## EXECUTIVE SUMMARY — 1espea2024008-print-pdf

## Source details

**Canonical URL:** [EXECUTIVE SUMMARY — 1espea2024008-print-pdf](https://www.imf.org/-/media/files/publications/cr/2024/english/1espea2024008-print-pdf.pdf)

## Other formats

- [Markdown version](/-/media/files/publications/cr/2024/english/1espea2024008-print-pdf.pdf.md)
- [Structured JSON version](/-/media/files/publications/cr/2024/english/1espea2024008-print-pdf.pdf.json)

---

### Scope, context, and methodology
- Assessment covered regulation and supervision of cyber risk at Spanish Less Significant Banking Institutions (LSIs) and Financial Market Infrastructures (FMIs).
- Authorities in scope: Banco de España (BdE) and Comisión Nacional del Mercado de Valores (CNMV). Supervision of Significant Institutions (SIs) by ECB/SSM was not assessed.
- Rationale: a cyber incident affecting many LSIs or a critical third-party service provider could cause abrupt and significant adverse spillovers and systemic disruption; FMI incidents can be systemically adverse because of non-substitutability and interconnectedness.
- Review scope: legal/regulatory framework, onsite/offsite supervisory practices, cyber resilience (detect, respond, recover) for LSIs and selected FMIs (Iberpay/SNCE, BMEC CCP, Iberclear CSD).
- Assessment guided by EBA Guidelines, CROE, CPMI-IOSCO Guidance, FSB Stock take, BCBS Cyber-resilience: Range of Practices, IMF Departmental Paper on Cyber Risk Supervision, and other international good practices.

### Legal and institutional framework — key points
- Spanish framework is fully aligned with EU regulation; pertinent EU legislation is either transposed or directly applicable.
- Legal basis provides powers for information collection, assessment of compliance, imposition of corrective actions within reasonable timeframes, sanctions and enforcement as last resort.
- BdE is designated supervisor/overseer for payment systems and certain payment-related entities’ compliance with DORA Chapter II; DORA entered into force in January 2023 and its requirements will be applicable from January 2025 (Article 4 of Royal Decree-Law 8/2023).

### Key strengths in supervisory practices
- Clear supervisory expectations that are well communicated.
- Effective risk-based approach and application of proportionality.
- Useful and well-validated horizontal reviews at BdE.
- Strong emphasis on evidence-based onsite examinations at BdE.
- Thorough and detailed offsite oversight at CNMV and BdE, notable given resource constraints.
- Emphasis placed on security testing (including TIBER-ES) and proactive preparation for regulatory changes (e.g., DORA).
- Effective internal coordination and cooperation at both BdE and CNMV.

### Principal weaknesses and challenges
- Resource constraints and rigid hiring/employment policies hinder recruitment and retention of specialist cybersecurity staff; CNMV’s capacity is well below current needs.
- Authorities’ cyber risk supervision delivery capacity is already fully utilized.
- Specific weaknesses:
  - No onsite supervisory process in CNMV’s or BdE’s FMI oversight business areas.
  - BdE’s current approach results in few onsite examinations, making it difficult to increase coverage.
  - Neither BdE nor CNMV are involved in national critical infrastructure related matters.
  - TIBER-ES framework is not well suited to the majority of LSIs; institution-specific threat intelligence reports have an unfavorable cost/benefit ratio.

### Key statistics and operational metrics
- Nominal headcount of ICT and cyber risk supervisory positions at the BdE is around 10 percent of the total supervisory headcount, but several positions remain unfilled.
- There are over 3,000 third-party arrangements on technology services in the Spanish LSIs (reported to BdE).
- Approximately 60 percent of LSIs rely on two ICT service providers for critical services; these providers are owned by LSIs and under BdE direct supervision.
- Onsite LSI cybersecurity examinations:
  - Actual onsite work can exceed two months in duration.
  - An examination can last three to four months end-to-end.
  - As much as six experts may participate.
  - Delivery limited to two examinations per year on average given available resources.
  - Onsite LSI examinations take up around 20 percent of BdE’s total delivery capacity; the remaining 80 percent is expended on SIs.
- Crisis exercise metrics:
  - In INCIBE CyberEx, participants are graded on a five-level scale; average score now stands at 3.94 (5 being the best).

### Conclusions
- Cyber risk supervisory practices for LSIs and FMIs are materially in line with applicable regulations, guidance, and prevailing international good practice; legal and regulatory framework conveys adequate supervisory powers.
- Resource constraints and gaps in oversight approaches (onsite FMI examinations, involvement in critical infrastructure matters, suitability of TIBER-ES for LSIs) limit assurance and hinder scaling supervision to meet evolving threats and regulatory requirements (including DORA).
- Workloads expected to steadily increase in the short term with DORA implementation and phasing in of TIBER-ES testing.

