47 ready-to-run tabletop exercises aligned to global standards — IEC 62443, NIST SP 800-82, NIS2, NERC CIP — and layered with Southern African regulatory context (POPIA, NERSA, SADC frameworks). Purpose-built for Mining, Energy, Finance, and Water sectors.
Whether your HQ is in Johannesburg, London, or New York — these are the global standards that govern OT/ICS cybersecurity best practice. Every exercise maps to them, so Southern African operations meet the same bar as global counterparts.
The global benchmark for IACS security — mandatory reference for mining, energy, and manufacturing OT environments. Scenarios map to security levels and control domains.
NIST's definitive guide for OT security. Threat scenarios reference Rev. 3 controls across all Southern African industrial control system sectors.
Energy sector exercises align to NERC CIP — the same standards applied by multinationals with South African and SADC power generation assets.
All 47 exercises align to CISA CTEP objectives with CPG 2.0 framework mapping and structured After Action Report export for regulatory defensibility.
European multinationals operating in Southern Africa must comply with NIS2 across all sites. Pro plan includes NIS2 compliance filters for essential entities.
Financial institutions with EU exposure apply DORA globally. Southern African banking subsidiaries benefit from DORA-aligned ICT risk and incident scenarios.
Exercises cover all CSF 2.0 core functions: Govern, Identify, Protect, Detect, Respond, and Recover — the universal baseline applied across SADC member states.
Scenarios support ISO/IEC 27001 Annex A controls — widely required by South African financial sector regulators and multinational corporate governance standards.
Global standards form the foundation — Southern African regulations add the local layer. Your teams practice in context of both, producing evidence defensible to every regulator from Pretoria to Harare.
South Africa's primary data protection law. Exercises cover POPIA notification obligations, responsible party duties, and incident response requirements for critical infrastructure operators.
NERSA governs cybersecurity requirements for electricity, piped gas, and petroleum pipelines. Energy sector scenarios address NERSA compliance for licensees operating critical infrastructure.
The SADC framework aligns member states (ZA, ZW, BW, ZM, MZ, NA) on critical infrastructure protection. Exercises reference cross-border incident notification and coordination requirements.
South Africa's Cybercrimes Act and the National Cybersecurity Policy Framework define incident reporting obligations for operators of critical information infrastructure.
Mining conglomerates, energy multinationals, and financial groups with SADC operations don't choose between IEC 62443 and POPIA — they answer to both. Generic exercises address neither adequately.
Every scenario in the platform maps to IEC 62443, NIST SP 800-82, NERC CIP, and ISO 27001. Southern African teams run the same quality exercises as European counterparts — with local POPIA, NERSA, and SADC framing included.
Scenarios designed for the actual control systems, threat actors, and regulatory regimes facing SADC critical infrastructure operators.
From platinum mine SCADA attacks to Eskom-style grid disruption exercises — scenarios grounded in the real threat landscape facing Southern African OT operators.
Exercises explicitly reference POPIA notification timelines and NERSA reporting obligations alongside global IEC 62443 and NIST controls — dual-compliance in every session.
Full support in English and Portuguese — covering South African, Zimbabwean, Zambian, and Mozambican teams across the SADC region in their operational language.
From deep-level mine control system attacks to power grid disruptions — scenarios that reflect the threats facing SADC operators and the regulators they answer to.
An adversary compromises ventilation and winding control systems at a gold mine. Safety interlocks are at risk. IEC 62443 Security Level 3 response procedures are tested.
A coordinated attack on energy management systems triggers cascading load shedding. NERSA reporting obligations and SADC cross-border coordination are tested simultaneously.
A major OT breach at a Johannesburg HQ affects data of South African and EU citizens. POPIA 72-hour notification and NIS2 reporting run simultaneously under board scrutiny.
Tell us about your organization. We'll map the platform to your POPIA, NERSA, and global compliance requirements and show you exactly how exercises serve your sector.
Join critical infrastructure teams across SADC running professional tabletop exercises aligned to global standards and local regulation.