Retirement fund boards remain accountable for cybersecurity and cyber resilience, even when their administration and technology are outsourced.
That was a key message from the Financial Sector Conduct Authority (FSCA) during a practical webinar on implementing Joint Standard 2 of 2024 on Cybersecurity and Cyber Resilience on 27 October.
Presented by Andile Mjadu from the FSCA’s Regulatory Frameworks Department, the session covered governance, third-party oversight, independent assurance and incident response.
Joint Standard 2 of 2024 took effect on 1 June 2025. Issued by the FSCA and the Prudential Authority, it sets requirements for sound cybersecurity and cyber resilience practices among the financial institutions covered by the standard. These include managing cyber risk, protecting information and systems, overseeing third-party providers, and preparing to respond to and recover from cyber incidents. Non-compliance may result in regulatory enforcement action.
Cybersecurity belongs in the boardroom
The board of trustees remains ultimately accountable for a fund’s cybersecurity, even where operational functions are outsourced. Cyber risk cannot simply be left to IT specialists or administrators.
Bianca Bekker, a legal adviser at ICTS Legal Services who works with retirement funds on compliance with the standard, attended the webinar. Her takeaways included the need for trustees to remain actively involved in overseeing cyber risk, even when they do not operate the underlying systems themselves.
Roles and responsibilities must be documented, with appropriate independence between those who operate systems and those who oversee information security. As Bekker puts it, “people should not mark their own homework”.
Cybersecurity must also receive the same fiduciary priority as liquidity management, investment policy and other core fund obligations. Bekker warned that if cyber risk is not “actively discussed and interrogated in the boardroom”, the fund is already falling short of the FSCA’s expectations.
Funds and their critical service providers are expected to maintain a documented cybersecurity and cyber resilience strategy that is approved, kept current and reviewed regularly. The strategy must be supported by practical controls, including identity and access management, multi-factor authentication, data loss prevention, least-privilege access and an auditable trail of activity.
“Having a policy document is not enough – the framework must be alive and enforceable,” Bekker said.
Outsourcing does not remove oversight duties
Retirement funds often depend on external administrators and technology providers, making third-party oversight a significant part of managing cyber risk.
Funds must obtain sufficient assurance about their providers’ arrangements, rather than rely on high-level statements that controls are in place. They should also understand and manage the risks of relying on a single critical provider.
Contracts should specify clear, measurable incident-notification timelines and, where possible, provide audit rights or access to independent assurance. The FSCA emphasised that a general contractual requirement to “notify us of an incident” is not enough without a clear timeframe.
Even a fund with no systems of its own retains an oversight obligation. Its board must be able to demonstrate that it has questioned the providers on whose systems the fund depends.
Bekker highlighted the practical difficulties of securing appropriate protections. Funds generally have more scope to negotiate detailed contractual terms with administrators than with insurers or other product providers. Trustees’ use of employer-issued devices and networks can also create gaps in the fund’s control environment.
Independent assurance and testing
The FSCA did not prescribe a specific form of independent assurance. Examples include ISO 27001, SOC 2 and ISAE 3402, but the focus is on demonstrating that assurance is independent and credible.
The webinar did not specifically address whether a “Cyber letter of assurance”, or letter of comfort, would be acceptable on its own. Bekker said a self-issued letter from a service provider, without supporting independent verification, is unlikely to meet the expectation on its own.
Cyber simulations and tabletop exercises were also encouraged. These allow funds to test how trustees, principal officers and service providers would respond to an incident, identify gaps in their arrangements and practise decision-making under pressure.
Funds should be able to show that they have rehearsed for a “bad day”, Bekker said, and demonstrate that they acted as a “reasonable trustee” if their decisions are later scrutinised.
Incident response and member communication
When a cyber incident occurs, a fund needs to establish which systems have been targeted, who depends on those systems and the extent of the disruption.
Service providers should notify funds as soon as reasonably possible. Bekker said unreasonable delays should be raised with providers and, where necessary, addressed through tighter contractual requirements.
There is also a formal regulatory reporting requirement. Joint Notice 2 of 2026, issued by the FSCA and the Prudential Authority, took effect on 1 September 2026 and determines the reporting template and process for material IT and cyber incidents under Joint Standards 1 of 2023 and 2 of 2024.
Under the prescribed “Reporting of Material IT and/or Cyber Incident Template”, financial institutions must submit an initial notification within 24 hours of classifying an IT incident or a cyber and information security incident as material. A subsequent update covering the impact of the incident must be submitted within 14 calendar days of notifying the responsible authority. The full incident report, including the completed sections of the template and the final investigation report, must be submitted according to timelines agreed with the responsible authority.
The notice defines a material incident as a disruption that has, or is likely to have, a severe and widespread impact on a financial institution’s operations, services to customers, or the broader financial system and economy.
The FSCA also stressed the need for clear, concise communication with members to limit misinformation and panic. Communication should begin early, even if all the details are not yet available.
Funds should establish in advance who will communicate with members, what information can be shared, and how updates will be provided as the situation develops.
Keeping cyber risk on the agenda
The webinar also highlighted the need for continuous awareness, training and upskilling among trustees, principal officers and relevant staff. Boards should regularly check that cybersecurity receives appropriate attention and review their arrangements as risks change.
Bekker said agility and timely responsiveness are treated as conduct issues, not purely technical ones.
Trustees need to understand their fund’s cyber risks, scrutinise service providers’ arrangements and be prepared to respond when those arrangements are tested.