### Key recommendations (high level)
- Recommendation 1 — Prioritize filling existing open positions and assess need to increase cyber risk specialist headcount by considering current and projected workloads over a three to five years period.
  - Timing: I (Immediate (within year))
  - Reference: 31. (i) BdE
- Recommendation 2 — Estimate current and projected future workload, ensure alignment of resources to these, and have full autonomy over recruitment and retention processes so hiring is effective at required experience and competence levels.
  - Timing: ST (Short term (within 1-2 years))
  - Reference: 31. (ii) CNMV Government
- Recommendation 3 — Establish and staff a small cyber risk competence center with a horizontal mandate to provide specialist support for all activities with a cyber risk supervisory component.
  - Timing: ST
  - Reference: 31. (iii) CNMV
- Recommendation 4 — Start planning and executing onsite examinations as part of FMI supervision; leverage BdE banking supervision expertise and consider limited external technical support at CNMV as interim measure.
  - Timing: ST
  - Reference: 99. (i) BdE CNMV
- Recommendation 5 — Conduct more, and more focused, thematic reviews while maintaining validation based on short onsite visits to a sample of the reviewed population.
  - Timing: ST
  - Reference: 99. (ii) BdE
- Recommendation 6 — Both BdE and CNMV should be involved in critical infrastructure related matters, such as designation and compliance assessments.
  - Timing: ST
  - Reference: 99. (iii) Government
- Recommendation 7 — Consider using sector-specific threat intelligence tailored to specific institutions in each TIBER-ES test to reduce costs while maintaining compatibility with TIBER.
  - Timing: I
  - Reference: 99. (iv) BdE
- Recommendation 8 — Develop a lighter threat intelligence-based red teaming framework based on TIBER-ES principles, considering the lower complexity, maturity and cost-bearing ability of a typical LSI.
  - Timing: MT (Medium Term (within 3−5 years))
  - Reference: 99. (v) BdE CNMV DGSFP

*Source: EXECUTIVE SUMMARY and selected sections, 1espea2024008-print-pdf*

### EXECUTIVE SUMMARY __________________________________________________________________________ 5

### EXECUTIVE SUMMARY

### Scope and Context
- Assessment covered the regulation and supervision of cyber risk at Spanish Less Significant Banking Institutions (LSIs) and Financial Market Infrastructures (FMIs).
- Authorities in scope: Banco de España (BdE) and Comisión Nacional del Mercado de Valores (CNMV).
- Supervision of Significant Banking Institutions (SIs) is within the remit of the European Central Bank’s Single Supervisory Mechanism (ECB/SSM) and was not assessed.
- Technology risk and cyber resilience are supervisory priorities (for example, BdE priority for 2023); CNMV has intensified cyber risk oversight activities in recent years.
- Rationale: A cyber incident affecting many LSIs or a critical third-party service provider could cause abrupt and significant adverse spillovers and systemic disruption; FMI incidents can be systemically adverse because of non-substitutability and interconnectedness. Spain’s financial system size and international importance increase potential for cross-border transmission.

### Assessment Scope and Methodology
- Review covered: legal/regulatory framework, onsite/offsite supervisory practices, cyber resilience (detect, respond, recover) for LSIs and selected FMIs.
- FMIs in scope: (i) payment systems operated by Iberpay (SNCE); (ii) Bolsas y Mercados Españoles Clearing (BMEC), the CCP; (iii) Iberclear (IC), the CSD. BdE supervises/oversees Iberpay and is the overseer of IC and BMEC per Spanish Securities Market Law, but no coordination articulation between CNMV and BdE for cyber risk oversight of securities FMIs.
- Information sources: questionnaires from BdE, CNMV and Ministry of the Interior; interviews; legal/decree study; supervisory plans, workpapers, reports.
- Assessment guided by international good practices including EBA Guidelines on ICT Risk Assessment under SREP, EBA Guidelines on ICT and security risk management, EBA Guidelines on outsourcing, CROE, CPMI-IOSCO Guidance, FSB Stock take, BCBS Cyber-resilience: Range of Practices, and IMF Departmental Paper on Cyber Risk Supervision.
- The note treats cyber risk and ICT risk as materially overlapping and both as categories of operational risk, consistent with authorities’ taxonomies and the FSB Cyber Lexicon.

### Legal and Institutional Framework Findings
- Spanish framework is fully aligned with EU regulation: pertinent EU legislation is either transposed or directly applicable.
- BdE is part of the SSM since 2014; CNMV and BdE participate in EU-CCP Colleges of Supervisors according to EU legislation.
- Legal basis and relevant regulation provide adequate powers for cyber risk supervision: broad powers for information collection, assessment of compliance, imposition of corrective actions within reasonable timeframes, sanctions and enforcement as last resort.

### Key Strengths in Supervisory Practices
- Clear supervisory expectations that are well communicated.
- Effective risk-based approach and application of proportionality in supervision.
- Useful and well-validated horizontal reviews at BdE.
- Strong emphasis on evidence-based onsite examinations at BdE.
- Thorough and detailed offsite oversight at CNMV and BdE, notable given resource constraints.
- Emphasis placed on security testing.
- Proactive approach to upcoming regulatory changes (e.g., ensuring future DORA compliance).
- Effective internal coordination and cooperation at both BdE and CNMV.

