South African factories and plant operations
Payroll and purchasing systems need protection. So do the records and configurations used to run a plant. Office IT and operational technology have different risks: recovery must account for people, equipment and the process being controlled.
The regulatory context
This guide addresses administrative IT and the information needed for OT recovery. The legal duties for a particular plant depend on its processes, hazards and sector.
Workplace and machinery safety
The OHS Act provides a framework for workplace, plant and machinery safety. The applicable regulations and records depend on the operation. A general IT assessment does not establish machinery safety or satisfy every inspection duty.
Map safety-related dependencies and involve the responsible engineer, safety practitioner and equipment supplier before changing a connected system.
Sources: OHS Act.
POPIA and administration
Payroll, access-control records, CCTV and identifiable production records may contain personal information. Health and biometric data need particular assessment under POPIA's special-personal-information provisions.
Set authorised purposes, access and retention. The fact that a system is located in a factory does not remove personal-information duties.
Sources: POPIA.
OT security guidance
NIST SP 800-82 Revision 3 addresses OT's safety, reliability and performance constraints. SP 1339 addresses OT backups and recovery exercises. These are technical references, not South African legal requirements or certification.
Use them to structure discussion with plant specialists. Do not carry office patching, scanning or endpoint-agent practices into OT without assessment and approval.
Sources: NIST OT security guidance; NIST OT backup guidance.
This guide covers selected information and IT matters. It is not a complete legal checklist or a finding that your organisation complies. Confirm applicability with the people responsible for your legal, regulatory and operational duties. See the general Compliance page for the wider context, including PAIA.
Keep what is required, for the right reason
A file copy is only useful if the authorised team can identify the correct version and restore it safely. Administrative retention and engineering recovery requirements need separate schedules.
| Record category | Rule or decision to confirm | Useful evidence |
|---|---|---|
| PLC, HMI, SCADA and engineering recovery material | As a recovery-planning measure, identify applicable logic, configurations, software versions, licences, dependencies and approved change records. Set backup frequency and versions with the plant owner and vendor; no universal statutory retention period is asserted here. Sources: NIST OT security guidance; NIST OT backup guidance. | Vendor-reviewed recovery inventory, protected copies and isolated test results. |
| Maintenance, inspection and safety records | Identify the records and periods required by the specific machinery, exposure or safety regulations and the plant's contracts. A single retention period for every factory would be misleading. Sources: OHS Act. | Legal register maintained by the responsible specialist and a retrieval check. |
| Payroll, finance and company accounting records | Apply the relevant tax rules and holds. Where the operation is a company, required accounting records include the current and previous seven completed financial years. Keep health, biometric and access records only with an applicable lawful basis for retention. Sources: SARS retention policy; SARS Tax Administration guide; Companies Act, section 24; POPIA. | Category-specific schedule, restricted access and approved disposal records. |
A backup retention setting is not a complete records policy. Record the owner, retention trigger, access rules, storage location, legal holds and authorised disposal for each category. Test retrieval, including the application or licence needed to read it. POPIA section 14 requires a lawful reason for continued retention; avoid keeping personal information indefinitely by default.
From risks to working controls
These are practical measures to assess against your environment and agreed service scope. Evidence should show what was checked, when, by whom and what still needs attention.
Have the authorised IT and OT specialists map necessary data flows and review separation between office and plant networks. Record exceptions and a safe change plan before implementation.
Possible evidence: Approved boundary diagram, permitted-flow register and reviewed exceptions.
Review named accounts, approved access windows, authentication, session records and revocation. Confirm equipment compatibility and the plant's authorisation process before enabling or changing remote access.
Possible evidence: Vendor-access register, approvals, session logs and expiry checks.
Agree vendor-supported backup methods and update copies after approved changes. Include the dependencies needed to use them. Test on a suitable isolated system or agreed recovery environment.
Possible evidence: Versioned backup inventory, change-to-backup checks and test results signed off by the plant owner.
Confirm which application databases, files and cloud services are covered. Use application-supported backup methods and test retrieval and recovery with the system owner.
Possible evidence: Coverage list, backup exceptions and a representative restore report.
Assess support status and compensating controls with the vendor. Require engineering approval, a maintenance window and rollback before scans, agents, patches or firmware changes on OT.
Possible evidence: Compatibility assessment, approved change record and documented rollback method.
The control examples draw on NIST OT security guidance and NIST OT backup guidance and NIST CSF 2.0. Technical guidance is not itself South African legislation or a compliance certificate.
What to check
An OT recovery plan must distinguish restoring information from safely returning equipment to service. The plant's authorised engineering and operations team must verify the process state, configuration and safety conditions before restart.
Bastion's confirmed services do not establish specialist OT engineering, safety-system validation or machinery certification capability. Any proposed work involving plant systems needs a separate technical scope, competent specialists, supplier compatibility checks and written approval. Do not disconnect, reboot or isolate safety-related systems using a generic IT response checklist.
Prepare before an incident
Use the plant's approved incident and emergency procedures. Escalate to operations and engineering before containment steps that could affect machinery or safety functions. Preserve relevant records through methods the plant owner approves. Office personal-data incidents also need a POPIA assessment.
Under POPIA section 22, reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person trigger notification duties. The responsible party must notify the Information Regulator and affected data subjects as soon as reasonably possible, subject to the Act's provisions. An operator must notify the responsible party immediately under section 21(2). There is no general 72-hour POPIA deadline. Sources: POPIA; Regulator guidance.
Agree who assesses the facts, preserves relevant evidence, makes notifications and authorises recovery. A technical incident report supports those decisions; it does not replace them.
Bastion Backups' role
Subject to an agreed scope, Bastion provides managed backup, recovery planning and testing, security checks and reporting, and controlled remote support. Start with your systems, record locations, authorised users and recovery priorities.
We can discuss administrative systems, supported backup workloads, recovery documentation and reporting. OT coverage, if considered, must first be assessed with the plant's engineering team and vendors; this page is not an offer to manage every controller or safety system.
Agree coverage, exclusions, responsibilities, storage and supplier arrangements, reporting, testing, support availability and any costs in writing before work begins. Where we process personal information as an operator, the written arrangement must address the applicable POPIA duties.
The plant owner and appointed specialists retain operational, engineering, safety and regulatory decisions, including authority to restart production. We do not certify regulatory compliance, promise that incidents will be prevented or guarantee recovery times without a specific agreed commitment.
Explore our supported solutionsCommon questions
Compatibility and safety need assessment first. Some OT equipment has strict vendor constraints or cannot tolerate ordinary scans, agents or restarts. Use approved methods, an agreed change window and rollback; do not assume office tools are suitable.
POPIA section 72 governs transfers of personal information outside South Africa; it is not a blanket local-hosting rule. Separate tax-record location rules, contracts and plant requirements may also apply. Assess the actual records, storage locations and supplier arrangements before selecting a service.
Legislation and guidance
Content reviewed 16 October 2026.
Check current legislation, regulator notices and your own contracts before acting. The practical examples describe matters to review; they are not a statement that every listed control is legally required for every business.
View all industry guidesDiscuss your factory's systems
Tell us which systems you use and what you need to review. Please do not send client files, identity documents, sensitive system configurations, passwords or access codes with an initial enquiry.