April 2026 · Governance Note

SITA, Trapped Between Responsibility and Authority.

A structural diagnosis of South Africa's State Information Technology Agency: why a mandate designed for procurement produces rent without performance, and what a reformed mandate would actually need to look like.

The Verdict
Structurally successful at avoiding accountability.

SITA does not fail because it is incompetent. It fails because its mandate produces the outcomes the mandate claims to prevent.

A monopoly integrator with no payment enforcement, no delivery liability, and no exit for customers will always extract rent without performance. Every other symptom in the state IT record is a consequence of those three missing constraints.

01 · Mandate Mismatch

An operator without ownership. SITA hosts, administers and holds privileged access, but does not own the IP, the budget, or the procurement decision.

Consequence
It can keep systems alive technically while losing entitlement legally.
Pattern
Use continues. Authority doesn't.

02 · Infrastructure Blindness

Core state systems are still classified as “procured IT services” even after they become sovereign infrastructure.

Consequence
No doctrine marks the crossing from vendor product to national dependency.
Pattern
Procurement logic fails where continuity logic is needed.

03 · Centralisation Without Tools

Centralisation gives SITA visibility, access and control. It does not give shutdown authority, escrow mandates, or sunset enforcement.

Consequence
SITA inherits risk without instruments.
Pattern
Responsibility arrives; authority stays behind.

04 · Defensive Procurement

In a crisis, SITA retreats to process compliance, “awaiting instructions” and “procurement irregularity.”

Consequence
Individuals are protected; the state's legal position deteriorates.
Pattern
Courts increasingly reject it as a defence.

05 · Incentive Asymmetry

Acting decisively carries personal audit exposure. Delaying diffuses responsibility. The system rewards inaction dressed as compliance.

Consequence
Doing the right thing becomes a career risk.
Pattern
Delay compounds until litigation forces a move.

06 · Replacement Fantasy

“We'll just build another one.” But embedded systems take years to replicate, data gravity is enormous, and users resist.

Consequence
Replacement talk buys time but poisons negotiations.
Pattern
Courts read it as bad faith.

07 · No Stop Rules

No enforced rule says: if a system is mission-critical for X years, the state must own it or escrow it.

Consequence
Disputes drift indefinitely.
Pattern
Resolution only arrives when something collapses.

08 · The Visible Villain

Departments decide. Ministers hesitate. Treasury negotiates. But SITA touches the servers and flips the switches.

Consequence
When it blows up, the law lands on SITA.
Pattern
Structural failure, individual liability.
The Structural Diagnosis

SITA is a monopoly integrator with no payment enforcement, no delivery liability, and no exit for customers. Under those conditions the institution extracts rent without performance: income protected by authority rather than earned through delivery. Four mechanisms hold that equilibrium in place.

01 · Mandate

Mandate schizophrenia

SITA is simultaneously regulator (standards, compliance), broker (procurement middleman), operator (hosting, networks), and builder (custom systems). These roles should never coexist inside the same entity. Their coexistence guarantees conflicts of interest and guarantees that no single role can be held to account without the other three being invoked in its defence.

  • Three separate Boards governed SITA during the 2024/25 financial year. A new Board was constituted in February 2025 after the second interim Board dissolved in January.
  • The Parliamentary Committee found Board members were actively “acting like executives, frustrating the technical and executive processes” — the regulator and operator roles collapsed into each other at governance level.
02 · Asymmetry

No kill-switch symmetry

In ordinary markets, if the buyer stops paying, the service degrades or stops. Inside SITA's arrangements, the buyer can stop paying and the service continues, while the vendor who cuts service is punished. Payment discipline is broken by design. That asymmetry alone explains most of the downstream dysfunction.

  • The Departments of Home Affairs, Police Services, Basic Education, and Human Settlements all presented evidence to Parliament in December 2024 on the operational damage caused by SITA’s service failures — departments dependent on systems they cannot exit and cannot compel SITA to fix.
03 · Procurement

Procurement theatre

Compliance replaces competence. RFPs specify process, not outcomes. Delivery risk is transferred to vendors while control remains with SITA. The predictable result is that the worst vendors survive longest, because survival is rewarded by compliance documentation rather than by outcomes.