### Principal Weaknesses and Challenges
- Resource constraints are the most prominent challenge: rigid hiring and employment policies negatively affect ability to keep pace with changing cybersecurity threats and recruit specialist staff.
- Annual CNMV process to secure government approval for its budget introduces uncertainties on staffing levels and expansion, hindering recruitment and retention of expert cybersecurity staff.
- Authorities’ cyber risk supervision delivery capacity is already fully utilized; CNMV’s capacity is well below current needs.
- Specific weaknesses:
  - No onsite supervisory process in CNMV’s or BdE’s FMI oversight business areas, leading to weaker assurance over compliance.
  - BdE’s current approach results in few onsite examinations, making it difficult to increase coverage.
  - Neither BdE nor CNMV are involved in national critical infrastructure related matters, despite being well placed to address continuity of critical financial services.
  - TIBER-ES framework is not well suited to the majority of LSIs; need for a testing framework based on its principles tailored for LSIs.
  - Institution-specific threat intelligence reports in TIBER-ES have an unfavorable cost/benefit ratio.

### Conclusions
- Cyber risk supervisory practices for LSIs and FMIs were found to be materially in line with applicable regulations, guidance, and prevailing international good practice.
- The legal and regulatory framework conveys adequate supervisory powers.
- Resource constraints and gaps in oversight approaches (onsite FMI examinations, involvement in critical infrastructure matters, suitability of TIBER-ES for LSIs) limit assurance and hinder scaling supervision to meet evolving threats and regulatory requirements (including DORA).

### Key Recommendations (Table 1)
- Recommendation 1 — Prioritize filling existing open positions and assess the need for increasing the cyber risk specialist headcount by considering current and projected workloads over a three to five years period.
  - Timing: I  (Immediate (within year))
  - Reference: 31. (i) BdE

- Recommendation 2 — Estimate current and projected future workload, ensure alignment of resources to these, and have full autonomy over the recruitment and retention process so that they become more effective at hiring additional staff at the right experience and competence levels.
  - Timing: ST  (Short term (within 1-2 years))
  - Reference: 31. (ii) CNMV Government

- Recommendation 3 — Establish and staff a small cyber risk competence center with a horizontal (cross-cutting) mandate to provide specialist support of all activities that have a cyber risk supervisory component.
  - Timing: ST
  - Reference: 31. (iii) CNMV

- Recommendation 4 — Start planning and executing onsite examinations as part of FMI supervision. BdE’s existing cyber risk expertise in banking supervision could be leveraged initially. At CNMV, external support clearly limited to executing technical tasks should be considered as an interim measure.
  - Timing: ST
  - Reference: 99. (i) BdE CNMV

- Recommendation 5 — Conduct more, and more focused, thematic reviews while maintaining validation based on short onsite visits to a sample of the reviewed population.
  - Timing: ST
  - Reference: 99. (ii) BdE

- Recommendation 6 — Both the BdE and CNMV should be involved in critical infrastructure related matters, such as designation and compliance assessments.
  - Timing: ST
  - Reference: 99. (iii) Government

- Recommendation 7 — Consider using sector-specific threat intelligence to be tailored to specific institutions in each test in TIBER-ES to reduce costs, while maintaining compatibility with TIBER.
  - Timing: I
  - Reference: 99. (iv) BdE

- Recommendation 8 — Develop a lighter threat intelligence-based red teaming framework based on TIBER-ES principles, considering the generally lower complexity, maturity and cost-bearing ability of a typical LSI.
  - Timing: MT  (Medium Term (within 3−5 years))
  - Reference: 99. (v) BdE CNMV DGSFP

*Source: EXECUTIVE SUMMARY, 1espea2024008-print-pdf*

### 13.      The BdE’s approach to cyber risk supervision of LSIs is aligned with the principles of SI

### 13.      The BdE’s approach to cyber risk supervision of LSIs is aligned with the principles of SI

### Alignment and interoperability
- The BdE’s approach to cyber risk supervision of LSIs is aligned with the principles of SI supervision of the SSM, facilitating interoperability between the Joint Supervisory Teams (JST) of the SSM and local LSI supervisory teams.
- This alignment is significant because the BdE delegates members to JSTs who could at a later time be involved in LSI supervision, and vice versa.

### Oversight of payment systems and DORA implementation
- The BdE is the single overseer of Spanish payment systems including Iberpay as per domestic law and acts in accordance with the Eurosystem oversight policy framework.
- The BdE participates in joint oversight teams of pan-European payment systems, such as TARGET2 or TIPS.
- The BdE has been designated as supervisor of the compliance of certain payment related entities with the cyber risk management rules of the DORA Regulation.
- Recital 104 of DORA permits Member States to draw inspiration from DORA requirements for operators of payment systems and processing entities outside DORA’s scope.
- Article 4 of Royal Decree-Law 8/2023 mandates operators of payment systems, schemes and arrangements, payment processors and other technical service providers comply with Chapter II of DORA, which includes rules on ICT risk management (governance, protocols, prevention, recovery, backup, communication). The BdE has supervisory and sanctioning powers to this end.
- DORA entered into force in January 2023; its requirements will be applicable only from January 2025. On that date, according to Article 4 of Royal Decree-Law 8/2023, operators of payment systems, schemes and arrangements, payment processors and other technical service providers that provide services in Spain will also need to comply with those provisions of DORA related to ICT risk management (Chapter II).
- Implementation of DORA will require a varying degree of effort; the LSI sector and smaller FMIs are expected to spend relatively more to achieve compliance. Supervisors' resource needs are expected to increase as well.

