Solid Guardian: How Proactive IT Monitoring Keeps Your Business Running
The platform behind our Managed IT Services: faster support, real-time visibility, patching and proactive maintenance.
Read the guide →Joint Standard 2 in short
Joint Standard 2 of 2024 is the FSCA and Prudential Authority’s legally binding standard on cybersecurity and cyber resilience for South African financial institutions, including banks, insurers, retirement funds and investment firms. It came into force on 1 June 2025. It requires a documented cybersecurity strategy, board accountability, regular risk assessments, tested incident response plans, third-party risk management and documented proof of compliance.
Soon, the questions will start.
“Are we compliant yet?”
“Did we complete the audit?”
“Who’s signing off on the cyber policy?”
And if your financial institution isn’t ready by 1 June, those questions may be coming from regulators – not just your internal team.
Joint Standard 2 of 2024 has officially kicked in, and the FSCA (Financial Sector Conduct Authority) and Prudential Authority are expecting every financial organization in South Africa to prove they’ve done the work. If your business hasn’t aligned with these new standards, you’re not just behind – you’re exposed.
What is Joint Standard 2?
Joint Standard 2 is a set of legally binding cybersecurity compliance regulations aimed at strengthening operational resilience in South Africa’s financial services sector. The regulations apply to a wide range of financial institutions, including:
- Banks
- Insurers
- Retirement Funds
- Investment Firms
- Other licensed financial entities
The purpose of Joint Standard 2 is to ensure that financial institutions take proactive measures to secure their data and systems against cyber threats. This includes everything from risk assessments and incident response planning to securing third-party vendors and maintaining comprehensive documentation.
The Impact of Non-Compliance
Failure to comply with Joint Standard 2 can have serious consequences. The FSCA and Prudential Authority have made it clear that they will be inspecting financial institutions for compliance and will penalize those that fall short. Penalties can include fines, reputational damage, and even potential restrictions on business operations.
But the risks go beyond just regulatory fines. Cybersecurity threats are evolving, and financial institutions that aren’t compliant with Joint Standard 2 are at an increased risk of a cyber attack. In 2024, ransomware and phishing attacks targeting financial firms in South Africa, particularly in Johannesburg and Cape Town, have increased by more than 40%. Non-compliance with these new regulations could leave you exposed to these threats and their financial, operational, and reputational costs.
Key Requirements of Joint Standard 2
To comply with Joint Standard 2, financial institutions must meet several key requirements:
Establish a Formal Cybersecurity Strategy
Your organization must have a clear, documented cybersecurity strategy. This strategy should outline how cyber risks are identified, assessed, mitigated, and monitored over time.
Board-Level Accountability
The board of directors must take ownership of cybersecurity risk management. This means assigning a board sponsor for cyber security and ensuring that cyber risk is discussed regularly at board meetings.
Conduct Regular Risk Assessments
Financial institutions must perform ongoing risk assessments to evaluate vulnerabilities in their systems and processes. These assessments should inform the institution’s cybersecurity strategy and identify areas of improvement.
Maintain Tested Incident Response Plans
Every financial firm must have an incident response plan in place. The plan should outline the steps to take in case of a breach, including communication strategies, containment measures, and recovery procedures.
Third-Party Risk Management
Financial institutions often rely on third-party vendors for services such as cloud storage, data processing, and payment processing. Under Joint Standard 2, firms must ensure that third-party vendors meet the same cybersecurity standards, and that any risk posed by these vendors is properly managed.
Compliance Reporting and Documentation
Your organization must maintain comprehensive documentation to demonstrate compliance with the standard. This includes records of risk assessments, incident response testing, and cybersecurity training programs. Regular reporting will be required to prove that your firm is meeting all the necessary requirements.
Your Compliance Plan
Here’s how to get started and ensure your firm meets the June 1st deadline for compliance:
Start with a Gap Analysis
Conduct a gap analysis to identify areas where your current cybersecurity strategy doesn’t align with Joint Standard 2. This will help you understand what needs to be improved before the deadline.
Assign Cybersecurity Responsibility at the Board Level
Make cyber security a top priority by appointing a board-level sponsor. This individual will be responsible for overseeing the implementation of the cybersecurity strategy and ensuring that all compliance requirements are met.
Conduct a Cyber Risk Assessment
Work with a trusted cybersecurity partner to conduct a comprehensive risk assessment. This will help you identify vulnerabilities in your systems and give you a roadmap for strengthening your defenses.
Update Your Incident Response Plan
Test your incident response plan with simulated cyber attacks. This will help your team understand their roles during a real-world breach and ensure that your firm can respond swiftly and effectively to any cyber incident.
Audit Your Third-Party Vendors
Evaluate your third-party vendors to ensure they meet the same cybersecurity standards. Make sure that they are compliant with Joint Standard 2 and have appropriate safeguards in place to protect your data.
Why It Matters
Joint Standard 2 is more than just a regulatory requirement. It’s an opportunity to strengthen your organization’s cybersecurity defenses and build trust with your clients, partners, and regulators. By complying with the standard, you can demonstrate your commitment to protecting sensitive financial data and staying ahead of emerging threats.
But compliance doesn’t stop with Joint Standard 2. It’s an ongoing process. Financial institutions must remain vigilant, regularly updating their cybersecurity strategies and monitoring for new threats. By embracing these standards, your firm will be better equipped to handle the evolving cyber threat landscape and ensure long-term resilience.
Conclusion: Don’t Wait Until It’s Too Late
The June 1st deadline for Joint Standard 2 compliance is fast approaching, and the time to act is now. With increasing cyber threats targeting South African financial institutions, the costs of non-compliance are too high to ignore. By taking proactive steps to align your firm with Joint Standard 2, you can ensure that your cybersecurity strategy is robust, comprehensive, and compliant with regulatory requirements.
Book your Zero-Cost Cyber Security Assessment now.
Need help with your Cyber Security compliance?
We run gap analyses and cyber risk assessments against Joint Standard 2, help you put the strategy, incident response plan and documentation in place, and manage the security controls day to day. See our IT audit service or book a consultation.
Frequently Asked Questions (FAQs)
What is Joint Standard 2?
Joint Standard 2 of 2024, “Cybersecurity and Cyber Resilience Requirements”, is a binding standard issued by South Africa’s Financial Sector Conduct Authority (FSCA) and Prudential Authority. It sets minimum cybersecurity and cyber resilience requirements for financial institutions.
When did Joint Standard 2 come into effect?
It came into effect on 1 June 2025, twelve months after it was published. Financial institutions are now expected to be able to show that they comply.
Who does Joint Standard 2 apply to?
Banks, insurers, retirement funds, investment firms and other financial institutions regulated by the FSCA and the Prudential Authority.
How do you comply with Joint Standard 2?
Start with a gap analysis, appoint a board-level sponsor, run a cyber risk assessment, update and test your incident response plan, audit your third-party suppliers, and keep documentation that proves each step.