South Africa Cyber Rules: Joint Standard 2 of 2024 and the Cybercrimes Act

South African banks, insurers, pension funds, market infrastructures and many financial services providers now have a binding cyber security standard, and a fixed template and clock for reporting material incidents, published by the regulators in September 2026. Joint Standard 2 of 2024, Cybersecurity and Cyber Resilience Requirements, was issued by the Prudential Authority (PA) and the Financial Sector Conduct Authority (FSCA) and took effect on 1 June 2025. It works alongside Joint Standard 1 of 2023 on IT governance and risk management, and, once section 54 commences, the Cybercrimes Act's duty to report cybercrime to the police. This guide covers scope, the main obligations, the incident reporting route, and where service accounts and other non-human identities fit. It is written for CISOs, IT risk and compliance teams, and outsourced providers serving South African financial institutions. Personal information breaches are covered in the South Africa POPIA Guide.

Sources: the text of Joint Standard 2 of 2024 could not be accessed, so this page is based on secondary sources: summaries by the law firms Michalsons, Webber Wentzel and Clyde & Co, reporting by Moonstone, the PA and FSCA Joint Communication 2 of 2024 as reproduced by RegAlert, and the Prudential Authority's page for Joint Communication 5 of 2026. Each obligation names its source. Figures and deadlines appear only where two independent sources agree. Confirm against the official text before relying on it.

Key takeaways

• In force since 1 June 2025. Michalsons, Webber Wentzel and Moonstone all give 1 June 2025 as the commencement date for Joint Standard 2 of 2024.
• Wide financial sector scope. Michalsons lists banks, mutual banks, insurers, collective investment scheme managers, market infrastructures, discretionary and administrative FSPs, pension funds, OTC derivative providers and credit rating agencies.
• 24 hours to report a material incident. Moonstone and Clyde & Co both report an initial notification within 24 hours and an update within 14 days, under the template determined in Joint Notice 2 of 2026.
• Principles, applied proportionately. Michalsons describes the standard as principle based, applied according to an institution's risk appetite, nature, size and complexity.
• Identity and access are core controls. Webber Wentzel reports duties to limit access to authorised users, processes and devices; Moonstone reports PA guidance stressing regular review of privileged access and multi-factor authentication.

The South African instruments

The standard's consultation ran from a first draft on 15 December 2021 through a revised draft on 13 December 2022 to tabling in Parliament on 30 November 2023, according to Joint Communication 2 of 2024 as reproduced by RegAlert.

Who is in scope

Clyde & Co's reading of the 2025 draft placed market infrastructures on the Umoja Portal; the final routing reported by Moonstone names banks, mutual banks and insurers for Umoja. Check the Joint Notice for your licence type. Service providers to financial institutions are affected indirectly through contracts (Michalsons).

Key obligations

Governance and strategy

• Governing body: ensures compliance, oversees cyber risk management, and works with senior management on a cyber security strategy and framework (Michalsons).
• Strategy and framework: maintained to respond to changing threats, manage risk, allocate resources and close gaps (Webber Wentzel).
• Awareness: cyber security awareness training for staff and the governing body, reviewed against current threats (Michalsons, Webber Wentzel).

Identify and protect

• Classification: classify processes and information assets by criticality and sensitivity, including those held by third parties, and assess risk to critical operations (Webber Wentzel, Moonstone).
• Access: limit access to authorised users, processes and devices, with identity and access policies that cover remote access (Webber Wentzel).
• Hygiene: manage user access, review privileged access regularly, apply defence in depth and use multi-factor authentication, including on critical systems (Moonstone, reporting the PA's guidance).
• Cryptography: encrypt information in systems and on endpoints, or protect it with access controls proportionate to the risk (Webber Wentzel).

Detect, test, respond and recover

• Detection: monitor for anomalous activity and detect cyber events (Moonstone, Michalsons).
• Testing: verify controls work through vulnerability assessments, penetration tests, simulation exercises and application security testing, and remediate findings (Michalsons, Moonstone). The secondary sources give no testing frequency.
• Situational awareness: understand the threat landscape and take part in threat intelligence sharing (Moonstone, Michalsons).
• Response and recovery: an incident response policy and tested plans (Michalsons, Moonstone). The PA's analyst, quoted by Moonstone, said every institution must assume attackers will eventually gain access.

Third parties

Contracts and service level agreements define security roles and require compliance with the standard; contracts provide for secure return, transfer or deletion of data when services end (Michalsons, Webber Wentzel). Insurers also have the separate outsourcing standard, Joint Standard 1 of 2024, from 1 December 2024 (Webber Wentzel). See the Third-Party Security Contract Clauses Template.

