Self-assessment
Joint Standards Self-Assessment (IT Governance and Cyber Resilience)
12 yes/no questions for regulated financial institutions on Joint Standard 1 of 2023 (IT governance and risk management) and Joint Standard 2 of 2024 (cybersecurity and cyber resilience): board oversight, risk, controls, third parties, testing, and reporting incidents to the regulators. You get a score for each area and a list of gaps with what to do about each one.
1. Do the standards apply, and governance
The standards apply to financial institutions regulated by the Prudential Authority and the FSCA (for example banks, insurers and many financial services providers, subject to the scope in each standard). Joint Standard 1 is reported to have commenced on 15 November 2024 and Joint Standard 2 on 1 June 2025. Answer Not applicable throughout if you are not such an institution.
1. Have you confirmed that the standards apply to you and recorded how, including which entities and services are in scope?
(Joint Standard 1 of 2023, Joint Standard 2 of 2024)
2. Does the board (or governing body) approve and oversee the IT strategy, IT risk appetite and cyber strategy, and review reports on them regularly?
(Joint Standard 1 of 2023)
3. Are roles and accountability for IT and cyber risk clear, including a senior person responsible for each?
(Joint Standard 1 of 2023, Joint Standard 2 of 2024)
4. Do you have written, approved policies for IT governance, information security and cyber resilience that are reviewed at least once a year?
(Joint Standard 1 of 2023, Joint Standard 2 of 2024)
2. Risk, controls and third parties
1. Do you identify and assess IT and cyber risks, keep a register, and manage them to your risk appetite?
(Joint Standard 1 of 2023)
2. Do you manage the identification, protection, detection, response and recovery capabilities that the cyber standard expects, such as access control, patching, monitoring and backups?
(Joint Standard 2 of 2024)
3. Do you manage the cyber and IT risk of third parties and cloud providers, with contracts and oversight proportionate to the risk?
(Joint Standard 1 of 2023, Joint Standard 2 of 2024)
4. Do you test your cyber defences and your response and recovery plans on a regular basis, and act on what you find?
(Joint Standard 2 of 2024)
5. Do you have business continuity and disaster recovery plans for critical IT services, with recovery objectives that are tested?
(Joint Standard 1 of 2023)
3. Incidents and reporting to the regulators
1. Do you have an incident management process that classifies incidents and identifies when an incident is material?
(Joint Standard 2 of 2024)
2. Do you notify the regulators of a material incident within the time allowed (reported as an initial notice within 24 hours of classifying the incident as material, an update within 14 calendar days, and a final report on a timeline agreed with the authority)?
Sources say the 24-hour clock runs from classification as material, not from detection, and counts ordinary hours. The reporting communication was reported to take effect on 1 September 2026. Check the final joint communication and template. (Joint Standard 2 of 2024, Joint Communications)
3. Do you also report data breaches to the Information Regulator and affected people under POPIA, and incidents to the SAPS where the Cybercrimes Act requires?
(POPIA s22, Cybercrimes Act s54)
Sources
- Joint Standard 1 of 2023: IT governance and risk management (Law Library)
- Cyber compliance is now mandatory for an FSP's risk management (Moonstone)
- New IT and cyber incident reporting template now in effect (Moonstone)
- Joint Standard on cybersecurity and cyber resilience requirements (Webber Wentzel)
- Joint Standard 1 of 2023 (ENS)
- Cybersecurity and cyber resilience requirements joint standard (Michalsons)
Turn these gaps into tracked tasks
Assign owners and due dates, keep the evidence, and show your progress to clients and auditors.