South Africa
FSCA/PA Joint Standards (IT & Cyber) compliance, made simple
12 yes/no questions for regulated financial institutions on Joint Standard 1 of 2023 (IT governance and risk management) and Joint Standard 2 of 2024 (cybersecurity and cyber resilience): board oversight, risk, controls, third parties, testing, and reporting incidents to the regulators. You get a score for each area and a list of gaps with what to do about each one.
ComplianceDesk gives you 20 pre-built FSCA/PA Joint Standards (IT & Cyber) controls, an evidence vault, audit-ready reports, and reminders before anything falls overdue — so proving FSCA/PA Joint Standards (IT & Cyber) compliance stops being a spreadsheet exercise.
Take the free self-assessment: a score for each area and a list of gaps to close.
What is FSCA/PA Joint Standards (IT & Cyber)?
12 yes/no questions for regulated financial institutions on Joint Standard 1 of 2023 (IT governance and risk management) and Joint Standard 2 of 2024 (cybersecurity and cyber resilience): board oversight, risk, controls, third parties, testing, and reporting incidents to the regulators. You get a score for each area and a list of gaps with what to do about each one.
- Official name
- Joint Standards Self-Assessment (IT Governance and Cyber Resilience)
- Status
- In force. Shown as in force as we understand it. Check the current text with the regulator or an attorney, since provisions can be amended or commence at different times.
Who it applies to
- Whether it applies to you depends on your size, activities and licences. Use the free "Which laws apply to me?" checker, or read the first section of the self-assessment.
- The standards apply to financial institutions regulated by the Prudential Authority and the FSCA (for example banks, insurers and many financial services providers, subject to the scope in each standard). Joint Standard 1 is reported to have commenced on 15 November 2024 and Joint Standard 2 on 1 June 2025. Answer Not applicable throughout if you are not such an institution.
What you have to do
Do the standards apply, and governance
A business should be able to show that it can answer yes to these: Have you confirmed that the standards apply to you and recorded how, including which entities and services are in scope? Does the board (or governing body) approve and oversee the IT strategy, IT risk appetite and cyber strategy, and review reports on them regularly? Are roles and accountability for IT and cyber risk clear, including a senior person responsible for each? Do you have written, approved policies for IT governance, information security and cyber resilience that are reviewed at least once a year?
Risk, controls and third parties
A business should be able to show that it can answer yes to these: Do you identify and assess IT and cyber risks, keep a register, and manage them to your risk appetite? Do you manage the identification, protection, detection, response and recovery capabilities that the cyber standard expects, such as access control, patching, monitoring and backups? Do you manage the cyber and IT risk of third parties and cloud providers, with contracts and oversight proportionate to the risk? Do you test your cyber defences and your response and recovery plans on a regular basis, and act on what you find? Do you have business continuity and disaster recovery plans for critical IT services, with recovery objectives that are tested?
Incidents and reporting to the regulators
A business should be able to show that it can answer yes to these: Do you have an incident management process that classifies incidents and identifies when an incident is material? Do you notify the regulators of a material incident within the time allowed (reported as an initial notice within 24 hours of classifying the incident as material, an update within 14 calendar days, and a final report on a timeline agreed with the authority)? Do you also report data breaches to the Information Regulator and affected people under POPIA, and incidents to the SAPS where the Cybercrimes Act requires?
How to comply, step by step
- Do the standards apply, and governance. Map the standards' scope against your licences and group structure, and have compliance sign it off. Put IT and cyber risk on the board agenda each quarter and minute decisions. Document roles in a governance framework and review it each year. Keep a policy register with owner, approval date and next review date.
- Risk, controls and third parties. Run a yearly IT risk assessment that covers assets, threats, vulnerabilities and controls. Map your controls to each function and track gaps in a remediation plan. Keep a register of critical third parties, with due diligence and contract terms for each. See the POPIA operator agreement. Schedule vulnerability scans, penetration tests and recovery exercises, and track fixes. Set recovery time and recovery point objectives for each critical system and test them.
- Incidents and reporting to the regulators. Write materiality criteria and test them against past incidents. Build the notification steps and the regulators' template into your incident plan, and test them. See the POPIA and Cybercrimes Act assessments, and keep one combined reporting checklist.
Sources and review status
Compiled from the public sources below. It is not legal advice and has not been reviewed by a lawyer. Last researched 2026-11-01. This is general information, not legal advice. Laws change, so check the current text and the regulator's notices before relying on it.
- Joint Standard 1 of 2023: IT governance and risk management (Law Library)
- Cyber compliance is now mandatory for an FSP's risk management (Moonstone)
- New IT and cyber incident reporting template now in effect (Moonstone)
- Joint Standard on cybersecurity and cyber resilience requirements (Webber Wentzel)
- Joint Standard 1 of 2023 (ENS)
- Cybersecurity and cyber resilience requirements joint standard (Michalsons)
Every FSCA/PA Joint Standards (IT & Cyber) control, organised for you
The real control library ComplianceDesk seeds the moment you activate FSCA/PA Joint Standards (IT & Cyber) — 20 controls across 6 categories.
IT Governance & Strategy
- JS-1.1 Governing body oversees IT risk
- JS-1.2 IT strategy aligned to business strategy
- JS-1.3 IT roles and responsibilities assigned
IT Risk Management
- JS-2.1 IT risk management framework in place
- JS-2.2 IT asset and data inventory maintained
- JS-2.3 IT risk assessments performed regularly
IT Service & Change Management
- JS-3.1 Change management process enforced
- JS-3.2 IT incident and problem management
- JS-3.3 IT project governance
Cybersecurity Strategy & Controls
- JS-4.1 Cybersecurity strategy and framework approved
- JS-4.2 Access control and privileged access management
- JS-4.3 Data protection through encryption
- JS-4.4 Vulnerability management and patching
- JS-4.5 Security testing performed
- JS-4.6 Continuous monitoring and detection
- JS-4.7 Security awareness training
Incident Response & Reporting
- JS-5.1 Cyber incident response plan tested
- JS-5.2 Material incidents reported to the regulators
Resilience & Third Parties
- JS-6.1 Disaster recovery and continuity tested
- JS-6.2 Third-party and outsourcing cyber risk managed
Frequently asked questions
How can I check where my business stands on Joint Standards Self-Assessment (IT Governance and Cyber Resilience)?
Take the free self-assessment. It scores each area, lists your gaps with what to do about each one, and does not say you are compliant. You can save the result to ComplianceDesk to turn each gap into a task with an owner and a due date.
Is this guide written by a lawyer?
No. It was assembled from the public sources listed below and has not been reviewed by a lawyer. Treat it as a starting point and check the current law before relying on it.
How many controls does ComplianceDesk track for FSCA/PA Joint Standards (IT & Cyber)?
20, organised into 6 categories, ready to assign to an owner as soon as you activate the framework.
Can I track FSCA/PA Joint Standards (IT & Cyber) alongside other frameworks?
Yes — most teams activate several frameworks at once. Controls that overlap across frameworks can share the same evidence, so you don't collect the same document twice.
How long does it take to set up FSCA/PA Joint Standards (IT & Cyber) in ComplianceDesk?
Activating FSCA/PA Joint Standards (IT & Cyber) instantly seeds its full control library. Most teams assign owners and get their first controls moving within a day.
Other South Africa frameworks
See your full compliance picture
193 frameworks, one system of record.