### Regulatory and international standards landscape
- CNMV supervises FMIs under EU regulations, notably EMIR and CSDR and their RTS; FMIs supervised by CNMV lack an SSM-like construct.
- EBA guidelines applicable to credit institutions and supervisory authorities, and therefore to Spanish LSIs and the BdE’s supervision, include:
  - EBA/GL/2019/04 (Guidelines on ICT and security risk management)
  - EBA/GL/2019/02 (Guidelines on outsourcing arrangements)
  - EBA/GL/2017/05 (Guidelines on ICT Risk Assessment under the SREP)
  - EBA/GL/2021/05 (Guidelines on internal governance)
  - EBA/GL/2022/03 (Guidelines on common procedures and methodologies for the SREP and supervisory stress testing)
- International standards for ICT risk management and cybersecurity are taken into account by the BdE as supplementary, non-binding sources.
- The BdE’s cyber risk oversight of payment systems follows the Eurosystem Cyber Resilience Strategy (issued in 2017), based on CPMI-IOSCO: (i) PFMIs and (ii) Guidance on cyber resilience for FMIs.
  - Within PFMIs, relevant principles: Principle 2 (governance), Principle 3 (comprehensive risk management framework), Principle 17 (operational risk).
  - The Guidance on cyber resilience for FMIs covers cyber governance, identification, protection, detection, response, and recovery (including a two-hour recovery time objective), testing, situational awareness, and learning and evolving.
- Two specific tools used by the BdE for payment systems cybersecurity oversight:
  - ECB’s Cyber Resilience Oversight Expectations for FMIs (CROE), including a maturity model.
  - A cybersecurity survey supporting CROE assessments.
- For CNMV-supervised FMIs, applicable international standards include CPMI-IOSCO’s PFMIs and Guidance on cyber resilience for FMIs; CROE and the cybersecurity survey are also used, and the survey has been extended to the Spanish CCP and CSD with cooperation from the BdE.
- Non-financial-sector EU instruments with direct bearing: NIS2 and GDPR; both require coordination with non-financial sector authorities in specific situations (e.g., personal data breaches).

### Internal organization and supervisory resourcing
- ICT and cyber risk supervisory expertise at the BdE is organized both vertically and horizontally:
  - LSI microprudential supervision: Directorate General Banking Supervision.
  - FMI oversight: Payment Systems Department (DD.SPA) of the Directorate General Operations, Markets and Payment Systems.
  - Vertical: fully dedicated experts in SI and LSI offsite supervisory teams and in DD.SPA, though not fully dedicated to ICT/cyber risk.
  - Horizontal (Directorate General Banking Supervision): ICT Risk Inspections Division (on-site examinations at SIs and LSIs) and IT Risk Division (horizontal analyses, TIBER-ES framework, specialist support, international collaboration).
- Headcount and capacity:
  - Nominal headcount of ICT and cyber risk supervisory positions at the BdE is around 10 percent of the total supervisory headcount, but several positions remain unfilled.
  - Vacancies and projected workload increases challenge continued delivery of current performance levels.
- Coordination mechanisms at the BdE:
  - A recent reorganization in Directorate General Banking Supervision to improve cross-divisional cooperation.
  - Three fora: (i) a strategy committee for ICT risk; (ii) an ICT outsourcing committee; and (iii) an IT Risk forum.
- CNMV resourcing and organization:
  - Cyber risk supervision of FMIs is executed from the Markets Directorate General; there is only one dedicated cybersecurity position in a support role at the Policy, Innovation and Sustainable Finance Department within the Policy and International Affairs Directorate General.
  - CNMV largely relies on experts whose primary specialization is not cybersecurity.
  - A pending request for two additional headcounts exists, but approval and filling can take extremely long due to rigid HR processes outside CNMV control.

### Supervisory approach and practices
- Cyber risk supervision is fully integrated into broader supervision at both BdE and CNMV with formalized, documented processes, clear responsibilities, organizational structures, and reporting lines, and adequate planning, review, and quality assurance.
- Legal powers are adequate for information collection, assessment of compliance, corrective actions, sanctions, and enforcement (Conclusions).
- The authorities consider cyber risk supervision a priority; BdE LSI priorities are aligned with ECB SI priorities, which include cybersecurity and ICT risk since 2022. Payment system oversight and FMI supervision focus on cyber resilience as per CROE and CPMI-IOSCO Guidance.
- Risk-based approach is implemented by:
  - Prioritizing resources where manifestation of cyber risk can have higher impact.
  - Considering the wider risk context.
  - Using risk and maturity ratings consistently.
- Example of prioritization for LSIs:
  - 6 such institutions were identified and grouped together for more intense monitoring. Three ICT and cyber risk experts have been assigned to the supervision of this group.
- Proportionality:
  - Expectations on control maturity are set irrespective of size and complexity, but expected maturity depends on size and complexity (sophistication, documentation, optimization, automation, scalability, redundancy).
  - Questionnaires used by BdE and CNMV take account of proportionality. For FMIs, CROE maturity model and “comply or explain” principle facilitate proportional approach.
- Supervisory toolkit elements: offsite (ongoing) supervision, onsite examinations (inspections), thematic reviews, and security testing oversight — all planned, controlled, and documented.
- The BdE materially adheres to the SREP methodology for LSI supervision, including for cyber risk, complying with applicable EBA guidelines; processes are kept very similar to SI supervision to enable fungibility of expertise and team members across LSI and SI onsite examinations.
- Concentration risk:
  - Majority of Spanish LSIs rely on two important ICT outsourcing service providers (both owned by LSIs and under BdE direct supervision). These providers are in the special monitoring group and subject to more scrutiny, a more intense onsite examination schedule, and closer contact.

