you observe the full process, build confidence in the service, and your clients receive an exceptional outcome.
Grow your compliance services practice
Each engagement deepens the client relationship and creates natural pathways to ongoing managed services. Cyberwin supports you at every stage — from the first conversation to the annual retainer renewal.
Ready to find out more?
Book a 30-minute partner briefing with the Cyberwin South Africa channel team. We'll walk through the services most relevant to your client base, answer your questions about the programme, and outline what the first 90 days as a Cyberwin partner look like.