03 · Secure sign-in & cloud
MFA for everyone
The riskOne leaked password opens up email, files and client data.
The fixMFA enforced on every account, with single sign-on for the VPN and your cloud apps. One secure login for everything.
POPIA Reality Check · online
Would you pass if a breach happened tomorrow?
POPIA already applies to your business, and every breach must be reported to the Information Regulator and the people affected. These are the 7 questions you would face. Answer them now, and see straight away where you stand and what to sort out first.
- 7 questions
- 3 minutes
- Free
- Instant score
First, a little about you.
Two taps, so the result fits your role.
Your role
Number of employees
Pillar 03Secure sign-in & cloud
Does everyone sign in with MFA, including email and remote access?
Stolen passwords are still the easiest way in, and a hacked mailbox full of client data is a reportable breach.
Pillar 04Backups & ransomware recovery
Are your backups immutable and off the network, and was a restore tested in the last six months?
Ransomware goes after the backups first. Without them, a breach becomes weeks of downtime.
Pillar 02Device & mail protection
Does every laptop and server update automatically, and are all your security licences current?
Most attacks use holes that were patched long ago, and a lapsed licence quietly switches protection off.
Pillar 01Firewall & 24/7 monitoring
Is your firewall monitored 24/7 by someone who acts?
Attacks happen at night and over weekends. An alert nobody reads stops nothing.
Roles & accountability
Do you know who reports a breach to the Regulator, and how?
POPIA requires you to notify the Information Regulator and the people affected as soon as reasonably possible after a breach.
Roles & accountability
Is your Information Officer registered, and does your team know who it is?
Every business has an Information Officer, by default the head of the business, who must be registered with the Information Regulator.
Pillar 01Firewall & 24/7 monitoring
Is it impossible for staff to paste client data into free AI tools?
Client data pasted into a free AI tool has left your control, and that can count as a breach.
Your foundation is strong. Now make sure you can prove it.A solid start, but one or two doors are still open.There are critical gaps in your security baseline.
Your score is instant, no details needed.
Your result · 0/7
Your foundation is strong. Now make sure you can prove it.A solid start, but one or two doors are still open.There are critical gaps in your security baseline.
This is exactly what the Regulator and your customers want to see. The next step is being able to prove it: documentation and a tested recovery procedure.The basics are there. The open points are known gaps, and they can be closed within about 90 days without stopping your work.If a major client or the Regulator asks for proof tomorrow, you are exposed. The good news: these are known gaps, and this is exactly where the quick wins are.
As a director, you are accountable for these answers. Make sure there is proof behind them, not just a tick.As the IT person, you often know exactly where it pinches. We are the senior layer behind you: you keep the day-to-day, we take the security and the escalations.For you, predictability counts. A predictable monthly fee, and you can start with the pillar that matters most.
Full result
See your full result.
Where you stand on each pillar, your biggest gaps and what fixes them. Right here on screen, in plain language.
By pillar
The four pillars cover the technology. Roles and accountability sit with management.
01Firewall & 24/7 monitoring·
02Device & mail protection·
03Secure sign-in & cloud·
04Backups & ransomware recovery·
Roles & accountability·
Where to start.
04 · Backups & ransomware recovery
Immutable, tested backups
The riskWithout a tested, immutable backup, one attack can stop the business for weeks.
The fixImmutable backups off the network, with a restore test we document as proof.
02 · Device & mail protection
Updates and licences
The riskOne forgotten laptop or expired licence is an open door to the whole network.
The fixAutomated patching and ESET protection on every workstation and server, with licences tracked for you.
01 · Firewall & 24/7 monitoring
Firewall monitored 24/7
The riskA break-in can go unnoticed for a long time, while client data walks out of the door.
The fixA FortiGate firewall monitored 24/7 by our Network Operations Centre, with a 15-minute response on critical outages.
Roles & accountability
Breach reporting
The riskWithout clear roles, the first days are lost working out who does what, while the clock runs.
The fixClear roles: who reports, to whom and how fast. We detect, escalate and supply the technical details for the report.
Roles & accountability
Registered Information Officer
The riskIt is one of the first things the Regulator looks at after a complaint or a breach.
The fixYour Information Officer registered and briefed. This one sits with the business; we walk through it with you in the IT review.
01 · Firewall & 24/7 monitoring
Client data out of free AI
The riskStaff mean well, but one pasted spreadsheet can put client information outside your control.
The fixOne approved business AI tool, free AI tools blocked at the FortiGate firewall, and files with personal data stopped before they leave.
Seven times yes. Well done.
The Regulator and your customers ask for proof, not a tick. Email us your score or book a coffee, and we see together whether your answers hold up.
Want to know what to fix first?
Email us your score or book a quick coffee chat. You get a clear, no-obligation starting point.
Why these questions
How a breach becomes your problem.
POPIA applies to every business that holds personal information about clients, suppliers or staff, whatever its size.
- 01You hold client and staff data
- 02A breach: phishing, ransomware or a lost laptop
- 03You must report it to the Information Regulator
- 04No proof of security? Fines up to R10m
R17m
Average ransomware recovery cost in South Africa, before a single rand of ransom is paid.
Sophos 2026R10m
Maximum administrative fine under POPIA. On top of telling every affected client.
POPIA, section 109R5m
What the Information Regulator fined the Department of Justice after its security licences lapsed.
Information Regulator, 2023Sources: Sophos (2026), POPIA sections 19, 22, 55 and 109, Information Regulator (2023). This is not legal advice.
Questions about the check
Good to know.
Do I have to fill in my details?
Not for your score: you see that straight away. For the full result per pillar, with your biggest gaps and what fixes them, we ask for your name, company and email. We never share your details with anyone, we process them in line with POPIA, and you only get updates if you choose to.
Does this replace a POPIA audit?
No. It is an honest first measure, based on the questions you would face after a breach. For the full picture there is the free 60-minute IT review, where we look at your actual setup.
Does POPIA apply to my business?
Almost certainly. POPIA applies to any business that processes personal information about clients, suppliers or staff, whatever its size.
What if I score below 7?
Then you know where to start. Email us your score or book a coffee, and you get a clear, no-obligation starting point. No sales pitch.
About youQuestion {n} of 7Your scoreIn placeNeeds attentionOpen doorNoPartlyPOPIA Reality Check score {s}/7 · quick coffee chatHello,I did the POPIA Reality Check online. This is my score. I would like to hear what the best first step is, by email or over a coffee.Score: {s}/7Role: {r}Employees: {z}Open points:No open points.My result: {u}Kind regards,Our POPIA Reality Check resultI did the POPIA Reality Check. Our score: {s}/7. See the result, and take it yourself too:Fill in your name, company and email.
IT review
Book your no-obligation IT review.
Whether you want to tidy up scattered IT, secure your network or bring everything under 24/7 oversight, we'd be glad to talk it through.
- 01
Introduction and POPIA check, 30 minutes
We listen to where things stand and work out how we can help.
- 02
A review that fits your setup
60 minutes on site or in a cloud session, plus an optional 7-day passive traffic check. You get clear, practical advice either way.
- 03
A bespoke proposal
Predictable monthly costs, a clear point of contact and a start date.
We take on a limited number of new clients at a time. Request your review early.
Duo IT SolutionsCape Town · South Africa
Email us directly
dante@duo-it.co.za