Joint Communications From The FSCA Cyber and IT Security
JOINT COMMUNICATIONS FROM THE FSCA CYBER AND IT SECURITY
Joint Communication 2 of 2025: Cloud Computing and Data Offshoring – 25 July 2025
On 25 July 25, the FSCA and Prudential Authority released Joint Communication 2 of 2025, signalling plans to draft a Joint Standard with clear rules for cloud use and data offshoring. This guidance emphasises the role of boards, trustees, and senior management in managing risks tied to these technologies.
Cloud computing is considered a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage facilities, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. Source:
Joint Communication 2 of 2025
The offshoring of data is the storage and/or processing of data outside the borders of South Africa.
The Joint Communication proposes that, when implementing any cloud computing and/or data offshoring solution, financial institutions should:
- Apply risk-based strategies tailored to their business size and complexity.
- Consider establishing strong governance structures, processes, and procedures. These could include, for example, formulating a defined policy, board-approved data strategy, and data governance framework that addresses the financial institution’s risk appetite for cloud computing and/or data offshoring.
- Take all reasonable measures to ensure the confidentiality, integrity, and availability of their data, information technology applications, or systems. Take all reasonable measures to ensure the confidentiality, integrity, and availability of their data, information technology applications, or systems.
- Consider contractual and other legal requirements for these services and the enforceability of rights and obligations arising from these contractual arrangements.
- Exercise appropriate due diligence before investing in the use of cloud computing and/or offshoring.
Any guidance from the FSCA is to be welcomed, given that increasingly, data is stored in the cloud offshore.
Joint Communication 3 of 2025: For consultation: Determination of the notification template in terms of Joint Standard 1 of 2023 – IT Governance and Risk Management for Financial Institutions and Joint Standard 2 of 2024 – Cybersecurity and Cyber Resilience Requirements for Financial Institutions – 3 September 2025
The Communication standardises how institutions report IT governance, risk management, cybersecurity incidents and cyber resilience measures to the Financial Sector Conduct Authority and Prudential Authority. You can view the reporting template here.
Don’t miss the deadline for input on the new notification templates!
Engage our strategic consultants to prepare your submission or discuss compliance before the October 5, 2025, comment due date.
Joint Communications From The FSCA Cyber and IT Security Read More »





