As South Africa continues to expand its digital infrastructure, greater consideration must be given to the resilience of the systems supporting connectivity. Building a sustainable digital future requires more than technological investment; it calls for coordinated infrastructure planning, effective regulatory frameworks and a long-term commitment to operational continuity.
Digital resilience: Lessons from infrastructure disruptions
In July 2019, City Power experienced a ransomware attack that disrupted several of its operational systems, including databases, applications and network infrastructure. Although electricity generation and distribution infrastructure were not directly compromised, the consequences extended to residents who were unable to purchase prepaid electricity, access certain billing services or receive timely responses to reported faults. [1] Only three months later, the City of Johannesburg experienced a separate cyberattack, resulting in the precautionary suspension of its website, electronic services and billing platforms. The incident further affected residents’ ability to access essential municipal services and communicate service-related concerns through established channels. [2]
These incidents, although now several years behind us, remain important examples of the relationship between digital infrastructure and the continuity of essential public services.
More recently, the Development Bank of Southern Africa experienced a ransomware attack in 2023, while a cyberattack on the South African Weather Service in 2025 disrupted services relied upon by various sectors, including aviation and agriculture. [3]
These failures are real, and they are ours. But it would be a mistake to read the list as a verdict on South Africa. Every digitised economy carries the exposure of critical systems to technological disruptions, cybersecurity threats and operational failures becomes a shared global concern.
South Africa has made considerable progress in developing its digital economy, supported by advancements in electronic payment systems, digital public services, telecommunications networks and data centre infrastructure. These developments have strengthened the country’s position as an important participant in Africa’s digital transformation.
Understanding digital infrastructure and resilience
Digital Infrastructure encompasses the physical and virtual technologies that enable the delivery, management and exchange of digital information and services. This includes telecommunications networks, fibre infrastructure, data centres, cloud computing environments, software platforms and the supporting systems that facilitate connectivity across different sectors. The effectiveness of this infrastructure is largely dependent on its reliability, scalability, security and interoperability.
Resilient Digital Infrastructure extends beyond these characteristics by incorporating the capacity to withstand disruptions, adapt to changing conditions and restore essential services within acceptable timeframes. In practical terms, resilience requires that critical sectors, including telecommunications, healthcare, financial services, transportation and public administration, maintain an appropriate level of operational continuity even when individual systems experience failure.
The distinction is particularly important within the public sector, where disruptions to digital services may directly affect citizens’ access to essential services.
As digital technologies become increasingly integrated into government operations and everyday economic activities, resilience should therefore be considered a fundamental component of infrastructure development rather than an additional measure introduced after implementation.
Connectivity and resilience: Understanding the relationship
South Africa’s commitment to expanding digital connectivity is reflected in several important developments.
- During the February 2026 State of the Nation Address, President Cyril Ramaphosa highlighted the establishment of 55 data centres, alongside anticipated investment exceeding R50-billion over the following three years. [5]
- A R3-billion allocation associated with the second phase of SA Connect further demonstrates government’s commitment to improving broadband accessibility, particularly in communities that remain underserved. [6]
- In March 2026, the Development Bank of Southern Africa and the National Planning Commission published the Digital Connectivity Investment Roadmap to 2035, outlining investment priorities and interventions relating to infrastructure development, regulatory reform, institutional capacity and digital inclusion. [7]
Collectively, these initiatives represent meaningful progress towards establishing a more connected economy. However, while connectivity remains fundamental to digital transformation, it is important to recognise that greater connectivity does not necessarily translate into greater resilience.
As systems become increasingly interconnected, the potential consequences of an isolated disruption may extend beyond the infrastructure or institution in which the failure originated.
Balancing infrastructure consolidation with operational resilience
The National Data and Cloud Policy, adopted in 2024, establishes a framework for the consolidation and management of government data infrastructure through cloud-enabled technologies. The policy further envisages a central role for the State Information Technology Agency in facilitating access to data infrastructure and cloud services across government departments. [8]
The rationale for this approach is understandable. Fragmented procurement processes, duplicated infrastructure investments and limited interoperability between public-sector systems have historically presented challenges to efficient service delivery.
Consolidation offers an opportunity to address these inefficiencies, strengthen coordination and optimise the use of limited technical and financial resources.
