Standard

Provider Membership Standard

Who can become a CSA Member Company, what members commit to, how we check and review them, and how introductions to members work.

Version 1.2 · Last updated 25 October 2026

1. What membership is, and what it is not

Provider Membership is for cybersecurity firms that want to contribute expertise, build credible visibility and meet defined business needs through CSA. It is a trust signal: it tells a business that the firm has been checked against this Standard and is reviewed regularly.

• Membership is not a regulatory approval, a certification, an accreditation or an endorsement.
• Membership does not guarantee the quality or outcome of a member's work.
• Payment does not buy favourable editorial conclusions, coverage or introductions.
• Member and commercial relationships are disclosed wherever they are relevant.
• Membership is a contract with CSA. "Cybersecurity Association South Africa" and "CSA" are a brand and platform operated by bodhi.style s.r.o., a company registered in the Czech Republic. Membership does not make a firm a member, owner or partner of an association or of the company, and gives it no vote.

2. What members receive

What the membership fee covers. Every member gets all of this, the same for every member, for as long as membership lasts:

• CSA Member Company status and a provider profile that shows the registration, insurance and certifications we have actually checked — and nothing we have not;
• use of the CSA member mark, in line with our Member Mark Guidelines;
• invitations to contribute expertise through interviews and educational content, subject to our editorial standards and Interview & Contributor Terms;
• full access to all current editorial content, plus future subscriber content when the subscription service launches.

What the membership fee does not buy: enquiries. Membership makes a firm eligible to receive enquiries. It is not a right to any. When a business sends us a defined need and a member fits it, we pass the enquiry on (see How introductions work) — and that member pays us only if work follows, through the referral fee in section 11. Nothing is owed on an enquiry that leads nowhere.

We do not promise any number or value of enquiries, publication opportunities or audience reach. The membership fee is not an advance on introductions, and it is not reduced or refunded because no introduction was made.

3. Who can apply

An organisation that provides cybersecurity services to organisations in South Africa and that:

• is a legally registered entity in South Africa or in a member state of the European Union;
• has provided cybersecurity services for at least two years;
• holds professional indemnity insurance appropriate to its services, of at least the minimum agreed in its membership agreement;
• complies with the data protection law that applies to its work — POPIA, the GDPR or both — and, if registered in South Africa, has a registered Information Officer and can show us the evidence;
• holds every licence, registration and professional qualification its services require;
• can demonstrate the capabilities, certifications and partnerships it claims.

An applicant outside the European Economic Area must accept the transfer safeguards for enquiry data set out in the membership agreement (the European Commission's standard contractual clauses).

4. What we check before admission

• company registration, directors and trading address, against the register of the Companies and Intellectual Property Commission (CIPC) or, for a firm registered in the EU, the company register of its country;
• the insurance certificate;
• each certification or accreditation claimed, with the body that issued it;
• references from two clients for comparable work, whom we contact ourselves (the firm gives us a reference's details only with that person's agreement);
• declared vendor affiliations, and reseller and referral arrangements;
• any regulatory sanction, relevant court finding or insolvency proceeding against the firm in the last five years, which the applicant must disclose;
• for a firm that asks to be listed as a direct contact for organisations under attack: that its stated availability is real, tested before it is listed.

We describe a firm as checked only once each of these checks has been completed and recorded. Admission is decided by CSA's Membership Lead within 20 business days of a complete application; an applicant may ask a Reviewing Director — a member of CSA's statutory body not involved in the decision — to reconsider a refusal. We may decline an application, and we give brief reasons; we do not decline on grounds that amount to unfair discrimination. A person who decides on an application or an introduction declares any interest in, or relationship with, the firm concerned and steps aside where it could matter.

5. What members commit to

Honest representation. Claim only the certifications, partnerships and capabilities the firm actually holds. Never suggest that CSA has certified, accredited, audited or endorsed the firm, a particular piece of work, a product or a price, and never misstate CSA's role or the firm's status with CSA.

Honest selling. No fear-led selling. Scope work to the client's actual need and explain it in plain language. Give clear written quotes. Tell the client about any vendor affiliation when recommending a product the firm resells. Never use a Radar item or CSA membership to mislead a prospect.

Handling enquiries. Contact the business promptly, within a time appropriate to the nature and urgency of the enquiry, or tell us straight away that the firm cannot take the enquiry on. Do not charge the client for the introduction, and do not raise the price quoted to an introduced client because of the referral fee. Do not pass the enquiry to anyone else without the client's agreement.

Data protection. Handle client information in line with POPIA and any other data protection law that applies, under a written agreement wherever the firm processes information on the client's behalf. Report security compromises as the law requires. Use an enquiry, and the contact details in it, only to respond to it and for any work that follows; delete it within twenty-four months if no work follows; report a breach affecting enquiry data to CSA within 48 hours; and accept the data protection terms of the membership agreement — for firms outside the European Economic Area, these include the European Commission's standard contractual clauses for personal data we pass on from the EU.

Keeping us informed. Tell us within ten business days of: a regulatory sanction, or legal proceedings relevant to the firm's services; a security compromise at the firm that affects clients; business rescue, liquidation or insolvency; a change of control; the loss of a certification, accreditation or insurance cover it relied on for admission; any change to its direct emergency contacts or their availability; and any change to its provider profile.

The member mark. Use the CSA member mark only as our Member Mark Guidelines allow, and only while membership is active. Remove it within ten business days when membership is suspended or ends.

Co-operation. Co-operate with complaint handling and periodic reviews, answer our reasonable questions truthfully, and report to us on the outcome of enquiries as the membership agreement requires.

