Joint Standard 2: Cyber Resilience

Joint Standard 2 cybersecurity requirements make cyber risk management, control testing, monitoring, incident response and resilience a formal expectation for specified South African financial institutions. From a cybersecurity perspective, this makes external vulnerability visibility, email domain trust, ongoing risk evidence and board-readable reporting important parts of a financial institution’s cyber resilience approach.

Act no: N/A

Type: Principle-based

Purpose: Establishes minimum cybersecurity and cyber resilience standards for financial institutions to safeguard IT systems, data, and services.

1. A bank, a branch, a branch of a bank and a controlling company as respectively defined in section 1 of the Banks Act, 1990 (Act No. 94 of 1990);
2. A mutual bank as defined in section 1 of the Mutual Banks Act, 1993 (Act No. 24 of 1993);
3. An insurer and a controlling company as defined in section 1 of the Insurance Act, 2017 (Act No. 18 of 2017);
4. A manager as defined in section 1 of the Collective Investment Scheme Control Act, 2002 (Act No. 45 of 2002);
5. A market infrastructure as defined in section 1 of the Financial Markets Act 2012 (Act No. 19 of 2012);
6. A discretionary FSP as defined in Chapter II of the Notice on Codes of Conduct for Administrative and Discretionary FSPs, 2003 (Category II);
7. A category 1 FSP as contemplated in section 3(a) of the Determination of Fit and Proper Requirements for FSPs, 2017, that provides investment fund administration services;
8. An administrative FSP as defined in Chapter I of the Notice on Codes of Conduct for Administrative and Discretionary FSPs, 2003 (Category III);
9. A pension fund registered under the Pension Funds Act, 1956 (Act No. 24 of 1956);
10. An OTC derivative provider as defined in the Financial Markets Act Regulations;
11. An administrator approved in terms of Section 13B of the Pension Funds Act, 1956 (Act No. 24 of 1956) and
12. A registered credit rating agency as defined in section 1 of the Credit Rating Services Act, 2012 (Act No. 24 of 2012)

Financial Service Providers (FSPs), IT vendors servicing financial institutions.

• Board Accountability: Governing body must oversee cyber risk and approve cybersecurity strategies and frameworks [Clause 4.1, 4.2]
• Cybersecurity Strategy: Institutions must establish, maintain, and annually review a cybersecurity strategy aligned to business objectives [Clause 6.1.1–6.1.2]
• Access and Identity Management: Implement strict access controls and identity verification processes including strong authentication and remote access policies [Clause 7.2.2]
• Data Security Controls: Encrypt sensitive data, control endpoint access, and enforce secure data handling in both production and non-production environments [Clause 7.2.3]
• Incident Response and Recovery: Maintain tested plans for rapid response and recovery from cyber incidents, with defined RPO and RTO [Clause 7.4.1–7.5.1]
• Situational Awareness: Understand the cyber threat landscape, its implications for the institution’s operating environment, and the adequacy of cyber risk mitigation measures [Clause 7.6.1]
• Threat Intelligence Sharing: Participate in external cyber threat intelligence sharing and ensure internal monitoring systems are in place [Clause 7.6.2]
• Vulnerability and Penetration Testing: Regular vulnerability scans and penetration testing (black, grey, white box) on critical systems [Clause 7.7.2–7.7.3]
• Multi-Factor Authentication: Enforce MFA for critical systems, privileged accounts, and internet-facing applications [Clause 8.3.1]
• Malware and Patch Management: Proactively manage malware threats and apply patches in a timely and risk-based manner [Clause 8.5.1, 8.7.1]

Administrative penalties [Section 167 – Financial Sector Regulation Act]

N/A

Institutions may face regulatory interventions including supervisory reviews and enforceable undertakings [Section 134 – Financial Sector Regulation Act]

Customers are likely to lose faith in an FSP that has been exposed to security vulnerabilities or has failed to protect their data, leading to a decline in customer base and potential loss of revenue.

Supports DMARC implementation and monitoring to help reduce domain spoofing risk, improve outbound email trust, and move safely towards enforcement.

• Email System Authorisation: Ensures that only authorised email systems and domains are used for communication, reducing the risk of impersonation attacks [Clause 7.2.3(a)(v)]
• Internet Service Control: Helps detect and block unauthorised use of email-related internet services that could leak sensitive information [Clause 7.2.3(a)(vi)]

Provides a simple point-in-time Governance Record showing how the domain is set up to help protect against email impersonation, based on externally visible email authentication signals.

• Situational Awareness: Helps management document the domain’s externally visible email authentication posture, supporting understanding of email impersonation risk and the adequacy of related cyber risk mitigation measures. [Clause 7.6.1]

• South African Reserve Bank: Download the Joint Standard → South African Reserve Bank Prudential Authority
• Michalsons: Joint Standard on Cybersecurity and Cyber Resilience Requirements

(Links verified and active as of June 2026)

Where appropriate, we link to Michalsons’ expertly maintained legal resources and plain-language explanations. We gratefully acknowledge their role in making South African legislation more accessible and understandable.