Private, independent industry initiative. Not a government body.

How we stay transparent
Cybersecurity Association South Africa Find credible expertise

For business leadership

Find credible expertise

You do not need to arrive with a technical brief. Tell us what is worrying you in business terms and we will help turn it into a clear question — then introduce you to member firms that do this work.

Dealing with an incident right now?

Do not use the form below, and do not wait for us. CSA does not provide incident response and is not an emergency service. Contact an incident-response provider directly — your existing IT or security supplier, your cyber-insurer’s incident line, or a specialist firm.

Remember: a breach of personal information must be notified to the Information Regulator under section 22 of POPIA; a crime should be reported to the South African Police Service; your bank and insurer usually have their own reporting deadlines. Once the immediate situation is under control, we can help you find a member firm for the follow-up work.

What we actually do

We are not IT security specialists and we do not carry out the work. Two things we do that most leadership teams find hard on their own:

  1. Turn a worry into a question. Most enquiries start as “I think we have a problem”. A provider cannot quote against that.
  2. Know who does this particular kind of work, and what standing they have.

Tell us what is worrying you

Please keep it general. Do not include confidential details, system inventories or specifics of a live incident — if the work goes ahead, the provider will arrange a secure channel for that.

What happens when you send this

  1. A person reads it first. CSA’s membership lead reads every enquiry — nothing goes to a provider automatically — and replies within one business day, with clarifying questions if we need them.
  2. We pass it to the right member firm — or firms. We choose member firms, in South Africa or the EU, that do this kind of work, and pass on your enquiry with the contact details you gave us. A firm in South Africa receives it under EU standard contractual clauses that we have signed with it.
  3. We tell you what happened: which firm or firms have your enquiry — or, if no member firm fits it, that too.
  4. The firm contacts you directly. From there you deal with each other without us, and you decide whether to work with them.
  5. The provider pays us, not you. We are paid a percentage by the member firm if work goes ahead; the firm may not raise its price to you because of it. We select from firms admitted and reviewed under our Provider Membership Standard, and we disclose the relationship — as we are doing here.
How big is the organisation? Required
Sector
What prompted this? Required
Which area, roughly? Required

“I do not know” is a perfectly good answer. It tells the provider the first conversation is about mapping, not quoting.

Timeframe Required
In your own words

Keep this general. Do not include passwords, system inventories, exploit details, confidential client material, health or other sensitive personal data, or more incident detail than we need to route your request. A person at CSA reads and screens every enquiry before anything is passed on.

Where should we reply? Email required

Your enquiry and contact details are used only to put you in touch with suitable member firms: CSA’s Membership Lead reads them and passes them to the member firm or firms we choose, in South Africa or the EU — firms outside the EU receive them under EU standard contractual clauses. We keep your enquiry for up to 24 months, or delete it sooner if you ask. The provider pays us a percentage if work goes ahead — you pay us nothing. Legal basis: our and your legitimate interest in the introduction you asked for; where you are yourself the contracting party, also the steps you asked us to take; you can object at any time. More, including your rights, in our Privacy Policy (section “When you ask us to find expertise”). By sending this form you confirm you have read that notice.

Membership is a trust signal, not a guarantee of performance and not a regulatory approval. CSA does not supervise the work, does not warrant its outcome, and is not a party to any contract you sign. See our Terms of Use.