The office devices your cybersecurity policy forgot

Published

July 2026

Length

11 pages

Written for

Owners, office managers, finance managers and IT managers.

Many SME cybersecurity policies concentrate on email, laptops, cloud accounts and staff awareness. That is necessary, but incomplete. A multifunction printer can process and retain confidential documents. A hosted PBX can expose call routing, recordings and billing. Routers, access points, CCTV and access control often have remote administration portals, supplier access and firmware that requires maintenance.

What the report covers

• Which devices are routinely left out
• What each of them can expose
• POPIA and the Information Regulator's reported figures
• Asset lists, owners and administrator credentials
• Firmware, support status and remote access
• Separating device networks from staff and guest use
• What to do when equipment is replaced or returned

Key points

• The gap is usually not a lack of sophisticated security software. It is no complete asset list, no named owner, shared administrator passwords, uncertain firmware status, forgotten remote access and no controlled process when equipment is replaced.
• Scanned identity documents, employee records, call recordings, camera footage and access logs can all contain personal information, and POPIA requires appropriate, reasonable safeguards.
• The Information Regulator reported 2,374 security-compromise incidents in the 2024/25 financial year, up from roughly 1,700 the year before, with reported compromises continuing to climb into 2025/26.
• Start with an asset list and named owners, replace default and shared credentials, enable multi-factor authentication where supported, and separate device networks from everyday use.

Related