Tshifhiwa Phaswa

Experienced ICT Governance, Risk, and Business Continuity professional with a strong background in information security, ICT governance, audit management, and service delivery within the public sector. Holds an MBA and a Postgraduate Diploma in Information Technology Management (NQF 8), and is a certified BCM Senior Lead Implementer, with a proven ability to develop and implement governance frameworks that support organisational resilience, compliance, and strategic objectives. Demonstrated expertise in managing ICT risks, strengthening information security controls, and coordinating internal and external audits, including engagement with the Auditor-General.

Skilled in aligning ICT services with business needs, managing stakeholder relationships, and supporting decision-making through effective reporting and governance structures such as Steering Committees.

Business Continuity Management Professional - Office of the Chief Justice - Midrand

(2024-11)

• Strengthened BCM compliance and resilience readiness by redesigning and aligning BCM policies, Business Impact Assessments (BIAs), Business Continuity Plans (BCPs) and Disaster Recovery strategies for multiple OCJ business units and courts in accordance with ISO 22301.
• Improved recovery readiness by conducting Business Continuity Threat and Risk Assessments and developing an integrated BCM Risk Register aligned with Enterprise Risk Management (ERM), ISO 22301 and ISO 31000, enabling the identification, prioritisation and treatment of strategic continuity risks.
• Increased BCM awareness and preparedness by designing and delivering 6 BCM awareness and training sessions, supported by simulation and exercise planning across OCJ national and regional court environments.
• Improved executive oversight of continuity risks by providing monthly BCM resilience and maturity reporting to the BCM Committee, supporting evidence-based decision-making, escalation of critical risks and monitoring of BCM implementation progress.
• Strengthened operational resilience by identifying and closing critical continuity gaps through the integration of BCM, OHS, ICT Disaster Recovery, physical security, facilities management and emergency response across the OCJ court network.

ICT Security and Risk Manager - Gauteng Department of Health - Johannesburg

(2016-09 - 2024-10)

• Strengthened ICT audit readiness and remediation by coordinating ICT audit activities, tracking findings and implementing remediation plans across the Gauteng Department of Health, supporting improved compliance with PFMA, POPIA, National Health Act and applicable ICT governance requirements.
• Strengthened cybersecurity incident management by coordinating security incident response, investigation, remediation and post-incident reviews across critical healthcare information systems and infrastructure supporting hospitals, clinics and administrative facilities.
• Improved ICT governance and policy compliance by reviewing and enhancing ICT security policies, standards and procedures in alignment with POPIA, PFMA, National Health Act, Minimum Information Security Standards (MISS), ISO 27001 and NIST cybersecurity principles.
• Reduced cybersecurity exposure by implementing and monitoring vulnerability management, patch compliance, endpoint security and security-control assessments across critical ICT infrastructure, including monitoring SCCM patching and addressing systems with outdated operating systems, legacy Microsoft Office versions and incomplete endpoint management coverage.
• Strengthened ICT risk management by conducting ICT security and risk assessments, maintaining risk registers, monitoring mitigation plans and reporting key cybersecurity and technology risks to management.
• Improved technology resilience and operational efficiency by supporting the management and security of critical business applications and infrastructure, including Oracle Warehouse Management System (WMS) and related ICT services.
• Strengthened third-party and SLA governance by monitoring ICT service-provider performance, reviewing contractual obligations, tracking service levels and escalating non-performance to ensure continuity of critical healthcare technology services.
• Improved staff cybersecurity awareness by supporting the development and delivery of ICT security awareness and POPIA-related awareness initiatives, strengthening employee understanding of information security, data protection, phishing, access control and responsible use of organisational information.

Network Controller - Gauteng Medical Supplies Depot - Johannesburg

(2009-02 - 2016-08)

• Provided desktop, network, Active Directory and end-user technical support, resolving hardware, software, connectivity and access-related incidents.
• Managed Active Directory user accounts, permissions, access controls, password resets and user onboarding/offboarding.
• Troubleshot Windows, applications, printers, network connectivity and endpoint-related issues to maintain reliable IT services.
• Maintained accurate IT asset, hardware and software licensing records, supporting effective asset management and audit readiness.
• Supported endpoint security, patching, configuration management and cybersecurity awareness in accordance with organisational ICT policies and standards.

IT Technician - Wits University (Paracon) - Johannesburg

(2008-02 - 2009-02)

• Provided first-line and second-line technical support to academic and administrative users, resolving hardware, software, network and system-related incidents.
• Supported the installation, configuration, maintenance and troubleshooting of desktops, laptops, printers, peripherals and other ICT equipment.
• Assisted users with Microsoft Windows, Microsoft Office, email, network connectivity, system access and common application-related issues.
• Delivered user guidance and basic IT training while developing technical documentation, troubleshooting guides and user support procedures.
• Maintained IT asset records and supported hardware deployment, software installation, equipment maintenance and general ICT operational activities.

QA Tester (Intern) - Vodacom SA - Johannesburg

(2007-08 - 2008-02)

• Improved software quality by designing and executing functional, regression, integration and performance testing for VLive products.
• Developed and maintained test cases, test scenarios and test scripts, ensuring requirements and business processes were adequately validated.
• Identified, documented and tracked software defects, working closely with developers to investigate root causes and verify fixes.
• Supported automated regression testing, improving test coverage and ensuring consistent validation of application releases.
• Conducted user acceptance and release testing, validating system functionality, performance and stability before production deployment.

Master of Business Administration - Mancosa (2023)

Bachelor of Laws - Laws - Unisa (2024)

Postgraduate Diploma in Information Technology Management - Information Technology Management - Mancosa (2021)

Bachelor of Business Administration - Business Administration - Unisa (2019)

Higher National Certificate: IT Systems Development - IT Systems Development - Boston City Campus (2007)

Higher National Certificate: IT Technical Support - IT Technical Support - Boston City Campus (2005)

National Certificate – Engineering Studies N4 - Engineering Studies - Central Johannesburg College (2003)

Fundamentals of Project Management Certificate - Project Management - Milpark Business School (2011)

Senior Certificate - Frans Rasimphi Secondary School (2000)

Applied Risk Management - Risk Management - Unisa (2020)