Nevertheless, it is equally important to consider the potential risks associated with increasing dependence on shared infrastructure. Where multiple institutions rely on the same service providers, physical facilities, network routes or supporting systems, a disruption affecting one component may have consequences across several institutions.
This does not diminish the value of infrastructure consolidation. Rather, it highlights the importance of incorporating resilience considerations into the design and implementation of consolidation initiatives.
An important distinction in this regard is the difference between redundancy and diversity.
Redundancy generally involves establishing additional capacity or backup systems to maintain continuity in the event of a failure. However, where primary and backup systems remain dependent on the same physical infrastructure, energy supply or service provider, the intended protection may be limited. Infrastructure diversity, on the other hand, seeks to reduce common dependencies by incorporating alternative network routes, facilities, technologies or service providers.
A resilient infrastructure strategy should therefore consider both approaches, particularly where the continuity of critical public services is concerned.
Understanding the different dimensions of digital resilience
Digital resilience is frequently discussed within the context of cybersecurity. Although cybersecurity remains an essential component, resilience encompasses a broader range of physical, technological, operational and institutional considerations.
A Check Point study cited in May 2026 indicated that South African organisations experienced an average of 1,863 cyberattacks per organisation per week, with government institutions among the sectors facing significant exposure. [9]
These findings reinforce the importance of strengthening cybersecurity capabilities. However, it would be limiting to approach digital resilience exclusively through the prevention of cyberattacks.
A more comprehensive approach requires consideration of four interconnected dimensions.
-
Physical infrastructure
The physical dimension includes fibre networks, telecommunications towers, base stations, data centres, electricity infrastructure and other facilities that support digital connectivity.
The reliability of these systems is influenced by factors such as electricity availability, infrastructure maintenance, vandalism, theft and environmental conditions.
Physical resilience therefore requires appropriate infrastructure planning, alternative routes, backup power arrangements and ongoing maintenance.
-
Logical infrastructure
Logical infrastructure refers to the systems and configurations that enable digital networks and applications to function, including routing protocols, identity management systems, domain services and security certificates.
Failures within these components may interrupt access to otherwise operational systems.
This highlights the importance of maintaining appropriate technical controls, monitoring mechanisms and recovery procedures across the different layers of digital infrastructure.
-
Operational capacity
Operational resilience concerns the people, processes, contractual arrangements and institutional capabilities required to maintain and restore services.
Although organisations may have documented disaster recovery and business continuity plans, the effectiveness of these arrangements depends on whether they are adequately resourced, regularly reviewed and practically tested.
The availability of appropriately skilled personnel, clearly defined service provider responsibilities and established incident response procedures is therefore essential.
-
Governance and institutional accountability
Governance provides the framework within which resilience is prioritised, implemented and monitored. This includes the allocation of responsibilities, reporting of incidents, coordination between institutions and the establishment of mechanisms through which lessons from previous disruptions can inform future planning.
Reluctance to disclose cybersecurity incidents, often associated with reputational concerns, may limit opportunities for institutional learning. [9]
While these concerns are understandable, improving the responsible sharing of incident information could strengthen resilience across the broader public sector.
Ultimately, these four dimensions should not be considered independently. Their effectiveness depends on the extent to which they are incorporated into a coordinated infrastructure management framework.
Developing a regulatory environment that supports innovation and resilience
An important consideration in advancing South Africa’s digital infrastructure is the role of regulation in facilitating technological development while maintaining appropriate standards of accountability and resilience.
During Digital Council Africa’s Conext 2026 summit, an important perspective was raised regarding the need for regulatory frameworks to create an enabling environment for innovation, rather than attempting to prescribe specific technological solutions.
This distinction is particularly relevant within the digital infrastructure sector, where technological advancements frequently occur at a pace that exceeds traditional regulatory development processes.
Regulations that prescribe specific technologies may become increasingly restrictive as new solutions emerge. Conversely, regulatory frameworks that establish clear performance and operational requirements may provide greater flexibility for innovation.
Within the context of digital resilience, such requirements could include minimum service continuity standards, interoperability, recovery capabilities and appropriate incident reporting obligations. The intention should be to establish a regulatory environment that provides certainty and accountability without unnecessarily limiting technological advancement.
Ongoing regulatory work within the telecommunications sector, together with infrastructure investment initiatives supported by the Development Bank of Southern Africa, presents opportunities to strengthen the alignment between policy objectives and infrastructure development.
