← Frameworks / POPIA / Control Mappings

Protection of Personal Information Act (Act 4 of 2013)

South Africa's comprehensive data protection law, closely modelled on EU GDPR principles. Establishes 8 conditions for lawful processing: accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards, and data subject participation. Covers responsible party obligations, information officers, data subject rights, transborder data flows, enforcement by the Information Regulator, and criminal offences. Mandatory for all public and private bodies processing personal information in South Africa.

Controls: 96
Total Mappings: 151
Publisher: Republic of South Africa Version: 2013 (effective 2021)
POPIA → SP 800-53 SP 800-53 → POPIA Coverage Analysis
AC (9) AU (5) CA (4) CM (8) CP (4) IA (4) IR (8) MA (2) MP (4) PE (3) PL (2) PM (4) PS (5) PT (8) RA (5) SA (2) SC (6) SI (9) SR (4)

AC Access Control

Control Name POPIA References
AC-01 Access Control Policies and Procedures
s19
AC-02 Account Management
s19
AC-03 Access Enforcement
s19
AC-04 Information Flow Enforcement
s19s72
AC-05 Separation Of Duties
s19
AC-06 Least Privilege
s10s19
AC-07 Unsuccessful Login Attempts
s19
AC-08 System Use Notification
s18
AC-16 Automated Labeling
s26-27s28-33

AU Audit and Accountability

Control Name POPIA References
AU-01 Audit And Accountability Policy And Procedures
s17s19s8
AU-02 Auditable Events
s17s19s8
AU-06 Audit Monitoring, Analysis, And Reporting
s19s22s73-99
AU-09 Protection Of Audit Information
s19
AU-11 Audit Record Retention
s14

CA Security Assessment and Authorization

Control Name POPIA References
CA-01 Certification, Accreditation, And Security Assessment Policies And Procedures
s19
CA-02 Security Assessments
s19
CA-06 Security Accreditation
s57-59
CA-07 Continuous Monitoring
s19

CM Configuration Management

Control Name POPIA References
CM-01 Configuration Management Policy And Procedures
s19
CM-02 Baseline Configuration
s19
CM-03 Configuration Change Control
s19
CM-06 Configuration Settings
s19
CM-07 Least Functionality
s19
CM-08 Information System Component Inventory
s17
CM-12 Information Location
s10s14s17
CM-13 Data Action Mapping
s13s15s17s8

CP Contingency Planning

Control Name POPIA References
CP-01 Contingency Planning Policy And Procedures
s19
CP-02 Contingency Plan
s19
CP-09 Information System Backup
s19
CP-10 Information System Recovery And Reconstitution
s19

IA Identification and Authentication

Control Name POPIA References
IA-01 Identification And Authentication Policy And Procedures
s19
IA-02 User Identification And Authentication
s19
IA-04 Identifier Management
s19
IA-05 Authenticator Management
s19

IR Incident Response

Control Name POPIA References
IR-01 Incident Response Policy And Procedures
s19s22
IR-02 Incident Response Training
s22
IR-04 Incident Handling
s19s22
IR-05 Incident Monitoring
s22
IR-06 Incident Reporting
s22s73-99
IR-07 Incident Response Assistance
s22
IR-08 Incident Response Plan
s22
IR-09 Information Spillage Response
s22

MA Maintenance

Control Name POPIA References
MA-01 System Maintenance Policy And Procedures
s19
MA-02 Controlled Maintenance
s19

MP Media Protection

Control Name POPIA References
MP-01 Media Protection Policy And Procedures
s19
MP-02 Media Access
s19
MP-04 Media Storage
s19
MP-06 Media Sanitization And Disposal
s14s19

PE Physical and Environmental Protection

Control Name POPIA References
PE-01 Physical And Environmental Protection Policy And Procedures
s19
PE-02 Physical Access Authorizations
s19
PE-03 Physical Access Control
s19

PL Planning

Control Name POPIA References
PL-01 Security Planning Policy And Procedures
s19s8
PL-02 System Security Plan
s17s19

PM Program Management

Control Name POPIA References
PM-01 Information Security Program Plan
s19s8
PM-02 Information Security Program Leadership Role
s55s8
PM-03 Information Security and Privacy Resources
s8
PM-09 Risk Management Strategy
s19s8

PS Personnel Security

Control Name POPIA References
PS-01 Personnel Security Policy And Procedures
s19
PS-03 Personnel Screening
s19
PS-06 Access Agreements
s19
PS-07 Third-Party Personnel Security
s20
PS-09 Position Descriptions
s55s56

PT Personally Identifiable Information Processing and Transparency

Control Name POPIA References
PT-01 Policy and Procedures
s13s26-27s5s8s9
PT-02 Authority to Process Personally Identifiable Information
s11s57-59s9
PT-03 Personally Identifiable Information Processing Purposes
s13s15s26-27
PT-04 Consent
s11s34-35s5s69
PT-05 Privacy Notice
s12s13s18s5s69s70
PT-06 System of Records Notice
s23-24s25s5
PT-07 Specific Categories of Personally Identifiable Information
s10s15s26-27s28-33s34-35
PT-08 Computer Matching Requirements
s71

RA Risk Assessment

Control Name POPIA References
RA-01 Risk Assessment Policy And Procedures
s19
RA-02 Security Categorization
s17
RA-03 Risk Assessment
s19
RA-05 Vulnerability Scanning
s19
RA-07 Risk Response
s19

SA System and Services Acquisition

Control Name POPIA References
SA-04 Acquisitions
s21
SA-09 External Information System Services
s20s21s72

SC System and Communications Protection

Control Name POPIA References
SC-01 System And Communications Protection Policy And Procedures
s19
SC-07 Boundary Protection
s19s72
SC-08 Transmission Integrity
s19
SC-12 Cryptographic Key Establishment And Management
s19
SC-13 Use Of Cryptography
s19
SC-28 Protection of Information at Rest
s19

SI System and Information Integrity

Control Name POPIA References
SI-01 System And Information Integrity Policy And Procedures
s16s19
SI-02 Flaw Remediation
s19
SI-03 Malicious Code Protection
s19
SI-04 Information System Monitoring Tools And Techniques
s19
SI-06 Security Functionality Verification
s16
SI-07 Software And Information Integrity
s16s19
SI-10 Information Accuracy, Completeness, Validity, And Authenticity
s16
SI-12 Information Output Handling And Retention
s14
SI-18 Personally Identifiable Information Quality Operations
s16s23-24

SR Supply Chain Risk Management

Control Name POPIA References
SR-01 Policy and Procedures
s20s21
SR-02 Supply Chain Risk Management Plan
s20s21
SR-03 Supply Chain Controls and Processes
s20s21
SR-05 Acquisition Strategies, Tools, and Methods
s21