Joint Standard 2 of 2024 is in force for defined financial institutions. Boards, insurers and service providers need evidence proportionate to their role.
Cyber risk is no longer only a technical concern. It can create governance, privacy, operational and commercial consequences, but the legal and contractual requirements differ by entity, service and relationship.
Three forces can converge on a broker or UMA
FSCA / PA Joint Standard 2 of 2024
In force since 1 June 2025 for the financial institutions defined in paragraph 2 — insurers among them. Most independent non-life Category I brokerages are not directly in scope in that capacity. A broker or UMA may instead encounter entity-specific contract and oversight requirements from an in-scope institution.
The cyber-insurance underwriter
Insurance applications and renewals may ask for documented control evidence. A structured pack supports review but does not predict price, acceptance, renewal or coverage.
POPIA and the Information Regulator
POPIA s.19 demands appropriate technical and organisational measures. The Information Regulator has issued enforcement notices and is escalating. Cyber failure is now a privacy failure.
Cyber posture leaks quietly — until it is suddenly a claim, a fine, or a renewal denial
A typo-squat domain, an expired TLS certificate, a missing DMARC record, a failed phishing-drill report — each one is a small signal. Together they shape the underwriter's view of your business and the regulator's view of your controls.
Lookalike domains targeting your brand
Typosquat and homoglyph domains can be used to impersonate a firm and enable social engineering. Monitoring helps identify suspicious registrations for investigation.
Email authentication gaps
SPF, DKIM and DMARC misconfiguration lets attackers impersonate your domain. The result is fraudulent quotes, premium diversion, and policyholder loss of trust.
Load-shedding and resilience evidence
SA-specific continuity evidence can cover UPS, generator, failover ISP and secure MFA recovery. The evidence requested varies by insurer and arrangement.
Vendor concentration risk
In-scope institutions must manage third-party cyber risk. A broker or UMA should assess its own concentration exposure and any related contractual requirements.
Conduct compliance still matters
FAIS, TCF, POPIA and FICA exposure has not gone away. Confusing quote journeys, hidden notice/consent, weak claims routes — these still cost trust and conversion daily.
Executive blind spots
Without one source of truth, branches and portals drift. Cyber and compliance debt accumulate silently — and surface only when something goes wrong publicly.