Black Friday is a month away, and for most South African retailers it opens the busiest trading period of the year. Store systems, e-commerce platforms and payment infrastructure carry their highest volumes at exactly the time the IT team can least afford an outage, a breach or an unplanned restart.
Attackers know this calendar too. A ransomware operator who encrypts a transaction database in the last week of November holds far more leverage than one who does it in February, and a skimming script on a payment page sees more card numbers in one weekend than in a quiet quarter. The weeks before peak trading are the time to check the controls that matter, while there is still room to fix what the checks find. These are the checks we recommend, in order.
Why peak trading changes the risk picture
The threats to retail IT do not change in November; the consequences do. Three things combine:
- Volume. More transactions, loyalty sign-ups and delivery addresses mean more personal and payment data exposed to any single incident.
- Change freeze. Most retailers stop non-essential changes for the trading period, so a vulnerability not patched before the freeze stays open until January.
- Scrutiny. Any card-data compromise brings the acquiring bank and PCI DSS into play. PCI DSS v4.0 was retired on 31 December 2024, v4.0.1 is the only active version, and its future-dated requirements became mandatory on 31 March 2025. There is no grace period left to point to.
Lock the change window and finish patching early
Set the date of your change freeze now and work back from it. Anything that needs a restart on a POS back-office server, a store controller or an e-commerce host should be installed and verified before that date.
PCI DSS v4.0.1 restored the wording that the 30-day installation timeline applies to critical vulnerabilities, so check that nothing critical from October is still outstanding in the cardholder data environment. With N-able N-central, patch install maintenance windows separate low-impact updates such as drivers, which can run during the day, from security updates and service packs, which run off-peak. Keep the missing-patch report as evidence that the estate was current at the freeze.
In the same pass, confirm that multi-factor authentication covers every non-console route into the cardholder data environment, as Requirement 8.4.2 demands, including vendor and franchise remote-support accounts. Then confirm that endpoint protection is installed, current and reporting on every store device. SentinelOne keeps detecting and responding on the endpoint when connectivity drops, which matters during load shedding.
Check the payment page, not just the firewall
For retailers that sell online, Requirements 6.4.3 and 11.6.1 address e-skimming: card data stolen by scripts running in the shopper's browser. The intent is that every script on a payment page is authorised, its integrity is checked, and the page is monitored for unauthorised changes. These controls were best practice from March 2022 and have been required since 31 March 2025.
Before the sale begins, inventory the scripts your checkout loads, including tag managers and chat widgets, and remove anything you cannot justify. Confirm that tamper detection alerts a mailbox someone reads over the long weekend. NetScaler WAF in front of the storefront blocks injection and bot traffic, but it does not replace script inventory and page monitoring, for which the PCI Security Standards Council has published separate guidance.
Prove a recovery before you need one
A successful backup job is not a recovery test, as our disaster recovery testing guide explains. Pick the systems whose loss would stop a till from ringing or an order from shipping, and restore each one before the freeze.
Cove Data Protection can do part of this automatically. Its Recovery Testing feature restores a protected Windows device to a new virtual machine every 14 or 30 days, boots it, captures a screenshot in the Management Console, and then purges the machine. It covers System State, Files and Folders and MS SQL on devices of 2 TB or smaller. A screenshot of a booted transaction server dated a week before Black Friday is useful evidence for the compliance file. Pair it with our article on ransomware recovery with immutable backups, because a backup the attacker can also encrypt is not a recovery option.
Rehearse the POPIA notification
Loyalty and online account data sits squarely under POPIA, and a compromise during trading has to be reported while the business is at its busiest. The Information Regulator's fact sheet on handling security compromises says the responsible party should notify the Regulator and affected data subjects as soon as it is reasonably sure that a compromise has occurred; confirmation and a completed investigation are not prerequisites. Notifications to the Regulator go through its eServices portal, and an operator that suffers a compromise must tell the responsible party immediately.
Rehearse this now. Know who deputises for your Information Officer over the holidays, have a working eServices portal login, and draft the data subject notice in advance: what happened and when, what you are doing about it, what the customer should do and, where known, who had access to the data. A website notice should stay up for thirty to ninety days as a rule of thumb. Our POPIA compliance overview covers the wider obligations.
The checklist
Working back from your freeze date:
- Set the change-freeze date and publish it to store operations and suppliers.
- Patch every critical vulnerability in the cardholder data environment and keep the report.
- Confirm MFA on every non-console path into that environment, including vendor accounts.
- Confirm endpoint protection is present and reporting on every store device.
- Inventory payment page scripts and verify change-and-tamper alerting.
- Restore the systems that stop trading if lost, and file the evidence.
- Confirm Information Officer cover, portal access and a draft customer notice.
- Agree who is on call, and how a store reaches them, for the whole period.
None of this is new. The calendar simply adds a deadline.
Sources
- PCI Security Standards Council blog: Just Published, PCI DSS v4.0.1, dated 11 June 2024 and accessed 27 October 2026.
- PCI Security Standards Council blog: Guidance for PCI DSS e-commerce requirements effective after 31 March 2025, accessed 27 October 2026.
- Information Regulator (South Africa): Fact sheet on handling of security compromises, dated 19 August 2025 and accessed 27 October 2026.
- N-able N-central documentation: Patch install maintenance windows, accessed 27 October 2026.
- N-able Cove Data Protection documentation: Recovery Testing, accessed 27 October 2026.
Want these checks run across every store before the freeze? Talk to OAS about managed security for retail.