Do The ICT Basics Before Chasing the Hype

Introduction

We often get sucked into the hype of the next shiny thing. We are constantly sold on the critical importance of a new tool because of its advanced capabilities, machine-learning features, or market reputation.

But more often than not, local organisations struggle with implementing these products. Why? Because they do not have the fundamental basics in place to effectively manage and secure their core business operations.

Before you look at automating workflows using AI, or purchasing a new piece of security software, you need to ensure your ICT Governance, Risk, and Compliance (GRC) is sorted. Any new tech you bring into the business must add clear value by bridging an already identified gap. If your foundation is weak, adding complex software just creates a more expensive, chaotic environment.

How Grounded is Your Security?

If an auditor, a major client, or a regulator walked into your office today and asked you the following questions, how confidently could you answer?

• Asset Management: Can you provide an up-to-date inventory of every single laptop, mobile, server, and smart IoT device that connects to or stores your business data?
• Access Control: What specific protection measures are in place to ensure that information remains confidential, that only authorised users have access, and that data cannot be maliciously modified or leaked?
• Policy & Readiness: Where are your current acceptable use, information security, business continuity, and incident response policies?
• Risk Awareness: Can you show me your documentation from last quarter detailing your top 10 risk exposures and exactly what you are doing to mitigate them?
• Accountability: Who, by name, is ultimately responsible for the protection of your business information?

If you do not have an internal champion who actively owns this, ensures proper documentation, and keeps it updated, you should not be distracted by shiny new tools.

Changing the Conversation

How do you get started if you aren't the sole decision-maker? If you are a department head or a technical lead who sees these gaps, but leadership keeps pushing you toward trendy tools because they think the basics are "good enough", you need to change your presentation strategy.

Do not pitch technical features. Highlight business consequences.

Frame the argument around structural integrity: the current foundations are simply not strong enough to hold. Ask leadership a direct question:

"Do we want to spend our limited budget on industry trends and hope for the best, or do we secure our foundations so we are resilient when a threat actually hits?"

Propose a dedicated pause: let’s take the next quarter to focus entirely on the foundations.

The Blueprint for a Strong ICT Foundation

For South African small and medium businesses, getting the basics right means establishing a clear, layered framework. If your organisation has already adopted Enterprise Risk Management (ERM), ICT and cybersecurity must be tightly integrated into it, rather than treated as an isolated IT problem.

Building this base requires three distinct layers:

1. Leadership must provide the visible prioritisation, mindset, and energy required to fix the basics. They need to have the appetite to support a culture of compliance. This layer establishes the high-level policy on the standards that must be maintained and dictates how future technology choices will be evaluated
2. Risk Management. This is your structured, detailed playbook for identifying, assessing, and dealing with technology-specific risks. It moves your business away from guesswork and ensures you handle threats using standard risk treatment principles:
   • Mitigate: Apply controls to reduce the risk.
   • Transfer: Pass the risk on, such as through cyber insurance.
   • Avoid: Change the process to eliminate the risk entirely.
   • Accept: Acknowledge the residual risk if it falls within acceptable business tolerances.
3. Cybersecurity Framework.Because your infrastructure is exposed to an evolving threat landscape, you need an operational framework to protect it. By adopting industry-standard principles, you give your team a clear lifecycle to follow: Govern, Identify, Protect, Detect, Respond, and Recover.

The Payoff

Once this base is firmly established, the operational fog clears. You will be able to answer those tough compliance and asset questions instantly. You will clearly see exactly which gaps need to be prioritised next.

Most importantly, when you eventually do need to buy a piece of security software or look at an AI integration, you won't have to fight for budget. Your leadership will back you because they were part of the journey, they understand the underlying risk, and they can see exactly how the new tool fits into the bigger picture.

Credit Where Credit Is Due

This article aligns with internationally recognized industry standards for information security and corporate governance:

• The Cybersecurity Lifecycle: The Govern, Identify, Protect, Detect, Respond, and Recover functions are adopted from the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) 2.0.

• The Risk Treatment Principles: The Mitigate, Transfer, Avoid, and Accept matrix is based on core enterprise risk management principles defined by the International Organization for Standardization (ISO 31000) and the Committee of Sponsoring Organizations of the Treadway Commission (COSO) frameworks.