Reporting material IT and cyber incidents

Moonstone reports that materiality is the institution's own judgement, that the template asks for the criteria used, that one notification can cover both Joint Standards, and that outsourcing does not move the duty to report. POPIA notifications to the Information Regulator and any payment system reporting run separately. Build the 24-hour clock into your playbooks from the moment of classification, not detection, and decide in advance who classifies. See the Financial Services Incident Response Guide.

The Cybercrimes Act and financial institutions

Section 54 of the Cybercrimes Act 19 of 2020 will require electronic communications service providers and financial institutions to report cybercrime involving their networks or services to the South African Police Service within 72 hours of becoming aware of it, and to preserve information that may help the investigation (Webber Wentzel, Michalsons). Non-compliance can attract a fine of up to R50,000 on conviction (Webber Wentzel, Michalsons). Both sources say section 54 had not commenced when they were written; check the current status before building it into procedures. The offences themselves are covered in the South Africa Cybercrimes Act Guide.

What it means for non-human identities and AI agents

• "Processes and devices" are identities: the access duty Webber Wentzel describes covers authorised processes and devices as well as users. Service accounts, API keys, certificates and AI agent credentials need the same owner, scope and review as staff accounts. See the Service Account Security Guide.
• Privileged access review: include automation accounts with administrative rights, and vendor accounts, in the regular privileged access reviews the PA guidance stresses.
• Assets held by third parties: classification extends to assets held by third parties, which includes credentials your SaaS and outsourcing providers hold into your environment.
• Materiality scenarios: add leaked keys, abused integration tokens and compromised build pipelines to the scenarios used to classify incidents, so the 24-hour clock is applied consistently.

Compliance steps

1. Get the texts: download Joint Standard 1 of 2023, Joint Standard 2 of 2024 and Joint Notice 2 of 2026 from the PA or FSCA, and record the versions.
2. Gap assess: one row per requirement, owner, evidence and status.
3. Classify assets: critical processes and information assets, including those at third parties, and the identities that reach them.
4. Fix access: MFA on critical systems, regular privileged access reviews, and owned, scoped credentials for processes and devices.
5. Test: vulnerability assessments, penetration tests and simulations scaled to your risk, with tracked remediation. See the Penetration Testing Guide.
6. Wire up reporting: materiality criteria, the template, portal access and a 24-hour clock from classification.
7. Update contracts: security roles, incident notice and data return or deletion in every material supplier agreement.

Framework mapping

This mapping is NHI Mgmt Group's own; the Authorities do not publish one.

Measuring progress

• Requirements in the gap register with evidence of operation.
• Critical systems with MFA enforced for all interactive access.
• Privileged accounts, human and machine, reviewed in the last cycle.
• Time from material classification to notification in exercises, against 24 hours.
• Material suppliers with updated security clauses.

Common failure patterns

• Clock from detection confusion: playbooks that do not define who classifies materiality, so the 24-hour window starts late or is argued about.
• Human-only access reviews: privileged reviews that skip service accounts, scripts and vendor connections.
• Group assumptions: one group notification when each regulated entity must notify its own Authority, as Moonstone reports.
• Waiting for section 54: treating police reporting as irrelevant rather than preparing the process now.
• Paper frameworks: strategies approved by the board without testing evidence; the PA's analyst told Moonstone the Authority wants assurance providers to validate self-assessments.

Practitioner checklist

• Confirm which of your entities fall under Joint Standard 2 of 2024 and which portal each uses.
• Hold the official texts of both Joint Standards and Joint Notice 2 of 2026.
• Document materiality criteria and who classifies an incident.
• Test a 24-hour notification and a 14-day update in an exercise.
• Enforce MFA on critical systems and review privileged access, including machine accounts.
• Classify assets held by third parties and the credentials suppliers hold.
• Run vulnerability assessments and penetration tests and track remediation.
• Update supplier contracts for security roles, incident notice and data return.
• Track the commencement of Cybercrimes Act section 54.

Standards and references

• Prudential Authority: Joint Communication 5 of 2026, notification template for material IT and cyber incidents
• RegAlert: Joint Communication 2 of 2024 (reproduction)
• Michalsons: Cybersecurity and Cyber Resilience Requirements Joint Standard
• Webber Wentzel: Obligations of insurers related to cybersecurity and outsourcing
• Clyde & Co: South Africa's financial regulators bolster cyber resilience
• Moonstone: New IT and cyber incident reporting template now in effect
• Moonstone: Financial institutions urged to prioritise cyber resilience
• Webber Wentzel: Rights and obligations under the Cybercrimes Act
• Michalsons: The impact of the Cybercrimes Act on financial institutions
• Southern African Legal Information Institute: Joint Standard 1 of 2023

Related NHI Mgmt Group resources: South Africa POPIA Guide · Financial Services Cyber Regulation Map · Cyber Incident Reporting Requirements Map · Privileged Access Management Guide. This guide summarises South Africa's Joint Standard 2 of 2024 and related reporting rules as at 9 November 2026 and is not legal advice.