The incorporation of resilience requirements during the development of these frameworks may prove considerably more effective than introducing them retrospectively, once infrastructure dependencies and operational practices have already been established.
The interdependence between digital and energy infrastructure
An important consideration in developing resilient digital infrastructure is its relationship with energy infrastructure.
Telecommunications networks, data centres, base stations and supporting digital systems all depend on access to reliable electricity. Data centres, in particular, require substantial and continuous electricity supply, alongside appropriate cooling infrastructure, which may also place demands on water resources.
These dependencies demonstrate that digital infrastructure cannot be planned or developed entirely independently of the broader infrastructure environment in which it operates.
Currently however, infrastructure planning and regulation frequently take place across different institutions, each operating within its own mandate, priorities and implementation timelines. This presents a broad institutional challenge.
For example, the development of a data centre investment strategy without adequate consideration of electricity capacity and water availability may create infrastructure constraints that could otherwise have been anticipated during the planning process.
Similarly, the expansion of municipal connectivity infrastructure without appropriate consideration of energy supply may compromise the long-term reliability of the services being introduced.
Digital resilience should therefore be understood as both a technological and an institutional coordination challenge.
Addressing this challenge requires great collaboration between government departments, regulatory authorities, infrastructure operators and private-sector participants.
While each institution has a distinct mandate, the infrastructure being developed often serves interconnected purposes. Effective coordination should therefore extend beyond policy discussions to include project planning, infrastructure authorisations, investment decisions and implementation timelines.
Such collaboration would support a more integrated approach to infrastructure planning, ensuring that the development of one sector is adequately informed by the capacity and constraints of the others.
Optimising existing infrastructure before pursuing new development
Infrastructure development is often associated with the construction of new facilities, networks and supporting systems. While new investment remains necessary to address infrastructure gaps and growing demand, there is considerable value in assessing how existing infrastructure can be utilised more effectively.
Across South Africa, various forms of digital and supporting infrastructure have been developed. These assets may include fibre networks, established servitudes, telecommunications facilities and network capacity that is not being utilised to its full potential.
In certain circumstances, the interconnection or shared use of existing infrastructure may provide a more efficient means of improving connectivity and resilience than developing entirely new systems.
This approach would, however, require a clear understanding of the infrastructure already available, including its location, capacity, ownership, technical compatibility and commercial accessibility. Infrastructure mapping and asset inventories could therefore play an important role in identifying opportunities for collaboration and reducing unnecessary duplication.
The benefits extend beyond cost efficiency.
Where infrastructure sharing enables access to alternative physical routes or independently operated networks, it may also strengthen resilience by reducing dependence on individual assets or service providers.
Nevertheless, successful implementation would require appropriate commercial arrangements, regulatory support and coordination between participating institutions. Public-private partnerships and other forms of infrastructure collaboration may provide valuable mechanisms through which these opportunities can be explored, particularly where public-sector infrastructure objectives intersect with privately developed assets and technical capabilities.
Such arrangements should, however, be structured with due consideration of accountability, commercial sustainability, equitable access and the long-term maintenance of shared infrastructure.
The broader objective should be to ensure that infrastructure investment decisions are informed by both the need for expansion and the opportunities available through more effective utilisation of existing resources.
Practical interventions for strengthening digital resilience
While policy reform and long-term infrastructure investment remain important, several practical interventions could strengthen digital resilience within existing institutional and regulatory frameworks.
1. Incorporating resilience into procurement processes
Public-sector infrastructure procurement should consider the long-term operational implications of investment decisions alongside initial acquisition costs.
Although cost efficiency remains an important consideration, an excessive emphasis on the lowest-priced offering may result in insufficient attention being given to infrastructure reliability, recovery capabilities and operational sustainability.
Procurement evaluation criteria could therefore incorporate factors such as network diversity, service provider dependencies, demonstrated recovery capabilities and long-term maintenance arrangements. This would encourage infrastructure investment decisions that balance immediate financial considerations with the longer-term requirements of service continuity.
2. Strengthening business continuity and disaster recovery testing
Recovery procedures to be periodically tested under realistic operational conditions.
Institutions could establish recovery time objectives for critical public-facing services and assess their performance against these requirements through scheduled testing. Such assessments would assist in identifying operational weaknesses, clarifying responsibilities and determining whether the resources allocated towards recovery are sufficient.