  • Capital expenditure for 2024/25: R380.9 million spent against a R1 billion allocation — a 62% underspend attributed directly to procurement delays in SITA’s own annual report.
  • A R1.2 billion tender for the Western Cape Education Department, approved through SITA’s supply chain processes, was referred to the Special Investigating Unit after Parliamentary committee intervention.
04 · Capability

Capability decay

Top-tier engineers avoid SITA for three rational reasons: no delivery authority, no technical prestige, and high political risk. Over time, the organisation becomes administrative-heavy and engineering-light, which makes it structurally dependent on the outside vendors it is simultaneously punishing.

  • Vacancy rate at year-end 2024/25: 57%. The annual report describes delivery capacity as “constrained by high vacancy rates… and a shortage of critical ICT skills.”
  • Three consecutive executive positions vacated in rapid succession: Managing Director Dr Bongani Mabaso (8 months); Company Secretary Bridgete Laka (under 2 months); Company Secretary June Cornelius (under 2 months).

When access control is guaranteed and exit is forbidden, performance becomes optional.

The systems insight
How SITA Describes Itself

Read against the structural mechanisms above, SITA's own “About” page reads less like a mandate and more like a document written by an organisation that does not know what it is for.

“SITA's role is to consolidate and coordinate the State's information technology resources to achieve cost savings through scale, increase delivery capabilities and enhance interoperability… managing the IT procurement and delivery process to ensure that the South African government gets value for money, increased productivity; qualitative solutions, services and products; and uses best practice IT approaches in its modernisation and the delivery of services to all citizens.”Source · sita.co.za/page/about
“To be the leading information and communications technology (ICT) agency in public service delivery.”Vision · sita.co.za/page/about
“To improve service delivery to the public through the provision of information technology, information systems and related services in a maintained information systems security environment to departments and public bodies; and to promote the efficiency of departments and public bodies through the use of information technology.”Statutory Mandate · SITA Act, Act No. 88 of 1998 · Section 7.1

Every verb in all three of those statements belongs to a procurement agent. Consolidate. Coordinate. Manage the procurement and delivery process. Achieve cost savings through scale. Improve service delivery through the provision of information technology. None of them describe the stewardship of infrastructure the state cannot turn off. The word ownership does not appear in any of them. Neither does continuity, escrow, sovereignty, lifecycle, sunset, or resolution. The copy is written as if the job ends at the tender award: once the contract is signed and the servers are humming, SITA's work is done and the rest is someone else's problem. And notably, this framing is not only on the website. It is in the Act of Parliament that created the organisation. The procurement-agent vocabulary was baked in at the founding. It has never been revised.

That is not a tone problem or a writing problem. It is a self-understanding problem. An organisation that describes itself only in the language of acquisition will, when dependency crises arrive, reach for the only instruments it believes it possesses: more procurement, more coordination, more delivery management. None of those instruments resolve HANIS. None of them resolve eNaTIS. None of them resolve the recurring court cases against the state's own operators. The vocabulary itself forecloses the possibility of a different kind of action, because there is no word for it in the brochure.

The values published alongside the mandate make the diagnosis sharper, not softer. Each one of them, set against the operational record, reveals a specific way the organisation has quietly stopped being able to recognise itself.

Value 01 · Customer-Centricity
“Exceed customer expectations by providing the best appropriate services and solutions.”

The first problem is that the customer, in SITA's model, is the department. Not the pensioner whose grant did not arrive because CPS and SASSA were still arguing about who had lawful authority to run the payment system. Not the new parent whose child's birth registration is trapped inside a HANIS replacement that has been “nearly ready” for the better part of fifteen years. Not the accused in a criminal matter whose trial is postponed because the digital recording system went down and no one can agree whose contract was supposed to be maintaining it.