### Conclusions
- Legal basis and relevant regulation convey adequate powers for cyber risk supervision, including broad powers for information collection, corrective actions, sanctions, and enforcement.
- Rigid hiring and employment policies negatively impact authorities’ practical ability to discharge duties and keep pace with the rapidly changing cybersecurity threat landscape.
- Consequences:
  - BdE resources continuously running at full capacity; CNMV inadequately staffed.
  - Workloads expected to steadily increase in the short term with DORA implementation and phasing in of TIBER-ES testing.
  - Unlikely that authorities can improve coverage or depth of supervision while risk levels rise.

### Recommendations
- Authorities should prioritize addressing human resource bottlenecks in cyber risk supervision. Specifically:
  (i) The BdE should assess the need for increasing the cyber risk specialist headcount and prioritize filling existing open positions. A calculation considering current and projected workloads over a three-to-five years period would be most useful to support such an assessment and develop a formal case for additional headcount. Given the uncertainties regarding the amount of additional supervisory work due to the implementation of DORA, a more precise estimate can be made after the technical standards are finalized.
  (ii) International standards require budgetary processes that do not undermine autonomy and adequacy of resources. In this context, the annual process that the CNMV has to follow to secure government approval for its budget introduces uncertainties regarding ability to ensure adequate number of, and expansion in staff, including expert and specialized human resources in the highly competitive area of cyber security. This is a significant issue in light of identified challenges in current supervisory practices, such as in onsite supervision of cyber risk (discussed below), and will only grow in the near-term, reflecting rapidly expanding cyber threats and implementation of new regulations, such as DORA. Consequently, it is recommended that the CNMV estimate current and projected future workload, ensure alignment of resources to these, and have full autonomy over the recruitment and retention process so that they become more effective at hiring additional staff at the right experience and competence levels.
  (iii) In the meantime, the CNMV should establish and staff a small cyber risk competence center with a horizontal (cross-cutting) mandate to provide specialist support of all activities that have a cyber risk supervisory component.

*Source: 1espea2024008-print-pdf - 13.      The BdE’s approach to cyber risk supervision of LSIs is aligned with the principles of SI*

### 38.      Onsite examinations feature prominently in BdE’s supervisory approach. While the EBA

### Onsite examinations feature prominently in BdE’s supervisory approach

### Offsite supervision: structure and tools
- Generalist supervisors, supported by a small team of ICT and cyber risk experts, are responsible for BdE’s offsite (ongoing) LSI cyber risk supervision.
- The LSI and other institutions outside the SSM department has three dedicated ICT and cyber risk experts who provide specialist support.
- Offsite activities are embedded in the overall offsite supervisory process and focus on entities in the special monitoring group, with the two ICT outsourcing providers prioritized further.
- Offsite activities focus on information gathering, validation, and ongoing risk assessment in accordance with the LSI SREP methodology and EBA SREP guidelines; cyber risk as a category of operational risk feeds into assessments of: (i) business model, (ii) governance and risk assessment frameworks, and (iii) risks to capital.
- The BdE uses the unmodified IT risk taxonomy of the EBA SREP guidelines, defining five risk categories: IT security risk, IT availability and continuity risk, IT change risk, IT outsourcing risk, and IT data integrity risk.
- Certain LSIs’ business models rely heavily on digital services, so BdE prioritizes assessment of digital transformation programs because disruption risk typically increases until transition is complete and IT operations stabilize.
- Cybersecurity governance is a focus area, with attention to formally set and approved risk tolerance levels, board involvement, appropriate responsibilities, competencies, and reporting lines in all three lines of defense.
- The IT risk self-assessment questionnaire:
  - Is used for both LSIs and SIs.
  - Has been administered to LSIs for three years.
  - Is revised from time to time (a revision is expected this year because of changes brought by DORA).
  - Collects data on the IT environment, risk levels, and control strength.
  - Uses the EBA taxonomy and a 4-grade empirical scale for individual risk and control assessments (to avoid tendency to categorize most risks as medium in a 3-grade scale).
  - Requires risk levels to be assessed taking into account the inherent risk; control levels assessed based on indicators of effectiveness, maturity, and implementation status.
  - Stores results in a specific database to facilitate later analyses and benchmarking.
- BdE nudged LSIs to a more conservative approach after observing early self-assessments were too optimistic; feedback led to more realistic self-assessments.
- Other information sources: regular meetings with supervised entities, audit reports, and certifications (considered corroborative but not relied on as evidence).
- There is latitude in weighting ICT and cyber risk within the operational risk assessment; factors considered include IT architecture complexity, major projects, dependency on fully digitalized services, and incident track record.
  - It is expected that in the near future the ICT and cyber risk weight will be raised to around 50 percent in SI supervision at the SSM level; BdE aims to apply the same weight in LSI supervision to maintain alignment between SI and LSI methodologies.
- FMI offsite supervision:
  - No onsite activity in CNMV or BdE’s FMI oversight approach; applicable regulation and international standards are agnostic on onsite inspections.
  - Based on regular discussions with management and validated self-assessments and analysis.
  - BdE’s Payment Systems Department and CNMV meet regularly with relevant FMI management.
  - DD.SPA administers the cyber survey to all FMIs within its remit; in practice participation is universal.
  - Validation methods include outlier analysis, challenging less plausible assertions, and corroboration; reporting, dashboards, and trend analyses are prepared.

