Solving the problem of compliance for midsized organisations
If organisations focus on the requirements when embarking on the process of the ROC CISO Top 40, then the preparation can be done in a matter of days, rather than months.
Most boards struggle to answer five basic cyber questions that are necessary for compliance: What are our critical assets? Which threats matter most? Where are the gaps? What do we fix first? Are we doing enough?” Compliance is becoming ever more critical in today’s threat landscape. The Information Regulator has received over 8 000 security compromise notifications since PoPIA enforcement began, and the cost of a data breach is approximately R44.1 million.
“To remain compliant, larger organisations have to prove that their service providers are also compliant. However, mid-sized firms with 50 to 500 employees don’t often have the necessary in-house technical expertise to assess and fulfil all the compliance requirements. Consulting reviews are expensive and slow, and full ISO 27001 programmes are very costly,” says Jaco Voigt, Chief Executive Officer at Catalytic. “ We have had clients who have been presented with a time limit in which to comply or their contracts with larger organisations will be paused. This was one of the main driving forces behind our creation of ROC CISO Top 40.”
ROC CISO Top 40 provides a detailed analysis and clear roadmap for mid-sized organisations to become fully compliant. The process links critical assets, threats, and 40 CISO-defined controls into one risk picture with a 90-day plan. This baseline feeds directly into PoPIA compliance, ISO 27001, third-party risk and fractional CISO services.
First, you identify and list the critical IT assets your operations depends on, including cloud platforms, business systems, databases, identity systems, end points and sensitive data – all catalogued and rated by business impact. Then, it maps the threat landscape including ransomware, email and identity compromise, data exfiltration, cloud misconfiguration, insider threats and supply chain compromise. The 40 foundational controls are assessed across eight domains to produce a baseline maturity score. At the end of the process, an organisation receives a detailed, objective report, which allows them to make informed decisions about improving their security in every necessary aspect.
“It’s fast, practical, and written for boards, not technicians,” Voigt emphasises. “The client receives an executive cyber risk dashboard, a risk heat map, the top 10 priority cyber risks, a maturity assessment and a 90-day roadmap, as well as an easily actionable report that an executive board can understand. This empowers them to make the best decisions,” Voigt says.
If organisations focus on the requirements when embarking on the process of the ROC CISO Top 40, then the preparation can be done in a matter of days, rather than months. The team at Catalytic will recommend remediation to the customer immediately after completing each section.
The platform provides an ongoing picture of compliance and offers continuous engagement that allows you to get accurate feedback at any point in the risk and compliance cycle. It’s not just an annual box check exercise. Responsibilities are allocated to relevant team members and feedback is scheduled to ensure you keep up the cadence. Even if team members leave, nothing will be forgotten. It keeps your organisation current when security requirements change and update, which can happen more frequently than once a year.
“ROC CISO Top 40 ensures the responsibility remains in your organisation’s hands and you are not dependent on the hours billed by a consultant. It’s available at an incredibly affordable price, because we want our customers to be risk-aware, compliant, and avoid making expensive mistakes,” Voigt says. “Launched at the beginning of 2026, it has already filled an essential gap in the market and proved its worth.”