Customer-centricity, in a procurement frame, means making the departmental client happy in the moment of transaction. Citizen-centricity, which is the thing the Constitution actually asks for, means being accountable for the continuity of the service the citizen never sees and only notices when it breaks. SITA's copy cannot tell the difference between those two things, and that confusion is not decorative. It is the reason a payment can lapse, a court recording can stall, a forensic system can sit under interdict, and no one inside the organisation feels that the person at the end of the chain is, strictly speaking, their customer at all.

Value 02 · Innovation
“Pursue innovation by demonstrating thought leadership and proactive behaviour on the use of ICT to enhance public service delivery.”

The judicial record sits at the exact opposite end of the word “innovation” from where SITA's About page places it. What the courts describe is an organisation whose instinctive answer, when a dependency becomes uncomfortable, is to modify copyrighted source code it has no licence to touch, switch the system back on in defiance of a vendor cut-off, and then pursue a shadow replacement while denying that the original agreement existed at all. That is not innovation. It is improvisation under legal duress, dressed up as a roadmap.

Real innovation in state IT, in the current moment, would look like things SITA has never publicly proposed. A classification doctrine that distinguishes commodity IT from sovereign infrastructure. A standing escrow regime for any system that crosses the critical threshold. A formal sunset protocol with legal cover for the official who has to sign it. A transition fund. A lifecycle owner. None of these are technically hard. They are institutionally hard, because they require the organisation to stop thinking of itself as a buyer. “Thought leadership,” as a published value, has produced none of them. What it has produced is the word “modernisation” deployed as a negotiating tactic against the vendors of systems the state can no longer operate without.

Value 03 · Integrity
“Conduct our business with integrity at all times to inculcate a culture of honesty, respect and accountability among all our employees.”

Gauteng High Court judgments have made explicit findings of mala fides, bad faith, against the state's conduct in IT disputes. That is not a procedural irregularity finding. It is not “the paperwork was wrong.” It is a judge, looking at the record, and saying that over a period of years the state denied arrangements it knew existed, used software it knew it had no lawful right to run, and reactivated systems that had been placed under interdict. Integrity, in the sense the About page uses the word, is a culture-building aspiration. Integrity, in the sense the court uses the word, is a finding about what actually happened.

A values statement and a court judgment cannot both be true in the same way at the same time. The honest thing to do, if SITA believed its own published value, would be to treat those findings as a constitutional event and rewrite the organisation around preventing them. Instead, the more characteristic response has been to argue that each one was an unusual case, an unusual vendor, an unusual set of circumstances. They are not. They are the cases in which a vendor had the resources to litigate far enough for the pattern to become visible on the public record.

Value 04 · Agility
“Be adaptive and responsive in an evolving environment in order to maintain relevance and competitive advantage.”

eNaTIS has been waiting for a serious replacement conversation since 2007. HANIS has been inside a replacement process whose end date keeps receding since the early 2010s. The PRASA signalling estate degraded visibly for the better part of a decade while the contracts to replace it were fought over. Whatever word one uses to describe an institution whose replacement cycles are measured in decades, “agile” is not it. Neither is “adaptive.” Neither is “responsive.”

What SITA exhibits, in the judicial record, is something closer to the opposite of agility: a reflexive retreat, in every crisis, to the safest possible bureaucratic posture. “Awaiting instructions.” “Procurement irregularity under review.” “The matter is the subject of legal proceedings.” These phrases are not agility. They are the organisational equivalent of freezing. The evolving environment the value statement gestures at is the environment in which embedded systems become national infrastructure within a few years of installation, and no state IT agency in the world can afford to meet that timescale with a decade-long replacement conversation. Relevance and competitive advantage, in that environment, accrue to the institutions willing to own what they run. SITA is not yet one of them.

Value 05 · Collaboration
“Cooperate and support each other in pursuit of our shared goals to achieve synergies and greater productivity.”

The collaboration value, read against the court record, is the one that stings. Judgments describe situations in which the state was actively running a proprietary system under a contractual arrangement it was simultaneously denying in writing, while in parallel commissioning work on a replacement intended to displace the same vendor whose software was still keeping the lights on. That is not collaboration. It is, in the plainest possible terms, the opposite of collaboration conducted under the heading of collaboration.