### BdE’s onsite examinations of LSIs: scope, depth, and resourcing
- Onsite cybersecurity examinations are harmonized with the offsite risk-based approach; offsite results feed into planning and execution of examinations and vice versa.
- Examinations target LSIs exposed to higher cyber risk because of size, complexity, potential for impact on others, or significant weaknesses.
- By design, onsite cyber risk examinations of LSIs are broad, intrusive, resource intensive, and relatively infrequent:
  - Actual onsite work can exceed two months in duration.
  - An examination can last three to four months end-to-end.
  - As much as six experts may participate with varying intensity across the period.
  - Given available resources, delivery is limited to two examinations per year in average.
  - Onsite LSI examinations take up around 20 percent of the BdE’s total delivery capacity; the 80 percent being expended on SIs.
- Main goal: obtain strong assurance on the functioning of the cyber risk control environment through observing controls being executed, reviewing artifacts on past control execution, and, sparingly, control effectiveness tests (reserved for high-risk cases because of resource intensity).
- Examinations follow detailed internal policies prescribing a highly structured approach with required documentation and approvals; key process elements include:
  - (i) planning and approval of plans, including scope, procedures, and timeline;
  - (ii) documentation review based on formal documentation requests;
  - (iii) interviews according to communicated meeting schedules;
  - (iv) direct extraction of information from systems to support risk and control assessment;
  - (v) analysis and validation of information collected;
  - (vi) risk and control assessment;
  - (vii) drafting of findings and recommendations, including severity rankings;
  - (viii) follow-ups and clarification requests on open issues;
  - (ix) internal review;
  - (x) preliminary conclusions;
  - (xi) reporting and related internal approvals; and
  - (xii) issuance of a requirements letter.
- Direct extraction of information on the functioning of the control environment is a less commonly seen feature:
  - Done with read-only access and only on selected support systems (not business systems), e.g., IT service management systems, policy repositories, internal information portals.
  - Governing principle: enable efficient first-hand evidence gathering without incurring unnecessary risk; additional extractions require specific requests to the LSI.
- Examination documentation is sufficient for experts not involved to understand the process, decisions, and rationale; project management documentation, client communication, workpapers, evidence, and reports are stored in a standardized folder structure in a document management system.

### Thematic reviews of LSIs
- Only the BdE performs thematic reviews among the authorities reviewed; thematic reviews are less useful for CNMV or FMIs in scope because of the small number of FMIs.
- Purpose: enhance cyber risk supervision by obtaining better understanding of a risk issue or state of play across a sector segment; input to strategic/tactical planning, resource needs, risk concentrations, problem areas, outliers; allows benchmarking against peers and industry.
- Thematic reviews are questionnaire-based with strong validation:
  - Supervisors conduct short two-to-three-day visits to a selected sample to fill in or validate questionnaires; supporting evidence requested for some questions.
  - Possibility of selection in validation sample nudges all LSIs to provide better substantiated answers.
- Thematic reviews balance BdE’s traditional deep-examination approach with broader horizontal breadth, constituting a hybrid between self-assessment-based reviews and thematic examinations.
- In the last three years, the BdE did three thematic reviews, out of which one had the LSI segment in scope; that review dealt with the overall IT and IT risk landscape with a special focus on cybersecurity.

### Cybersecurity testing and crisis exercises
- Threat Intelligence-Based Ethical Red Teaming (TIBER) is the supervisory-relevant framework; BdE approved TIBER-ES in 2020 (an adaptation that keeps all mandatory requirements).
  - Tests done according to TIBER-ES can be certified as TIBER tests and be acceptable to jurisdictions recognizing the framework.
  - BdE maintains and develops TIBER-ES with assistance from CNMV and DGSFP; TIBER-ES is recognized in the entire Spanish financial system.
- TIBER-ES and TIBER tests are lengthy, complex, controlled, and expensive; targets are usually critical production systems at large institutions, requiring vendor vetting, planning, coordination, contingency arrangements, quality assurance, and validation.
- Targeted threat intelligence is emphasized, but early results indicate benefit is less than expected because most threat intelligence reports are not highly target-specific.
- Authorities’ role in TIBER-ES testing is restricted to facilitator, overseer, and validator roles, centered on the TIBER Cyber Team and the TIBER Test Manager Team; validation and formal certification of the test is a key authority role.
- TIBER-ES is intended for large institutions but some LSIs and FMIs may be tested; TIBER-ES is not mandatory yet and is not a supervisory tool in itself, though it is expected to become mandatory in the near term (see DORA) for a subset of institutions.
- BdE and a number of supervised LSIs and FMIs participate in voluntary cyber crisis exercises:
  - BdE participates in national exercises as observers and in cross-border ones as national authority.
  - The Spanish National Cybersecurity Institute (INCIBE) runs CyberEx annually since 2012; in the last iteration one third of participants were from the financial sector.
- CyberEx features:
  - A graded individual level exercise that does not test coordination between participants.
  - Participants engage in: (i) a management role play crisis scenario; (ii) a technical simulation for incident management teams; and (iii) a targeted cyberattack executed by INCIBE.
  - Participants are graded on a five-level scale; over the years average score improved and now stands at 3.94 (5 being the best).
  - Low participation ratios and selection bias limit extrapolation to sectoral readiness.
  - Exercise complemented with an annual cyber-resilience measurement with more than 45 cybersecurity indicators across anticipating, detecting, preventing, protecting, responding, mitigating and recovering.

