Joint Standard 2 of 2024 Backup and Recovery Requirements

Joint Standard 2 of 2024, the Cybersecurity and Cyber Resilience Requirements issued by the Financial Sector Conduct Authority (FSCA) and the Prudential Authority (PA), has applied to South African financial institutions since 1 June 2025. Our earlier guide to meeting FSCA requirements covers governance, vulnerability management and penetration testing. This article takes a narrower view: what the standard says about backup and recovery, and what a regulator or auditor will accept as evidence that you meet it.

Who the standard applies to

The standard covers banks, insurers, collective investment scheme managers, market infrastructures, discretionary and administrative financial services providers, pension funds and their administrators, derivative providers and credit rating agencies. A boutique asset manager carries the same backup and recovery obligations as a bank, with a smaller team to meet them. Our financial services page sets out how we support firms of that size.

What the standard says about backup and recovery

Section 7.4 deals with response and recovery. Three clauses are relevant to backup:

7.4.1(c): the institution must establish a data backup strategy and a plan for regular backups and testing.
7.4.1(d): backup media must be stored offline or at an offsite location, which the standard says includes cloud storage, and sensitive backup data must be secured, for example by encryption.
7.4.1(f): the institution sets its recovery point objective (RPO) and recovery time objective (RTO) according to its nature, scale, complexity and risk profile.

Section 7.5.1(d) adds that the incident response and management plan must be tested against all plausible cyber threats, in line with those RPO and RTO figures. Section 7.7.4(a)(i) requires regular scenario-based simulation exercises that validate response, recovery and communication.

If a provider runs your backups, two more clauses apply: 7.7.1(b), under which you must be satisfied that any third-party testing of your controls is adequate, and 7.2.3(x), which requires an agreement for the secure return or transfer of your data when the contract ends.

Turning each clause into evidence

The standard prescribes neither a backup product nor a testing interval; it leaves the frequency to you and expects you to justify it. Keep one artefact per clause.

A written backup strategy

Clause 7.4.1(c) asks for a strategy and a plan, not a schedule inside a backup console. Write down which systems are protected, how often, where copies are held, how long they are kept and who owns each decision. Record the date the governing body approved it: section 4.1.1 makes it responsible for compliance, and section 6 requires it to approve the cybersecurity strategy and framework the plan sits under.

Proof that copies are offsite and encrypted

A backup server on the same network as production is neither offline nor offsite, and fails 7.4.1(d). Direct-to-cloud backup meets the requirement. Keep the provider's encryption and storage-region statements on file. Cove Data Protection backs up servers, workstations and Microsoft 365 straight to N-able's cloud with no local appliance.

RPO and RTO per system, with the reasoning

Clause 7.4.1(f) expects targets that reflect your risk profile, so one firm-wide number is unlikely to be enough. Tier your systems and set a pair per tier, with reasons. Our guide to setting realistic RTO and RPO walks through the method.

Test results against those targets

Clauses 7.4.1(c), 7.5.1(d) and 7.7.4 all point at the same thing: a record of tests, each with a measured recovery time and data age compared with the target. A successful backup job is not a test. Our article on disaster recovery testing cadence suggests a layered programme from sample restores to annual scenario exercises.

Cove's Recovery Testing restores selected Windows devices into a temporary virtual machine every 14 or 30 days, boots it and captures a screenshot of the running system for the management console before purging the machine. The screenshots form a dated trail that a device was bootable from backup, useful evidence for 7.4.1(c). They do not replace a timed application recovery with business sign-off, which is what 7.5.1(d) requires for critical systems.

Third-party agreements

If OAS or another provider operates your backups, the contract should state who tests what, how results are shared and how data is returned or deleted at exit. Keep the provider's test reports with your own review of them, as 7.7.1(b) requires.

Incident reporting now has a fixed form

Section 9 requires an institution to notify the responsible authority of a material cyber incident or information security compromise. The form and timing were left to a later notice, which arrived on 1 September 2026: Joint Communication 5 of 2026 determines a single notification template for material IT and cyber incidents under Joint Standard 1 of 2023 and Joint Standard 2 of 2024, effective from that date.

Banks, mutual banks and insurers submit the template through the PA's Umoja Portal; other institutions use the FSCA's Joint Standards Submission Portal. The notification timeline is on the template's cover page, so record it in your incident response plan from the current template. A reportable ransomware incident is also the moment you need your RPO and RTO figures, last verified restore point and test history to hand, so build the runbook to retrieve them in the first hour.

A short checklist

Backup strategy and plan written, approved and dated, listing each protected system's frequency, retention and storage location.
Copies held offsite or in the cloud, encrypted, with the provider's statement on file.
RPO and RTO set per system tier, with reasoning.
Automated recovery test screenshots retained.
Timed recovery tests for critical systems, measured against RPO and RTO, with business sign-off.
A scenario-based exercise each year that includes recovery and communication.
Provider contracts covering test responsibility, reporting and data return at exit.
Incident response plan updated with the Joint Communication 5 of 2026 template, portal and timeline.

None of this is beyond a mid-size firm; most of it is documentation and discipline around a platform that already supports it.

Sources

Turn backup status into regulator-ready recovery evidence with OAS Cove Data Protection services.

Joint Standard 2 of 2024: Backup and Recovery Evidence Checklist