Andre Klynsmith

Aviation

Forty-Eight Hours From Awareness: SACAA Spells Out What Counts as a Reportable Air Cargo Cyber Incident

The South African Civil Aviation Authority has clarified that unauthorised access, malware, ransomware, data breaches and disruption of critical ICT systems can all fall within the new air cargo cybersecurity reporting requirements for regulated agents and known consignors.

Aviation

5 September 2026 • 5 min read

The rule gives regulated air cargo entities 48 hours to report a cybersecurity incident to the Director of Civil Aviation. The clock starts when the organisation becomes aware — which makes this an internal escalation problem long before it is an IT problem.

Where the Requirement Comes From

The obligation flows from the Thirty-Third Amendment of the Civil Aviation Regulations, published in Government Gazette No 55226 on 21 August 2026. It requires regulated agents and known consignors to report cybersecurity incidents to the Director of Civil Aviation within 48 hours of becoming aware of them.

SACAA has since set out what falls inside the scope. Incidents that could compromise aviation-related systems, networks, information or data are covered, with unauthorised access, malware, ransomware, data breaches and disruption of critical ICT systems given as examples. The authority stressed those examples are illustrative rather than an exhaustive list, and said the amendment is intended to enhance existing aviation cybersecurity requirements rather than introduce an entirely new framework.

The Hard Part Is Internal, Not Technical

SACAA communications and stakeholder relations manager Sisa Majola told Freight News that some regulated agents and known consignors may need to amend their security programmes and internal procedures to comply. He pointed to a specific structural weakness: designated officials might rely on ICT departments to identify and communicate incidents, so internal processes must ensure that information reaches the relevant officials quickly enough for the organisation to meet the deadline.

In a typical freight forwarding or ground handling business, an IT team detects a ransomware attempt or a mailbox compromise and treats it as a technical containment task. The security officer named in the company's aviation security programme may not hear about it for days. Under this rule that internal delay consumes the reporting window even though nobody ignored the incident. The remedy is a written escalation path with named roles and a stated internal deadline — a handful of hours, not days — from technical detection to the accountable official.

Enforcement Is Open-Ended, and So Is the Channel

Failure to comply with Part 108 could result in enforcement action under the Civil Aviation Act, the Civil Aviation Regulations and SACAA's established enforcement processes. The authority did not identify a specific penalty for missing the 48-hour deadline, saying enforcement action would depend on the circumstances and seriousness of the case. That discretion cuts both ways: there is no fixed fine to budget for, and no ceiling either.

One practical gap remains. While SACAA said established mechanisms exist for reporting aviation safety and security occurrences, it did not specify the reporting channel in its response, referring instead to the requirements and processes contained in the applicable aviation security framework. Majola also pointed to existing aviation cybersecurity Technical Guidance Material, which covers cybersecurity culture and the development and implementation of aviation cybersecurity programmes. Companies should confirm and record the exact submission route and recipient now, while there is no incident running.

About the Author
	Andre Klynsmith Entrepreneur & Technology Enthusiast Andre's expertise spans technology, blockchain, transport, and logistics — with a passion for innovation and driving positive change across industries. info@laaimylorrie.com | laaimylorrie.com