Cyber Security
Cyber Security Priorities for Botswana Businesses
/6 min read
As Botswana organisations put more services online and connect more of their operations, the attack surface grows faster than security programmes do. The question is rarely whether to invest, but in what order. This is the sequence we recommend after assessments across government, financial services, mining and utilities environments.
Priority 1: Identity
Credential misuse remains the most common route into an organisation. Multi-factor authentication, role-based access, removal of dormant accounts and control of privileged access deliver more risk reduction per pula than almost anything else.
Priority 2: Email
Phishing and business email compromise target finance and procurement teams directly. Impersonation protection, domain authentication and targeted awareness training address the entry point rather than the symptom.
Priority 3: Endpoints and patching
Laptops, desktops and field devices are where most attacks execute. Central endpoint protection, enforced patching and device compliance policies close the gap between an attempt and an incident.
Priority 4: Verified backup and recovery
Backups that have never been restored are an assumption, not a control. Ransomware readiness depends on tested recovery with offsite copies and a documented recovery time expectation.
Priority 5: Monitoring and response
Detection matters only if someone acts. Continuous monitoring paired with a written, rehearsed incident response plan turns a crisis into a procedure — containment, communication, recovery and review.
- Who declares an incident?
- Who communicates with staff, customers and regulators?
- What gets isolated first, and who authorises it?
Priority 6: Governance and evidence
Boards, auditors and data protection obligations require evidence that controls exist and operate. Policies, access reviews, awareness records and monitoring reports turn security work into something demonstrable.
Start with an assessment. Until exposure is measured across infrastructure, identity, endpoints, cloud and process, spending tends to follow marketing rather than risk.