Independent assurance for smaller financial institutions
These standards apply to small FSPs too
Joint Standard 1 of 2023 sets IT governance and risk management requirements for financial institutions. Joint Standard 2 of 2024 builds on it with specific cybersecurity and cyber resilience obligations.
Both apply across the regulated sector — including smaller FSPs, brokers and independent advisors who assumed the standards were written for large institutions or banks. The expectations are proportionate to size. The obligation to demonstrate them is not. A two-person FSP still needs a strategy approved by the board, a maintained risk register, a tested incident response capability, and evidence that it can produce on request.
South Africa’s Prudential Authority (PA) and the FSCA now require financial institutions to comply with both Standards. Non-compliance can mean fines, regulatory intervention, and loss of customer trust.
Both standards are already in force. Institutions that have not yet demonstrated compliance are not preparing for a deadline — they are past one.
What we deliver
A single combined workbook
JS1 and JS2 requirements are consolidated into one workbook rather than two parallel exercises. Where the standards overlap — governance, risk assessment, third-party management — the requirement is addressed once and evidenced once.
Readiness assessment
Your position scored against every requirement in the workbook, with gaps prioritised by regulatory exposure rather than by ease of fixing.
A structured document repository
A single place where every policy, register, test record and board minute the standards require is filed, versioned and findable — set up in the Microsoft 365 tenancy you already have, not a separate system to license and learn.
Implementation on what you may already own
Working with your existing IT service provider or in-house IT Team. Technical controls aligned to Microsoft 365 Business Premium wherever the standard allows, so compliance is achieved on licensing most institutions already hold rather than through new purchases
Incident response and testing
Response playbooks, tabletop exercises, and documented evidence that the capability was tested — including the notification path and timeframes the standards require.
Strategy and board reporting
A cybersecurity and resilience strategy the board can approve, and reporting that demonstrates the board's involvement in the standards expected.
How the engagement runs
Assessment first, then implementation against the workbook
Engagements begin with a readiness assessment scoped to the size of the institution — for a smaller FSP this is a matter of weeks, not months. The output is a scored position against each requirement and a remediation plan you can take to your board.
Remediation is then carried out by your own IT team or provider, working from the workbook. Each technical control is specified against the Microsoft 365 licensing you (Potentially) already hold, wherever the standard allows, so the people doing the work know exactly what to configure and why. SACYBER reviews and signs off what has been implemented rather than implementing it — which is also what makes the sign-off worth having.
The combined workbook is handed over and belongs to you. It is not a report that goes stale after delivery — it is the record you maintain, evidence against, and produce when the regulator asks.
Where continuity is needed, this work often converts into a fractional CISO retainer, which also satisfies the expectation that someone senior owns cyber risk.