The difficult question the value raises is not whether SITA collaborates with its staff, with its board, or with other departments. It plainly does. The question is whether it can collaborate with the outside parties whose work has become infrastructure for the state, once the commercial relationship becomes inconvenient. The answer, on the record, is that it cannot. And because it cannot, the eventual resolution of every one of these disputes has to arrive through litigation, through Treasury intervention, or through collapse. None of those are collaborative instruments. They are the instruments that activate when collaboration has already failed.

Value 06 · ICT as Game-Changer
“SITA views ICT's as a national socio-economic game changer; through which ICT investment must be equated with growth, impact and citizen satisfaction.”

This is the sentence that most completely gives the game away. Read it carefully. ICT investment must be equated with growth, impact and citizen satisfaction. The unit of analysis is investment: the act of buying. Not operation. Not ownership. Not continuity. The implicit theory of change is that the state procures the right things, and the rest takes care of itself. That is a theory that can only survive in an organisation that has not yet noticed that the hardest part of state IT is what happens after the money has been spent.

If ICT is genuinely a socio-economic game-changer, then the institution responsible for it cannot also treat it as a procurement line item. Those two framings are mutually exclusive. Infrastructure is not purchased once and then managed through a series of vendor contracts; it is inhabited, maintained, evolved, and occasionally rebuilt from the inside by people who understand it well enough to know when to stop paying a vendor and when not to. SITA's own framing, in this one sentence, collapses the category the reform depends on. You cannot be the steward of something you still describe as a purchase. And until the About page is rewritten to describe a different kind of institution, every reform proposal (including the eight in the section below) will land on an organisation that does not yet have the vocabulary to receive them.

The problem is not that SITA fails to live up to its values. The problem is that its values describe a procurement agent, and its job is infrastructure stewardship. The gap between the two is where the unlawfulness accumulates, quietly, continuously, and with the paperwork in order.
The Official Record

The structural diagnosis is not a reading between the lines. It is visible in SITA’s own audited annual report and in the findings of a Parliamentary Portfolio Committee oversight visit conducted in December 2024. These are primary documents. They confirm the pattern from the inside.

Primary Source 01

SITA Annual Report 2024–2025

  • Audited performance: 42.86% target achievement for 2024/25 — a sharp regression from 61.9% the prior year, and well below the threshold at which an agency can claim its mandate is being met.
  • Vacancy rate: 57%. The Acting Managing Director describes delivery capacity as “constrained by high vacancy rates… and a shortage of critical ICT skills.”
  • Capital expenditure: R380.9 million spent against a R1 billion allocation. The stated cause is procurement delays. A 62% underspend in infrastructure capital is not a budget problem; it is a process problem wearing a budget number.
  • Service revenue growth: 4% against a planned 10%, attributed to project delays, reduced client budgets, and “a shift in some portfolios towards non-traditional revenue models.”
  • EBITDA margin exceeded target at 10.26% — meaning the organisation was financially viable while failing to deliver. Rent without performance, confirmed by the agency’s own audited numbers.
  • The statutory mandate in the SITA Act (Act No. 88 of 1998) uses exclusively service-provision and efficiency language. No ownership. No lifecycle authority. No sovereign continuity. The procurement-agent framing is not an interpretation: it is the founding legislation.
State Information Technology Agency SOC Ltd — Annual Report 2024–2025
Primary Source 02

