Joint Standard 2 of 2024: what your board is now accountable for
Who the standard covers, what the governing body must own, testing intervals and the new 24-hour incident reporting rule.
6-page PDF · free with your work email
Virtual Trust and Resilience Office
A trust and resilience department, without building one.
An outsourced executive capability for mid-market companies that can't justify a full-time CISO and GRC team. Our Chief Trust & Resilience Strategist leads at board level, backed by analysts and specialists who handle the daily work: security questionnaires, compliance evidence and your threat posture. You pay one predictable monthly retainer.
Who it's for
Built for the moment security becomes a board question.
No security lead yet
You have IT support, but nobody owns security risk.
Financial services
You must meet Joint Standard 2 of 2024 and show the board is in control.
After a breach or audit
You have findings to close and questions to answer.
Winning bigger deals
Clients are sending you security questionnaires.
Inside your office
Three levels of expertise, one accountable team.
Board and executive level
Chief Trust & Resilience Strategist
- 12-month trust and resilience roadmap
- Board and Audit & Risk Committee reporting
- Cyber insurance readiness
- Leads the response when an incident hits
Governance, risk, compliance
GRC analysts
- Policies and a living risk register
- POPIA and Joint Standard 2 of 2024 evidence
- Security questionnaires for your deals
- Supplier security reviews
Security operations
SecOps specialists
- Oversight of your monitoring provider
- Vulnerability and patch tracking
- Incident response plan and tabletops
- Staff awareness and phishing simulations
One office, one portal. Evidence, questionnaires and reports live on the Enc0ded platform. Automation drafts the first version; our people check and sign off every document.
Choose your tier
Start where you are. Move up as you grow.
Every tier includes board-level leadership and the governance work. Higher tiers add security operations, exercises and more frequent testing of your people.
| What is included | Essentials | Professional | Enterprise |
|---|---|---|---|
| Chief Trust & Resilience Strategist | |||
| Board and executive sessions | Quarterly | Monthly | Monthly |
| GRC analysts | |||
| Policies, risk register and POPIA evidence | Included | Included | Included |
| Security questionnaires completed | Included | Included | Included |
| Cyber insurance readiness | Included | Included | Included |
| Supplier security reviews | Not included | Included | Included |
| SecOps specialists | |||
| Monitoring oversight and vulnerability tracking | Not included | Included | Included |
| Tabletop exercise | Not included | Once a year | Twice a year |
| Awareness and phishing tests | Not included | Quarterly | Monthly |
| Incident support | Business hours | Business hours | Extended cover |
Annual allowances for questionnaires and supplier reviews, and the hours of Enterprise incident cover, are agreed in your proposal.
Your first 90 days
From first conversation to a board that can see its risk.
- 01Assess · Days 1 to 30Interviews, a data and systems inventory, and a POPIA gap assessment.
- 02Plan · Days 31 to 60Risk register, roadmap and policy set, then your first board session with the Strategist.
- 03Embed · Days 61 to 90Policies approved, incident plan tested in a tabletop, awareness programme under way.
Accountability stays with your executives. Under POPIA your head of organisation remains the Information Officer. Your vTRO supports them; it does not take on that role.
Go deeper
Read the executive briefing.
A plain-language PDF for your board, with sources. Free with your work email.
Next step
Book a vTRO executive briefing.
Thirty minutes with our Chief Trust & Resilience Strategist to see where you stand and which tier fits.
Prefer email?
hello@enc0ded.africa