Bianca Bekker, Legal Advisor at ICTS Legal Services

On 27 October 2026 the FSCA hosted a practical webinar on the implementation of Joint Standard 2 of 2024 – Cybersecurity and Cyber Resilience. The session was presented by Mr Andile Mjadu from the Regulatory Frameworks Department.

As someone who works closely with retirement funds on their compliance with the Joint Standard 2, I found the session particularly useful. It moved beyond high-level principles and gave clear guidance on what the regulator actually expects from boards and their service providers. Below I share the key points that stood out for me.

1. Governance remains the foundation

Mr Mjadu was emphatic that cybersecurity is a board-level responsibility. It cannot be left solely to IT specialists or outsourced to administrators.

The Board of Trustees remains ultimately accountable, even where every operational function has been outsourced. Accountability itself cannot be outsourced. Roles and responsibilities must be clearly documented so that individuals can be held accountable, and there should be appropriate independence between those who operate systems and those who oversee information security (“people should not mark their own homework”).

Importantly, cybersecurity must be treated with the same fiduciary priority as liquidity management, investment policy and other core fund obligations. If it is not being actively discussed and interrogated in the boardroom, the fund is already falling short of the FSCA’s expectations.

Key take-aways on governance

• Cybersecurity belongs in the boardroom, not only in the server room.
• Accountability cannot be outsourced.
• Clear roles and independence of oversight are essential.
• Treat cyber risk with the same priority as investment and liquidity risk.

2. Strategy, framework and basic hygiene

Funds and their critical service providers are expected to maintain a documented cybersecurity and cyber resilience strategy that is approved, kept current and reviewed at appropriate intervals.

Core hygiene practices remain non-negotiable: identity and access management, multi-factor authentication (MFA), data loss prevention, least-privilege access, and an auditable trail of activity. Having a policy document is not enough – the framework must be alive and enforceable.

Key take-aways on hygiene fundamentals

• Identity and Access Management
• Multi-factor authentication (MFA)
• Data loss prevention and least-privilege access
• An auditable trail of activity
• Regular review of the strategy and framework

3. Oversight of third-party providers

Because most South African retirement funds are heavily outsourced, the quality of third-party oversight is critical. The FSCA’s message was clear: funds must obtain sufficient assurance, not merely high-level statements.

Contractual clauses that simply say “notify us of an incident” are no longer regarded as adequate. Contracts should contain clear, measurable notification timelines. Where possible, funds should also negotiate audit or independent assurance rights. Concentration risk and over-reliance on a single critical provider must be understood and managed.

Even a fund that has no systems of its own still carries an oversight obligation. The Board must be able to demonstrate that it is actively interrogating the providers on whose systems the fund depends.

Key take-aways on third-party oversight

• “Notify us of an incident” is no longer enough – use measurable timelines.
• Obtain sufficient assurance, not high-level statements.
• Consider audit / independent assurance rights in contracts.
• Understand and manage concentration risk.

4. Incident response and communication

When an incident occurs, a fund should be able to answer three practical questions within a reasonable time:

• Which systems have been targeted?
• Who is dependent on those systems?
• What is the level of disruption?

Notification from service providers should happen as soon as reasonably possible. Unreasonable delays should be raised with the provider and, where necessary, addressed through tighter contractual wording.

Equally important is communication with members. The FSCA stressed the need for clear, concise, plain-language communication to prevent misinformation and panic. Early communication is preferred, even if full details are not yet available.

Key take-aways on incident readiness

• Know which systems are affected, who depends on them, and the level of disruption.
• Notification must be timely and contractually enforceable.
• Communicate early with members in plain language to limit misinformation.

5. Assurance, testing and simulation

The regulator remains agnostic about the specific form of independent assurance (ISO 27001, SOC 2, ISAE 3402 or otherwise). What matters is that independent assurance can be demonstrated.

The FSCA did not prescribe any particular form of assurance and did not specifically address whether a “Cyber letter of assurance” (or letter of comfort) on its own is acceptable. The clear expectation is that the assurance provided must be independent and capable of being demonstrated. A self-issued letter of assurance from a service provider, without supporting independent verification, is unlikely to meet this expectation on its own.

Cyber simulation or tabletop exercises are strongly encouraged. Funds should be able to show that they have rehearsed for a “bad day” and can demonstrate that they acted as a reasonable trustee if ever called to account.

Key take-aways on preparedness

• Independent assurance matters more than the specific certification brand.
• A Cyber letter of assurance on its own is not specifically endorsed; independent, demonstrable assurance is required.
• Simulation / tabletop exercises help demonstrate “reasonable trustee” behaviour.
• Rehearse for a bad day – policies alone are not enough.

6. Culture and continuous improvement

Continuous awareness, training and upskilling of trustees, principal officers and relevant staff is expected. Boards should periodically check that cybersecurity is receiving appropriate attention on their agendas. Agility and timely responsiveness are treated as conduct issues, not purely technical ones.

7. Practical challenges acknowledged by the FSCA

The webinar also recognised real-world difficulties faced by funds, including:

• Fully outsourced funds that have no systems of their own still carry oversight duties;
• Trustees who use employer-issued devices and networks create a control gap that must be carefully managed; and
• Contractual leverage differs – it is generally easier to negotiate detailed terms with administrators than with insurers or other product providers.

Closing thoughts

The central compliance expectations under Joint Standard 2 of 2024 remain clear: strong governance, clear accountability, robust contractual notification requirements, early and plain-language communication, and the ability to demonstrate reasonable oversight and preparedness.

At ICTS Legal Services we continue to support funds with practical tools – Board self-assessments, service-provider questionnaires, SLA addendums, incident response frameworks and committee mandates – that help boards meet these expectations in a structured and defensible way.

ENDS