Companies Act: Cyber Governance

The Companies Act operates in a governance environment where directors are expected to exercise appropriate care, skill and diligence, while companies must maintain reliable statutory records and communications. In practice, that responsibility increasingly depends on trustworthy systems, accurate electronic records and secure digital channels. From a cybersecurity perspective, this makes external risk visibility, electronic record integrity, secure communications and governance-friendly evidence important parts of responsible company oversight.

Act no: 71 of 2008

Type: Mix (Rules-based with principle-guided governance)

Purpose: Provides for the incorporation, registration, organisation and management of companies in South Africa, aiming to encourage transparency, accountability, and corporate governance.

All companies incorporated or registered under this Act, including profit and non-profit companies, state-owned entities, private companies, and public companies. [Section 8]

Public companies, State-owned enterprises, Private companies, Directors and company officers, Auditors, and company secretaries.

• Director Care, Skill and Diligence: Directors must act with the degree of care, skill and diligence that may reasonably be expected of a person carrying out the same functions. [Section 76(3)(c)]
• Company Record Retention: Companies must keep required company records, including in electronic or physical format, as part of their statutory recordkeeping obligations. [Section 24]
• Company Record Integrity: Company records should be maintained in a way that supports accuracy, availability and responsible governance decision-making. [Section 24]
• Electronic Notices and Communications: Where documents or notices are transmitted electronically, they should be capable of being retained, retrieved or printed by the recipient. [Section 6(10)–(11)]

The Companies Tribunal may impose administrative fines for breaches, including non-compliance with record-keeping or disclosure requirements [Section 175].

False statements, reckless conduct, or interference with enforcement processes may attract criminal liability [Section 214].

The Commission may issue compliance notices or refer serious breaches to court [Sections 171–174].

Trust in an organisation and its brand can be significantly damaged, leading to the potential loss of customers, contracts, and licence eligibility.

Provides a safe, non-invasive external vulnerability scan of your public digital footprint, highlighting security weaknesses that may be visible to attackers.

• Director Oversight and Risk Governance: Helps directors and management identify externally visible cyber exposures that may create operational, reputational or governance risk. [Section 76(3)(c)]
• Company Record Security and Integrity: Identifies external vulnerabilities that could increase the risk of unauthorised access to systems used to store, access or manage company records. [Section 24]

Supports DMARC implementation and monitoring to help reduce domain spoofing risk, improve outbound email trust, and move safely towards enforcement.

• Electronic Communication Risk: Supports domain authentication and enforcement to reduce the risk of spoofed emails being sent using the company’s domain, supporting responsible oversight of digital communication and impersonation risk. [Section 76(3)(c)]

Provides a simple point-in-time Governance Record showing how the domain is set up to help protect against email impersonation, based on externally visible email authentication signals.

• Director Oversight and Risk Governance: Helps directors and management document domain-level email impersonation risk, supporting informed oversight of digital trust risks affecting the company. [Section 76(3)]

• South African Government: [Companies Act 71 of 2008 → link]
• Companies and Intellectual Property Commission (CIPC): [Companies Amendment Regulations 2023 – Beneficial Ownership → link]

(Links verified and active as of May 2026)