Cybersecurity Relevance
Joint Standard 1 IT governance requirements place importance on effective IT risk management, oversight, asset protection, access controls, resilience and incident reporting. From a cybersecurity perspective, this makes external risk visibility, secure digital services, email domain trust and governance-friendly evidence important parts of a financial institution’s IT risk management approach.
Overview
Name: Joint Standard 1 of 2023 – IT Governance and Risk Management for Financial Institutions
Act no: N/A
Effective Date: 15 November 2024
Type: Principle-based
Regulator: Financial Sector Conduct Authority (FSCA) and Prudential Authority (South African Reserve Bank)
Purpose: Establishes principles and minimum requirements for effective IT governance and risk management within financial institutions. Notes: Issued jointly by the FSCA and Prudential Authority under the Financial Sector Regulation Act 9 of 2017
Who Does This Affect?
Direct Applicability:
Applies to banks, mutual banks, insurers, collective investment scheme managers, market infrastructures, and discretionary/administrative FSPs [Section 3.1].
- a bank, a branch (commonly referred to as a ‘branch of a foreign institution’), a branch of a bank or a bank controlling company defined in section 1 of the Banks Act, 1990 (Act No. 94 of 1990);
- a mutual bank as defined in section 1 of the Mutual Banks Act, 1993 (Act No. 24 of 1993);
- an insurer and a controlling company of an insurer as defined in section 1 of the Insurance Act, 2017 (Act No. 18 of 2017);
- a manager as defined in section 1 of the Collective Investment Scheme Control Act, 2002 (Act No. 45 of 2002);
- a market infrastructure as defined in section 1 of the Financial Markets Act 2012 (Act No. 19 of 2012);
- a discretionary FSP as defined in Chapter II of the Notice on Codes of Conduct for Administrative and Discretionary FSPs, 2003 [Explanatory note: (Category II)]; and
- an administrative FSP as defined in Chapter I of the Notice on Codes of Conduct for Administrative and Discretionary FSPs, 2003 [Explanatory note: (Category III)].
High Impact On:
Banks, Insurers, Investment Managers, Market Infrastructures, IT Service Providers for Financial Institutions.
Key Requirements Relating to Cybersecurity
The key Joint Standard 1 IT governance requirements relate to the systems, controls and oversight financial institutions use to manage technology-related risk.
- IT Risk Framework: Institutions must establish, implement, and regularly review a comprehensive IT risk management framework [Clause 7].
- Material IT Risk Assessment: Institutions must be able to identify, assess and manage all material IT risks, taking proportionality into account [Clause 7.3(b)]
- Asset Protection: IT assets must be identified, prioritised, and safeguarded from unauthorised access or misuse [Clause 7.3(e)].
- Threat & Vulnerability Analysis: Institutions must assess the likelihood and impact of IT threats and establish mitigation controls [Clause 7.3(f)].
- Access Controls: Logical access to sensitive systems and data must be tightly controlled, enforced, and monitored [Clause 10.2(a)].
- Incident Notification: Material IT incidents must be reported to the responsible authority within the defined timeframe [Clause 15.1].
- Business Continuity & Resilience: Institutions must define recovery priorities and maintain tested IT resilience plans [Clause 13.1].
- Confidentiality Protections: Sensitive or personal data must be processed per POPIA and safeguarded against loss or theft [Clause 10.2(e)].
- Online Services Risk: Financial institutions must evaluate and mitigate IT risks specific to internet-facing services [Clause 11.1].
Consequences of Non-Compliance
Financial Penalties:
Administrative penalties imposed for contraventions of joint standards [Section 267 – Financial Sector Regulation Act].
Criminal Penalties:
N/A
Regulatory Consequences:
Potential licence revocation, directives, or other enforcement actions [Section 144 – Financial Sector Regulation Act].
Other Regulatory Actions:
Specific information or assurance may be requested by FSCA or Prudential Authority [Clause 15.2]
Reputational Harm:
The loss of trust and damage to reputation can have long-term consequences for an FSP, including decreased customer loyalty, reduced business opportunities, and potentially higher costs associated with rebuilding trust.
How ARMD.digital Supports Cybersecurity Compliance Efforts
Supports DMARC implementation and monitoring to help reduce domain spoofing risk, improve outbound email trust, and move safely towards enforcement.
- Confidentiality Protections: Helps prevent data leaks and phishing attacks via email spoofing [Clause 10.2(e)]
- Access Controls: Aids in enforcing domain-level communication controls [Clause 10.2(a)]
Provides a simple point-in-time Governance Record showing how the domain is set up to help protect against email impersonation, based on externally visible email authentication signals.
- Material IT Risk Assessment: Helps management document domain-level email impersonation risk, supporting the identification, assessment and management of material IT risks linked to business email and domain trust. [Clause 7.3(b)]
Additional Resources
- South African Reserve Bank (PA): Prudential Authority Publications
- Michalsons: Joint Standard Summary
(Links verified and active as of May 2025)
Where appropriate, we link to Michalsons’ expertly maintained legal resources and plain-language explanations. We gratefully acknowledge their role in making South African legislation more accessible and understandable.