Compliance & Cyber Intelligence for Insurance
Menu
Log in ↗
← People and Human Layer

CYB-30 · Cyber security

Mobile and remote working security — VPN or Zero Trust enforced; personal device (BYOD) policy in place

With load-shedding forcing staff to work from homes or alternative locations, remote working security is a persistent gap. All remote access to corporate systems and client data must be via VPN or a Zero Trust Network Access (ZTNA) solution. BYOD (personal device) usage for client data access must be governed by a formal policy with minimum security requirements.

High priority

Trigger

When this rule fires

Staff accessing client data over public WiFi without VPN; no remote access policy; personal devices accessing client data without minimum security controls; no mobile device management (MDM) on devices with client data

Applicability gate

Confirm the entity's role before treating this as a duty

This is a readiness rule mapped to JS2 themes. Its presence in the library does not establish that JS2 applies directly to the firm.

  • Insurance Broker: Most independent non-life Category I brokers are not directly in JS2's defined scope. A broker may be directly in scope if it separately meets a listed category, and may face contract or oversight requirements from an in-scope institution. Third-party provisions impose duties on the in-scope financial institution. They do not themselves make every supplier or intermediary directly subject to JS2.
  • Uma Binder Holder: UMA or binder-holder status is not itself listed in JS2's definition. Direct scope depends on another listed capacity; insurer contracts and oversight may create evidence requirements. JS2 paragraph 3.3 concerns juristic persons structured under an insurer or designated insurance group; it is not a blanket rule for every independent UMA or intermediary.
  • Insurer: An insurer as defined in the Insurance Act is directly in scope of JS2 from 1 June 2025. Apply proportionality and distinguish the insurer's own duty from requirements it places on third parties.

Citation

Mapped source

This control maps to the public instruments below. The mapping does not establish entity applicability.

Section
Joint Standard 2 of 2024 — paragraph 7.2.2(a)(v)–(vi) (remote access and BYOD) / POPIA s.19
Legislation
  • Joint Standard 2 of 2024
  • POPIA s.19

Remediation

How to close the gap

Deploy VPN or ZTNA for all remote access. Implement a BYOD policy requiring minimum controls (MDM enrolment, device encryption, remote wipe capability, MFA). Ban use of public WiFi without VPN in acceptable use policy.

Evidence required

Evidence to prepare if this control applies

  • VPN/ZTNA deployment confirmation
  • BYOD and acceptable use policy
  • MDM enrolment records
  • Remote access policy with controls
← Back to People and Human Layer