Joint Standard 2 of 2024: Cybersecurity and Cyber Resilience Requirements compliance software
The FSCA and Prudential Authority's cybersecurity and cyber resilience standard for South African financial institutions, effective 1 June 2025: 90 controls across 13 domains, with the 24-hour material incident notice under Joint Notice 2 of 2026 tracked.
- RegulatorsFinancial Sector Conduct Authority and Prudential Authority
- InstrumentJoint Standard 2 of 2024 under section 107 of the Financial Sector Regulation Act, 2017; effective 1 June 2025
- Structure13 domains · 90 controls, including Testing and Assurance domains
- NotificationsMaterial incidents: initial notice within 24 ordinary hours of classification, impact update within 14 days (Joint Notice 2 of 2026, from 1 September 2026)
What Joint Standard 2 requires
Who it applies to
- Banks, branches of foreign banks, mutual banks and their controlling companies, with branches and subsidiaries of the banking group brought into scope
- Insurers and the controlling companies of insurance groups, including foreign subsidiaries in the group
- Collective investment scheme managers, market infrastructures, OTC derivative providers and credit rating agencies
- Pension funds, section 13B administrators, discretionary and administrative FSPs, and Category I FSPs providing investment fund administration
Joint Standard 2 of 2024 was made by the Financial Sector Conduct Authority and the Prudential Authority under section 107 of the Financial Sector Regulation Act, 2017. It was published on 17 May 2024 and took effect on 1 June 2025 under Joint Notice 1 of 2024, with no transitional provisions of its own. It sits beside Joint Standard 1 of 2023 on IT governance and risk management, in force since 15 November 2024, and reaches further: pension funds, section 13B administrators, OTC derivative providers, credit rating agencies and Category I FSPs providing investment fund administration are within Joint Standard 2 but outside Joint Standard 1.
The Standard sets requirements for roles and responsibilities, governance, a cybersecurity strategy and framework, and the cyber resilience fundamentals of identification, protection, detection, response and recovery, situational awareness and testing, plus minimum hygiene practices: access and privileged access management, multi-factor authentication, perimeter defence, patching, secure configuration and malware protection. Every requirement is proportionate to the institution's nature, size, complexity and risk profile, but some are hard minimums, such as penetration testing of internet-facing systems at least annually. GRCLens carries 90 controls across 13 domains, including a Testing domain and an Assurance domain for the annual strategy review, the annual independent review of the framework, control effectiveness and remediation of findings.
Material incidents are notified to the responsible authority in the form the Authorities determine. Joint Notice 2 of 2026, effective 1 September 2026, fixes that form: an initial notification within 24 ordinary hours of classifying an incident as material, with weekends and public holidays counted, the impact section within 14 calendar days and a final report within a period agreed with the authority. Banks, mutual banks and insurers submit through the Prudential Authority's Umoja Portal; other institutions use the FSCA's Joint Standards Submission Portal. Outsourcing an IT or security service does not transfer the duty to notify.
How GRCLens supports Joint Standard 2
Joint Standard 2 runs on the same shared control model as every other framework in GRCLens, so evidence captured once can satisfy several obligations at the same time.
The 24-hour clock, stage by stage
Classification, the initial notice, the 14-day impact update and the agreed final report are tracked separately, against the portal each institution must use, so a missed stage shows before the Authorities ask about it.
Paragraph-level controls
Each control quotes the Standard's paragraph, with guidance on what supervisors ask for first, such as the inventory of internet-facing systems with their last test dates, and the deliverables that evidence it.
Hygiene practices kept visible
The section 8 hygiene practices, including the three populations that must have multi-factor authentication, form a domain of their own rather than being scattered through the fundamentals, because they are the easiest gaps to find and the hardest to explain.
Group scope and third parties
Paragraphs 3.2 and 3.3 bring branches and subsidiaries of banking and insurance groups into scope, and third-party duties spread through the Standard are gathered in one domain that reads from the supplier register.
Beside Joint Standard 1 and POPIA
Controls that depend on Joint Standard 1 of 2023 cite it, and shared safeguards carry evidence for POPIA section 19 and ISO/IEC 27001 at the same time.
Joint Standard 2 frequently asked questions
Who must comply with Joint Standard 2 of 2024?
Banks, branches, mutual banks and controlling companies; insurers and insurance group controlling companies; collective investment scheme managers; market infrastructures; discretionary and administrative FSPs; Category I FSPs providing investment fund administration; pension funds; section 13B administrators; OTC derivative providers; and credit rating agencies.
When did Joint Standard 2 take effect, and is there a transition period?
It took effect on 1 June 2025 under Joint Notice 1 of 2024. The Standard itself has no transitional provisions; the year between publication on 17 May 2024 and the effective date was the time to prepare.
How quickly must a material cyber incident be reported?
From 1 September 2026, within 24 ordinary hours of the institution classifying it as material, using the template determined by Joint Notice 2 of 2026. The impact section follows within 14 calendar days and the final report within a period agreed with the responsible authority.
How does Joint Standard 2 relate to Joint Standard 1 of 2023?
Joint Standard 1 sets IT governance and risk management requirements and has applied since 15 November 2024; Joint Standard 2 adds the cybersecurity and cyber resilience requirements. Joint Notice 2 of 2026 sets one template for material IT and cyber incidents under both Standards.
Does Joint Standard 2 require annual penetration testing?
For systems directly accessible from the internet, yes: they must be tested whenever they undergo major changes or updates, and at least annually if they do not. Critical systems must also be penetration tested, and the responsible authority may specify black box, grey box or white box testing.
One platform, many obligations
See all supported frameworks → Every framework that applies in South Africa →
Talk to us about Joint Standard 2
Security Solution Consultants provides Joint Standard 2 and financial sector cyber advisory alongside the platform, so you can combine tooling with hands-on expertise.