The SARB/FSCA Joint Standard on Cybersecurity and Cyber Resilience: A Control Build

A cybersecurity policy you can email to a regulator is not the same thing as a control the regulator can test. Joint Standard 2 of 2024 is built to tell the two apart.

Most commentary on South Africa’s Joint Standard reads it as a compliance summary — a tidy list of things a financial institution must now have. That misses what actually changed. The content of good cyber practice has been broadly settled for years; almost every board already claimed to hold most of it. What changed on 1 June 2025 is that the Prudential Authority and the Financial Sector Conduct Authority can now walk in and ask you to demonstrate it. The Joint Standard converts a set of aspirations into obligations a supervisor can examine. That is a different exercise, and it is an engineering exercise before it is a legal one.

What the standard is, precisely

Joint Standard 2 of 2024 on Cybersecurity and Cyber Resilience Requirements was issued jointly by the Prudential Authority, which sits within the South African Reserve Bank, and the FSCA, under the Financial Sector Regulation Act, 2017. It came into effect on 1 June 2025, with financial institutions given twelve months from that date to reach full compliance. It applies to a wide population: banks, mutual banks and their controlling companies, insurers and insurance groups, collective investment scheme managers, market infrastructures, several categories of financial services provider, retirement funds and their administrators, OTC derivative providers and credit rating agencies.

It is principle-based and proportional. Implementation is expected to scale with the nature, size, complexity and risk profile of the institution — a small administrator is not held to the depth expected of a systemic bank. Proportionality reduces the depth of the build; it does not remove the substantive requirement. It sits alongside Joint Standard 1 of 2023 on information technology governance and risk management, which the newer standard assumes rather than repeats.

Asserted versus evidenced

The governing body is ultimately responsible for compliance. The institution must establish and maintain a cybersecurity strategy that the board approves and reviews at least annually. If you have read anything on operational resilience from another financial regulator, this framing will be familiar — it is the same shift the DIFC made when it set out what a regulator means by operational resilience: the control must exist, operate, and be shown to operate.

The distinction that matters is between a document that exists and a control that runs. “We have multi-factor authentication” is an assertion. A coverage report showing MFA enforced across every remote-access path, every privileged account and every administrative console, with the exceptions named and dated, is evidence. The Joint Standard is written so that the second thing is what gets asked for. For now the authorities are working through self-assessment questionnaires, with a stated intention to bring in assurance providers to validate what firms report. Self-assessment is not the destination; it is the on-ramp to examination.

The control expectations, read as deliverables

Strip the standard back to what your technology function has to build and maintain, and it organises cleanly around the familiar resilience lifecycle:

• Identify. A maintained information-asset inventory, asset classification and a risk assessment over critical operations. This is the layer most firms underestimate, because a stale inventory quietly invalidates everything built on top of it — the asset register is a data-model problem long before it is a spreadsheet.
• Protect. Identity and access management, multi-factor authentication, privileged-access controls, data and application security, cryptography, patch and vulnerability management, and awareness training.
• Detect. Continuous monitoring and a security operations capability able to surface anomalies rather than merely collect logs.
• Respond and recover. Incident management, backup strategies and defined recovery objectives that have been tested against a real restore, not assumed.
• Test and learn. Regular vulnerability assessment, penetration testing and simulation exercises, with findings remediated on a tracked timeline and the programme adapted as the threat landscape moves.

None of this is novel. That is precisely the trap. Because each item reads as something you already do, it is easy to sign off the self-assessment on the strength of intent rather than operation.

The artefacts a supervisor will actually test

Assume an assurance provider arrives on the authority’s behalf. What they will want to see, on the day, is concrete: the board minute approving the current cybersecurity strategy; the strategy itself, with a review date inside the last year; an asset inventory that is current rather than eighteen months old; access-review evidence showing privileged accounts are recertified; penetration-test reports with a remediation tracker that closes findings; an incident register; and evidence that the controls actually influenced a decision — a vendor selection, a cloud migration, a change that was gated on a security review. Third-party arrangements should show cyber responsibilities written into the contracts, not held as an understanding.

If you can produce those and they tell one coherent story, you are defensible. If you have the documents but cannot show operation — the pen test with no remediation trail, the strategy no change decision ever referenced — you are in the position of stated compliance without evidence of operation. That is the position the Joint Standard is explicitly designed to catch.

The reporting clock

Material incidents must be notified to the responsible authority. On the timing the authorities have signalled a short clock: within 24 hours of classifying an incident as material, the institution is expected to report it. The precise template and the downstream reporting tiers were being operationalised through a further joint communication issued for comment during 2025, so confirm the exact fields and follow-up windows against the final version before you wire them into your incident runbook. The engineering consequence is unambiguous either way — your detection and triage have to be fast enough that classification happens in hours, not days, because the 24-hour clock starts at classification and a process that takes a week to decide whether an incident is material has already failed the test.

Where this will bite

The firms that will struggle are not the ones missing controls. They are the ones that treated the twelve-month window as a documentation programme — a policy refresh, a strategy signed by the board, a questionnaire returned — and left the evidence layer for later. The Joint Standard is a step on the same road every serious jurisdiction is walking, from cyber security as a stated posture to cyber resilience as a demonstrated one, the move I have described elsewhere as going from compliance to resilience. Supervision here is still maturing, which means the assurance visits are coming, not arriving. That is the window. Map your controls to the standard’s requirements now and build the evidence trail while you can do it calmly, because an assertion of compliance with nothing to demonstrate behind it will not survive the first person sent to check.