Act 19 of 2024; key provisions commenced 31 October 2025; third-party CII responsibility, STCC, expanded incident reporting including supply-chain incidents. Parts 3C and 3D (ESCI and foundational digital infrastructure) enacted but not commenced.