*Source: Excerpt from the provided IMF PDF content unit.*

### 71.      The Spanish Inter-Bank Cooperation Centre (CCI) ran a crisis exercise in 2023 that

### 1espea2024008-print-pdf - 71.      The Spanish Inter-Bank Cooperation Centre (CCI) ran a crisis exercise in 2023 that

### Crisis exercises and testing
- The Spanish Inter-Bank Cooperation Centre (CCI) ran a crisis exercise in 2023 that added the much-needed collective aspect; with the participation of a critical service provider, the exercise tested participant institutions’ individual response and recovery capacity as well as their co-ordination and collective response.
- BdE participates in tabletop exercises run by FS-ISAC and the Eurosystem due to logistical complexities and risks. Examples include the 2022 European Cross Border Tabletop Exercise, the 2023 Locked Shields Strategic Exercise (by FS-ISAC) and the UNITAS crisis communication exercise (by Eurosystem).
- CNMV has not participated in crisis exercises so far due to very limited specialist capacity, but encourages FMIs to participate and discusses results. With the advent of TIBER-ES and DORA it will be necessary for CNMV to be more actively involved.
- Footnotes: This technical note does not address cyber crisis exercises at the authorities themselves. Better prepared institutions tend to participate in larger numbers in voluntary exercises, especially if graded, so the test population is not random.

### Third-party risk and outsourcing
- Third-party risk has risen significantly due to increasing reliance on outsourcing and other services of technology providers in the Spanish financial sector.
- There are over 3,000 third-party arrangements on technology services in the Spanish LSIs, based on reporting to the BdE.
- Cloud outsourcing is on the rise; core banking systems are currently kept on-premises. BdE information indicates there are no cloud migration plans for the short- and medium-term involving core banking sectors in the LSI segment. LSIs typically migrate office, collaboration, analytics, customer relationship management, and other business support systems to the cloud.
- LSIs use cybersecurity managed services; Security Operations Centers (SOC) are among the most commonly outsourced functions.
- Approximately 60 percent of LSIs rely on two ICT service providers for critical services. These providers are owned by LSIs and are under direct BdE microprudential supervision (including onsite examinations).
  - Upsides: many LSIs achieve better cybersecurity stance via shared providers; BdE’s microprudential supervision has an impact multiplier by focusing on these entities.
  - Downsides: concentration risk at providers can lead to higher impact incidents, including potential breaches or disruptions across served LSIs simultaneously; likelihood considered low but not ruled out.
- BdE requires notification from LSIs on planned third-party arrangements. Required submissions include draft contract, outsourcing policy, and a risk and materiality assessment. The IT Risk Division processes notifications and uses workflow and project management tools; arrangements are stored in a database for consolidated views and dependency identification.
- FMIs under CNMV supervision share much of their ICT infrastructure and cybersecurity framework within group-wide structures, producing similar benefits and concentration risks.
- FMIs must obtain CNMV authorization for outsourcing involving core services. IC and BMEC classify outsourcing providers for criticality and assess them on indicators (e.g., BitSight cyber score and financial soundness). CNMV regularly reviews results and tracks arrangements.

### Incident reporting
- Authorities require supervised institutions to report cyber incidents according to formally defined criteria and deadlines. BdE and CNMV prioritize cyber incident reporting and follow up on incidents crossing thresholds. Reporting criteria and number of incidents reported differ between authorities.
- Since 2022, the two CNMV-supervised FMIs in scope must report all operational incidents: major incidents immediately; minor incidents monthly. Monthly reports contain major incidents as well. Repeated incidents trigger further scrutiny and a specific report explaining recurrence and mitigation. CNMV reviews and analyses all reports; the relatively small number of incidents makes this approach effective.
- LSIs must report cyber incidents meeting certain criteria to the BdE. Reporting threshold is implemented so that if one or more of seven predefined criteria are triggered, the incident must be reported. Criteria are qualitative and partially overlap. For all reportable incidents at least three reports must be submitted: initial, interim, and final. The final report must include root cause analysis, details on mitigating measures for the future, and financial impact, both direct and indirect. (There could be more than one interim report.)
- Payment systems under BdE oversight report cyber incidents according to the Eurosystem procedure for major incidents in the oversight policy framework. The approach and types of reports are similar to banking supervision, but reporting criteria differ due to differences in operational risk; both sets of criteria work well to identify incidents of supervisory interest.

### Supervisory Technology (SupTech)
- BdE has a SupTech strategy with the objective to further improve prudential supervision and help BdE become an international reference institution. Four pillars: (i) collaboration with the SSM (BdE is the SupTech center for graph analysis); (ii) in-house development of SupTech tools; (iii) creating an innovation culture; and (iv) specialised training (e.g., data science, artificial intelligence and machine learning).
- SupTech tools have been effective where granular structured data are available over longer periods (example: reconciliations between credit registry information and collateral reports improved data quality).
- Data scarcity on cyber risk is a major impediment; cyber risk data lack the quality, coverage, granularity, and metadata consistency of financial data. Advanced analytics are less effective; tools for unstructured data (e.g., natural language processing for board minutes or sentiment analysis) may be more successful.

