Joint Standard 2 of 2024, issued by the Financial Sector Conduct Authority (FSCA) and the Prudential Authority (PA), sets cybersecurity and cyber resilience requirements for regulated financial institutions. It came into effect on 1 June 2025, and since 1 September 2026 firms must report material cyber incidents to the regulators within 24 hours.
Twenty-four hours is not long. It means the question is no longer whether you have a policy, but whether you can detect an incident, decide it is material and get a report out within a day, including over a weekend.
Who does JS2 apply to?
JS2 applies to a wide range of FSCA and PA regulated institutions, including banks, insurers, retirement funds, market infrastructures and many financial services providers. The requirements are applied proportionately, so a small FSP is not expected to run the same programme as a bank, but the core obligations still apply.
What you need to meet the 24-hour window
1. Detection that works out of hours
You can’t report what you haven’t noticed. Endpoint detection, log monitoring and someone watching alerts 24/7, in-house or through a managed SOC, are the foundation.
2. A clear definition of material
Agree in advance what makes an incident material for your firm: impact on clients, critical systems, data, financial loss or reputation. Write the criteria down so the decision isn’t debated while the clock runs.
3. Named decision-makers
Decide who classifies an incident and who signs off the report, with deputies for when they are unavailable.
4. A ready-to-use report template
Prepare the report format and the information you’ll need, such as what happened, systems affected, client impact and actions taken, so the first report can go out with what is known, followed by updates.
5. Practice
Run a tabletop exercise at least once a year. Walking through a realistic scenario shows where the process slows down.
The rest of JS2
Incident reporting is one part. JS2 also covers governance, a cybersecurity strategy and framework, identity and access management, security testing, third-party risk, data protection and cyber resilience. Joint Standard 1, on IT governance and risk management, sits alongside it.
How ready are you?
Our free JS2 readiness check takes about 3 minutes: 14 questions, an instant score and a list of the gaps a regulator would ask about. For a full gap assessment and help closing the gaps, see our governance, risk and compliance services or book a consultation.
This article is general information, not legal or regulatory advice.