Joint Communication 2 of 2024 – Cybersecurity and Cyber Resilience

1 Financial Sector Regulation Act, 2017 Joint Communication 2 of 2024 Publication of the Joint Standard 2 of 2024 – Cybersecurity and cyber resilience

1. PURPOSE This Communication informs stakeholders that today and pursuant to section 60(3)(b)(vi) and 42(b)(vi) of the Financial Sector Regulation Act (FSR Act), the Executive Committee of the Financial Sector Conduct Authority and the Prudential Committee of the Prudential Authority (the Authorities) have published the following documents: 1.1 Joint Standard 2 of 2024: Cybersecurity and cyber resilience (Joint Standard); 1.2 Statement of Need, Expected Impact and Intended Operation supporting the Joint Standard; and 1.3 Consultation Report.
2. SUMMARY 2.1 The Joint Standard sets out the requirements for sound practices and processes relating to cybersecurity and cyber resilience for financial institutions specified in the Joint Standard. 2.2 On 15 December 2021, the draft Joint Standard was released for public consultation in terms of section 101 of the FSR Act. Comments were due on 15 February 2022. On 13 December 2022, the Authorities released a revised version of the draft Standard for public consultation in terms of section 98 of the FSR Act with comments due on 28 February 2023. The Joint Standard was tabled in Parliament on 30 November 2023. 2.3 More detail on the need, expected impact and intended operation of the Joint Standard can be found in the document referred to in paragraph 1.2 of this Communication. 2.4 The process for making regulatory instruments is prescribed in Chapter 7 of the FSR Act. The said process has now been concluded, and the Authorities therefore published the final Joint Standard. 2.5 The Joint Standard is envisaged to commence on 1 June 2025. Notwithstanding the fact that the Joint Standard will likely take effect after 12 months, the Authorities urge the industry to prepare for its implementation. The Authorities will, as contemplated in paragraph 10.1 of the Joint Standard, formally determine the effective date in due course.
3. ENQUIRIES 3.1 The documents referred to in paragraph 1 are available on the Authorities’ websites at www.fsca.co.za. or www.resbank.co.za. FINANCIAL SECTOR CONDUCT AUTHORITY PRUDENTIAL AUTHORITY DATE: 15 May 2024 DATE: 16 May 2024