Navigating Cybersecurity Regulation in Africa

In an era where digital threats are on the rise, the role of cybersecurity service providers (CSSPs) has become paramount for businesses across Africa. From banks to telecommunications, organizations are increasingly relying on CSSPs to safeguard their most sensitive information. But as their powers expand, so do the questions regarding the competence, accountability, and regulation of these service providers.

When you entrust a cybersecurity firm with access to your networks and data, how can you be sure that they are qualified to handle this responsibility? And when breaches occur, who is held liable? These pressing concerns underscore the need for a well-defined regulatory framework for CSSPs in Africa.

"The unsaid question is: who secures the securers?"

As the CyberM8 Initiative NPC discusses, simply saying "yes" or "no" to regulation does not suffice. There are compelling arguments for accountability in the cybersecurity space, particularly due to the critical nature of the information being handled. Nevertheless, there are concerns that strict regulation could stifle innovation and burden smaller cybersecurity companies, which are vital for Africa's digital ecosystem.

The Public Interest Principle

The Private Security Industry Regulatory Authority (PSiRA) has expressed that there is a need for oversight but emphasizes a tailored approach to cybersecurity regulation instead of merely replicating traditional security frameworks.

PSiRA states: “Cybersecurity service providers are increasingly entrusted with access to sensitive information, critical systems and digital infrastructure. This creates a strong public-interest case for appropriate oversight, particularly in relation to competence, ethical conduct, accountability, vetting and minimum professional standards.” They further argue that regulation must recognize the dynamic nature of the sector, advocating for a framework that nurtures innovation while protecting consumers and national interests.

This approach emphasizes that the conversation about regulation should not be one-dimensional. Questions of how, what, and who are equally vital. With the rapid digital transformation, existing laws and regulations in South Africa — such as the Cybercrimes Act and the Protection of Personal Information Act (POPIA) — may not adequately ensure the competency of CSSPs.

Identify the Gaps

According to Prof Sizwe Snail ka Mtuze, a cyber-law expert from Snail Attorneys, South Africa’s legal framework falls short when it comes to CSSPs. He argues: “The National Cybersecurity Policy Framework (NCPF), now approximately 15 years old, requires modernization. While the Cybercrimes Act addresses unlawful conduct and POPIA establishes obligations, neither sets minimum competency requirements for CSSPs.”

This gap signifies a pressing need for a risk-based, proportionate framework that establishes professional standards and ensures accountability, especially for high-risk services such as penetration testing and incident response.

Effects on Small and Medium Enterprises

At the heart of this regulatory conversation is the potential impact on small cybersecurity companies. CyberM8 aims to bolster small, medium, and micro enterprises (SMMEs) in this sector, as they are the backbone of Africa's digital economy. The challenge lies in ensuring that regulations do not impose excessive burdens that favor large, established firms over emerging ones.

Imagine a start-up with five skilled professionals capable of offering essential cybersecurity services but suddenly facing costly licensing fees and complex compliance requirements. Such scenarios could lead to monopolization in the industry where only large corporations thrive, while smaller, innovative companies fail to take off.

The critical question becomes one of balance: Should regulations vary depending on the risk posed by different cybersecurity functions? For instance, does a consultancy firm conducting basic cyber-risk assessments require the same oversight as a company executing penetration tests on government infrastructure?

Insights from Mozambique

The discourse on cybersecurity regulation spans beyond South Africa. For instance, Mozambique is crafting a more explicit regulatory framework for cybersecurity providers. The Instituto Nacional de Tecnologias de Informação e Comunicação (INTIC) is leading this charge with initiatives that include licensing CSSPs and setting technical standards.

“Mozambique is developing its legal and regulatory framework for building trust on cyberspace. The Cybersecurity Law introduces the registration and licensing of Cybersecurity Service Providers.”

Moreover, INTIC emphasizes international cooperation, participating in regional and global networks to enhance cross-border cybersecurity collaboration. This approach raises critical questions about how varying regulations can coexist in a borderless digital environment.

Cross-border Cybersecurity Regulations

Consider a cybersecurity firm based in Johannesburg that monitors clients in Mozambique, Botswana, and Kenya. Which country's regulations apply? What happens when licensure discrepancies arise? With a potential for multiple regulatory regimes across Africa, the regulatory landscape could become fragmented, hampering effective cybersecurity interventions.

As African nations push towards digital sovereignty while fostering interconnectedness within the regional digital economy, discussions must encompass common standards and professional competencies across borders.

Call for Dialogue at the Africa Cybersecurity Indaba

The Africa Cybersecurity Indaba, spearheaded by CyberM8, aims to convene stakeholders to address these multifaceted regulatory challenges. This platform will allow various parties — from government representatives to cybersecurity practitioners — to engage in meaningful discussions about the future of cybersecurity regulation.

Scheduled for October 2026 in Johannesburg, this pivotal event is expected to attract over 750 key players from across the continent. While consensus may not be achievable, the value of dialogue lies in ensuring those affected by regulations have their voices heard.

Africa requires robust cybersecurity measures alongside a nurturing environment for emerging cybersecurity providers. Achieving this balance could shape the continent's digital future. Ultimately, the question, “who secures the securers?” brings to light the intricate challenges surrounding cybersecurity regulation and the collaborative effort essential for effective solutions.