6. Membership and our editorial work

Membership does not buy coverage, a favourable framing, the removal or priority of a Radar item, or a place in an interview. When a member firm is affected by a security event, we report it as we would for anyone else (Editorial & Independence Policy, section 8). Members may contribute expertise; their contributions follow our Editorial & Independence Policy and carry a disclosure.

7. How introductions work

Introductions are open only to member firms that have signed Annex C of the membership agreement; we pass no enquiry to a firm that has not. Either side can end that annex on 30 days' notice without the membership ending.

1. A business describes its need through the Find credible expertise form (or by e-mail).
2. CSA's Membership Lead reads it and, if needed, asks clarifying questions. Nothing goes to a provider automatically.
3. We pass the enquiry, with the contact details the business gave us, to the member firm or firms that fit it, and tell the business which firms have it — or, if no member fits, that none does. From then on the firm and the business deal with each other directly; the business decides whether to work with the firm, and CSA is not a party to any contract between them.
4. If work goes ahead within twenty-four months of the introduction, the member firm pays CSA a referral fee: 12 % of the value of that work for the first twenty-four months of it — once for a one-off project, and on each invoice for as long as an ongoing service continues inside that period, and on nothing invoiced after it. The rate is the same for every member and we do not negotiate it. Every time, we tell the business that the firm pays us and the business does not, and that the firm may not raise its price because of the fee.

We choose which firm or firms receive an enquiry from among the members that have signed Annex C, by their fit with the need (services, sector experience, size, location and timeframe), their capacity, feedback from earlier introductions, and fair rotation among equally suitable firms. We do not publish which members take introductions and which do not — the list of member firms shows no ranking or tier of any kind, and a business sends its enquiry to us, not to the firms. Every member pays the same fee and the same referral rate, so there is no fee level that could affect whether a firm receives enquiries. We do not promise any number of enquiries. We may ask the business, after an introduction, whether work went ahead and how it went; the answer is used in the member's review.

8. Periodic review

Every member is reviewed at least once a year. We re-check registration, insurance and claimed certifications, and look at feedback, outcome reports and complaints. A complaint, adverse reporting, or anything a member tells us under "Keeping us informed" can trigger a review at any time. The member supplies the evidence we ask for within ten business days. A review ends with one of four outcomes: membership continues, continues with conditions, is suspended, or ends. We describe a member as reviewed only once the recorded review has taken place.

9. Complaints about members

Anyone can complain about a member firm by writing to membership@cybersecurity-association.org. We ask the member to respond, decide, record the outcome and take it into account in the member's review. We do not resolve contractual disputes or award compensation. See also our Complaints & Corrections Policy.

10. Suspension and ending membership

We may suspend or end membership for a breach of this Standard or the membership agreement, misrepresentation, upheld complaints that are serious or repeated, failure to keep us informed, or non-payment. Unless waiting would put clients or the public at risk, we first tell the member our reasons and give it ten business days to respond. The member can ask a Reviewing Director to reconsider the decision within ten business days of receiving it. While suspended, a member receives no introductions, may not use the member mark and is shown as suspended or removed from the list; enquiries already passed to it may be reassigned.

11. Fees

We charge for two different things and price them separately.

For membership — paid by every member, whatever happens next

• Verification fee: ZAR 4 500, once, payable with the application and not refunded if the application is declined. It pays for the checks in section 4: the company register, the insurance certificate, every certification with the body that issued it, two client references we contact ourselves, and the sanction and insolvency searches. Where there is more to verify, the fee follows the work — ZAR 600 for each certification or accreditation beyond the first three, and ZAR 1 500 where the applicant has a group structure or more than one operating entity. We quote the total before the applicant pays anything.
• Annual membership fee: ZAR 25 000, invoiced in full and in advance for each membership year, whatever the start date. It is the same for every member, large or small — the profile, the member mark and the eligibility are the same, so the price is too.
• Founding members: the first twelve firms admitted before 30 June 2027 pay ZAR 12 500 for their first two membership years and no verification fee, in exchange for a named reference, one interview, and feedback to us after each introduction. The offer is open to every applicant admitted in that window. The standard fee applies from the third year and is stated in writing at signature.

For an introduction that turns into work — paid only then

• Referral fee: 12 % of the value of the work the member invoices to the business, for the first twenty-four months of that work. The same rate for every member; we do not negotiate it. Nothing is payable if no work follows, and nothing at all is payable by a member that has not signed Annex C.

All fees are exclusive of VAT. The membership agreement sets out the payment terms, the referral window and the fee period. Paying a fee does not buy introductions, coverage or a favourable editorial conclusion.

12. What we publish

We publish this Standard, our Member Mark Guidelines and the list of current member firms, with each firm's country and year of admission. We show a firm's logo, profile, incident-response contact or review status only once it is real, authorised and supported by the evidence this Standard requires. When a firm leaves or is removed, it is taken off the list; we do not publish the reason. We publish the names and stated availability of member firms' direct incident-response contacts where the firm has asked to be listed.

13. Changes to this Standard

We give members at least 30 days' notice of changes by e-mail, except where a change is needed sooner to protect clients, the public or legal compliance. A member that is materially and adversely affected by a change may end its membership before the change takes effect. The current version and its date are shown at the top of this page; the version attached to a firm's membership agreement governs until a valid change takes effect. Earlier versions are available on request.

Information about member firms and their representatives is handled under our Privacy Policy. "Business day" means a day other than a Saturday, Sunday or public holiday in South Africa or the Czech Republic.