CyberMax Advisory guides South African financial service providers through full JS2 of 2024 compliance — translating FSCA cybersecurity requirements into practical, proportionate governance your board can stand behind.
Joint Standard 2 of 2024 is a binding FSCA and PA standard applying to all licensed financial service providers. It goes beyond IT policy — it mandates board-owned cybersecurity governance with documented frameworks, tested controls, and ongoing risk management.
We operate as your external cybersecurity governance partner — bringing regulatory expertise and board-level communication skills to close the gap between your IT environment and your JS2 obligations.
A structured baseline assessment mapping your current cybersecurity posture against all JS2 control domains — producing a clear gap analysis and remediation roadmap.
End-to-end development of your JS2-compliant cybersecurity framework — including strategy, governance structures, roles & responsibilities, and control documentation.
Preparing your board and executive team to own, evidence, and report on cybersecurity governance — from sign-off templates to regulatory engagement support.
Assessing and formalising your IT service provider relationships in line with JS2's third-party risk requirements, including contract schedules and oversight frameworks.
Developing and testing your cyber incident response plan to meet JS2's notification and recovery requirements — so you're prepared before an incident occurs.
A final structured review before any regulatory inspection or internal audit — validating your evidence base, identifying residual gaps, and preparing your team for scrutiny.
Our engagement model mirrors the JS2 compliance lifecycle — structured, documented, and designed to produce evidence your board can rely on and your regulator can inspect.
Define your regulatory perimeter, organisational profile, and proportionality position. Establish project governance and stakeholder roles.
Structured review of current cybersecurity controls across all JS2 domains. RAG-rated gap analysis with risk prioritisation.
Build your JS2-compliant documentation suite — strategy, policies, roles, contracts, and board governance materials.
Guide your team through embedding controls, managing third-party obligations, and operationalising your framework.
Incident response tabletop exercises, control testing, and evidence validation to confirm your framework functions as designed.
Final review of your evidence portfolio, readiness scorecard sign-off, and preparation for regulatory inspection or internal audit.
We work with small to mid-size FSPs who need expert JS2 guidance without retaining a full-time cybersecurity executive. Our value is in bridging governance and security — not in technical delivery.
Begin with a no-obligation JS2 readiness conversation. We'll assess your current position, explain what's required for your organisation's size and risk profile, and outline a clear path forward.