### Preparation for DORA
- Authorities are aware of DORA implications for supervised entities and themselves. Most impactful changes expected: supervision of critical third parties, applicability of TIBER testing, and incident reporting.
- Regulatory Technical Standards (RTS) and Implementing Technical Standards (ITS) are under development, making forecasting resource needs difficult; there is broad agreement the increase will be significant.
- Authorities have begun preparatory work: BdE conducted an information campaign; CNMV discussed implications with supervised FMIs. The application of the proportionality principle in DORA is widely debated but predictions are premature without final RTSs and ITSs.

### Coordination and cooperation
- Domestically, authorities mostly cooperate and coordinate via informal mechanisms and personal relationships. Examples: frequent interaction between BdE and CNMV, information sharing and training with INCIBE, ad-hoc contacts with law enforcement and national security agencies. A formal agreement is being negotiated between BdE, CNMV and the DGSFP on TIBER-ES development and deployment.
- There is no cooperation or coordination between financial supervisory authorities and the National Centre for the Protection of Critical Infrastructure (CNPIC); financial supervisors do not officially know which supervised institutions are classified as critical operators or what infrastructures are designated as critical.
- Internationally, BdE participates actively in EU and other international bodies and initiatives including: ECB Joint Supervisory Teams; ECB and EBA cyber risk working groups; European Systemic Cyber Group (ESCG); European Cyber Resilience Board and ECRB CIISI-EU; ECRB Crisis Coordination Network; Basel Committee working groups (ORG, Financial Technology Group, WNFR of SCG); Financial Stability Board groups (CIR, FIRE); CSOR of the SSG; IT Supervisors Group; ASBA exchanges; CPMI membership and cooperation on standards and Level 3 assessments.
- CNMV participates in EU and international mechanisms: under EMIR shares information with College of Supervisors of EU CCPs; member of ESMA’s CCP Standing Committee; contributed to FSB and CPMI-IOSCO output; regularly meets FINMA regarding SIX Group matters affecting IC and BMEC.

### Enforcement
- Authorities’ powers to enforce compliance with cyber risk regulations rest on the general sanctions regime for the sector. The legal framework stipulates classification criteria of infractions and applicable sanctions including fines, suspension of activity, sanctions to upper management, and publication of sanctions.
- No sanctions were necessary in recent years because institutions implemented satisfactorily the directions received from the authorities.

### Conclusions — key strengths
- Reviewed cyber risk supervisory practices regarding LSIs and FMIs are materially in line with applicable regulations and international good practice, but challenges remain.
- Key strengths include:
  - Clear supervisory expectations that are well communicated;
  - Effective risk-based approach and application of proportionality in supervision;
  - Useful and well validated horizontal reviews at the BdE;
  - Strong emphasis on evidence-based onsite examinations at the BdE and thorough offsite oversight at the CNMV, especially considering resource constraints;
  - Emphasis on security testing;
  - Proactive approach to regulatory changes, e.g., preparing for DORA compliance;
  - Effective internal coordination and cooperation at both BdE and CNMV.

### Conclusions — key challenges
- Key challenges identified:
  - (viii) No onsite supervisory process at the CNMV’s or the BdE’s department responsible for FMI oversight, resulting in weaker assurance over FMI compliance;
  - (ix) With current BdE approach there are few onsite examinations and it is difficult to increase coverage;
  - (x) Neither BdE nor CNMV are involved in national critical infrastructure matters, despite their good position to address continuity of critical services and systemic interdependencies;
  - (xi) TIBER-ES is not well suited to the majority of LSIs, but there is a need for a testing framework along its principles for this segment;
  - (xii) The cost/benefit ratio of institution-specific threat intelligence reports in TIBER-ES is unfavorable.

### Recommendations
- (i) Both BdE and CNMV should start planning and executing onsite examinations as part of FMI supervision. Leverage BdE’s existing cyber risk expertise in bank supervision; at CNMV consider external support limited to executing technical tasks as an interim measure. It may be necessary to revise the regulatory framework to explicitly grant onsite examination powers in this respect.
- (ii) BdE should conduct more, and more focused, thematic reviews while maintaining validation based on short onsite visits to a sample of the reviewed population. Focus horizontally (not all LSIs) and vertically (limit a review to a topical issue) to manage workload.
- (iii) Both BdE and CNMV should be involved in critical infrastructure matters (designation and compliance assessments). Involvement can range from information sharing and consultative roles under existing law to formally delegated roles that may require legal changes.
- (iv) Consider using sector-specific threat intelligence tailored to specific institutions in each TIBER-ES test to reduce costs while maintaining compatibility with TIBER.
- (v) BdE, in cooperation with CNMV and DGSFP, should develop a lighter threat intelligence-based red teaming framework based on TIBER-ES principles, considering the generally lower complexity, maturity and cost-bearing ability of a typical LSI.

*Source: IMF staff technical note as presented in the provided content unit.*

---


_Source: https://www.imf.org/-/media/files/publications/cr/2024/english/1espea2024008-print-pdf.pdf_