Accountability for these processes should extend beyond information technology departments to the institutional leadership responsible for overall service delivery.
3. Maintaining alternative service delivery arrangements
As public services become increasingly digitised, consideration should be given to the arrangements required to maintain essential services when digital platforms become unavailable.
Although digital systems can significantly improve accessibility and administrative efficiency, exclusive dependence on these platforms may create challenges during periods of disruption.
Appropriate alternative procedures, including controlled manual processes where practical, could assist institutions in maintaining basic service delivery while digital systems are restored.
These arrangements should be designed with suitable safeguards for recordkeeping, security and subsequent reconciliation. The objective is not to undermine digital transformation, but to ensure that technological advancement does not inadvertently eliminate the capacity to deliver essential services during disruptions.
4. Improving institutional learning and incident reporting
Infrastructure failures and cybersecurity incidents can provide valuable information regarding weaknesses in existing systems and operational arrangements.
However, the broader value of these experiences may be limited where findings remain confined to individual institutions.
The establishment of appropriate mechanisms for sharing incident findings, recovery experiences and recommended improvements could support greater institutional learning.
Such mechanisms would need to balance transparency with the protection of sensitive operational and security information. A coordinated approach could assist public institutions in identifying common vulnerabilities and implementing preventative measures before similar disruptions occur elsewhere.
5. Encouraging infrastructure sharing and cross-sector planning
Infrastructure development proposals should, where appropriate, include an assessment of existing assets and opportunities for shared utilisation before new infrastructure is commissioned.
This would support more efficient resource allocation while potentially strengthening network diversity and operational resilience.
Building resilience as a long-term institutional commitment
South Africa’s progress in expanding digital connectivity provides an important foundation for economic participation, improved public service delivery and technological innovation.
However, the long-term value of these developments will depend not only on the extent of infrastructure expansion, but also on the reliability and sustainability of the systems being established.
Digital resilience should therefore not be viewed as a once-off investment, a compliance requirement or a responsibility confined to information technology functions. Rather, it requires an ongoing institutional commitment to infrastructure maintenance, operational preparedness, coordinated planning and continuous improvement.
This commitment may involve difficult investment decisions, particularly where the benefits of preventative measures are less immediately visible than those associated with new infrastructure development.
Nevertheless, the consequences of insufficient preparation may extend considerably beyond the direct costs of restoring affected systems.
For public institutions, prolonged digital disruptions may affect service delivery, institutional credibility and citizens’ ability to access essential services.
For businesses and infrastructure operators, such disruptions may compromise productivity, financial sustainability and confidence in the broader digital environment.
As South Africa continues to position digital infrastructure alongside other critical national infrastructure, it becomes increasingly important that resilience is incorporated into the decisions guiding its development.
Building a connected future is an important ambition. Ensuring that the infrastructure supporting that future remains reliable, adaptable and sustainable is an equally important responsibility.
Ultimately, the opportunity lies in adopting an approach to infrastructure development that recognises resilience not as a response to failure, but as a fundamental consideration from the outset.
The success of South Africa’s digital future should therefore be measured not only by how extensively we connect our communities, institutions and economies, but also by how effectively we ensure that those connections can be sustained.
References
- “Johannesburg Ransomware Attack Leaves Residents in the Dark”, Dark Reading, July 2019. darkreading.com
- “Ransomware attack shuts down City of Johannesburg’s systems”, BleepingComputer, October 2019. bleepingcomputer.com
- “South Africa’s government-run weather service knocked offline by cyberattack”, The Record, January 2025. therecord.media
- Budget Speech 2026, Minister of Finance Enoch Godongwana, Parliament, Cape Town, 25 February 2026. South African Government
- State of the Nation Address, President Cyril Ramaphosa, Cape Town City Hall, 12 February 2026. South African Government
- 2026 Budget Review, National Treasury, February 2026. National Treasury
- “DBSA & NPC Unveil the Investment Blueprint Set to Transform South Africa’s Connectivity by 2035”, Development Bank of Southern Africa, 30 March 2026. DBSA
- National Data and Cloud Policy, Department of Communications and Digital Technologies, adopted 31 May 2024. Policy text
- “Sita denies claims of a government cyberattack”, TimesLIVE, 25 May 2026, citing Check Point research on attack volumes by sector. TimesLIVE