Portfolio Committee Oversight Report, 12 February 2025

  • The Portfolio Committee on Communications and Digital Technologies conducted an urgent oversight visit to SITA on 11 December 2024, describing the purpose as addressing “significant governance and executive management challenges” following a performance regression that left the Committee unable to wait for ordinary scheduling.
  • The Committee found “the lack of service delivery was due to the encroachment of the Board on the executive duties” — not vendor failures, not technology complexity, but a structural governance failure in which the organisation could not keep its own roles separated.
  • The Departments of Home Affairs, Police Services, Basic Education, and Human Settlements each presented separately to Parliament on failures attributable to SITA. Outdated infrastructure, persistent system downtimes, and network outages were named specifically.
  • A R1.2 billion tender approved through SITA’s supply chain for the Western Cape Education Department was referred to the Special Investigating Unit. The Committee found SITA’s supply chain management practices “weak.”
  • The Committee recommended Parliament seek legal advice on establishing an Ad Hoc Committee to investigate governance, operations, and criminal conduct at SITA — a signal that ordinary oversight is no longer considered sufficient.
  • Parliament requested a five-year mandate impact assessment from SITA: an implicit acknowledgment that the question is no longer only whether execution was poor, but whether the mandate itself has produced the outcomes it was designed to prevent.
Portfolio Committee on Communications and Digital Technologies — Oversight Visit Report, 12 February 2025
When Parliament asks an agency to account for its mandate across five years of declining performance, that is not a governance event. That is a structural one. The question being asked is whether the organisation is capable of fulfilling the mandate it was given — or whether the mandate itself produced the failure.
The Recurring Pattern

Across eight documented cases the same sequence plays out: a mission-critical system becomes infrastructure, procurement logic fails, and litigation or collapse forces resolution.

Case Period Pattern
SASSA / CPS grants 2012–2018 Contract lapsed; system kept running under Constitutional Court supervision to prevent social collapse.
Home Affairs HANIS / ABIS 2000s–2020s Biometric backbone. Replacement stalled by procurement disputes; parallel systems, years of limbo.
SARS Modernisation 2014–2018 Working compliance and investigative IT dismantled under “governance correction.” Revenue collapsed.
RTMC eNaTIS 2007–present Single embedded licensing database. Weak redundancy. Replacement perpetually deferred.
PRASA signalling 2015–2022 Ageing proprietary rail systems. Replacement contested; safety degraded before transition.
DOJ&CD court recording 2010s Vendor dependency; disputed contracts; courts reverting to manual. Legal system exposed to IT fragility.
Eskom IT estate 2010s–present Failed ERP transitions; informal maintenance tolerated to avoid outages.
SITA (cross-cutting) Ongoing Central procurement without lifecycle governance. Access without ownership clarity. Audited target achievement: 42.86% in 2024/25; 61.9% the year prior.
The national pattern is consistent: South Africa repeatedly lets mission-critical IT become infrastructure, then pretends it's still a procurement problem, until courts or failure intervene.
A Reformed Mandate

The core shift is one sentence: SITA must move from central IT procurement agent to state digital infrastructure steward.

01

Infrastructure Classification Power

Statutory authority to issue a Critical Infrastructure Determination that formally distinguishes commodity IT from national digital infrastructure. The determination triggers mandatory downstream obligations.

02

Mandatory Ownership or Escrow

If the state relies on a system for core sovereign functions beyond a defined threshold, it must either own the IP or hold enforceable source-code escrow with step-in rights, lodged at Treasury.

03

Full Lifecycle Authority

Not just acquisition and hosting, but exit, sunset, buy-out and forced migration. SITA must be able to impose transition deadlines and escalate unresolved systems to Treasury and Cabinet.

04

Emergency Continuity Regime

A formal, time-bound continued-use framework with automatic compensation accrual and transparent reporting. Removes the incentive to deny agreements or invent procurement excuses.

05

Shutdown Authority

Explicit power, with legal protection for the official exercising it, to declare that a system cannot lawfully be used after a specified date unless defined conditions are met.

06

Replacement Realism Rule

Before SITA may endorse or fund a replacement, it must certify realistic timelines, migration feasibility, data portability and overlap plans. No more “we'll build another one” as a tactic.

07

Treasury Resolution Escalator

When a critical system enters frozen-payment, lapsed-contract limbo beyond a fixed window, SITA must trigger a Treasury-led resolution: binding valuation, exit or buy-out, ring-fenced budget.

08

New Performance Metrics

Stop counting tenders processed. Start measuring the percentage of critical systems with clear ownership, time spent in transition, and the count of systems operating post-contract.

Procurement → Infrastructure → Sovereignty. Each phase has different rules. SITA currently pretends they are the same.
Share