## 1eurea2025010 - EXECUTIVE SUMMARY

## Source details

**Canonical URL:** [1eurea2025010 - EXECUTIVE SUMMARY](https://www.imf.org/-/media/files/publications/cr/2025/english/1eurea2025010.pdf)

## Other formats

- [Markdown version](/-/media/files/publications/cr/2025/english/1eurea2025010.pdf.md)
- [Structured JSON version](/-/media/files/publications/cr/2025/english/1eurea2025010.pdf.json)

---

### Key findings and context
- The FSAP reviewed supervision and oversight of cyber risk and operational resilience of Significant Banking Institutions (SIs) in the Single Supervisory Mechanism (SSM) and Financial Market Infrastructures (FMIs) operated by the Eurosystem, including relevant ECB organizational units and the ESAs’ joint Directorate for DORA oversight (collectively “authorities”).
- ICT/cyber risk is among the most significant operational risk categories for the banking sector with potential systemic implications due to sector reliance on and interconnectedness of ICT systems.
- ICT/cyber risk trends:
  - The general risk level in the EA banking sector in 2024 remained relatively stable compared to 2023.
  - Top three risk categories with worsening trends: ICT security risk, ICT outsourcing risk, ICT change risk.
- Underlying causes identified:
  - (i) more frequent and impactful cybersecurity incidents;
  - (ii) rising reliance on cloud services;
  - (iii) a growing number of critically important ICT projects.
- DORA:
  - Applicable since January 2025.
  - Converts previous ESA guidance into binding legal requirements and creates an oversight framework for Critical Third-Party Providers (CTPPs).
  - Expected to improve stability and reliability of the EU financial sector but imposes cost impacts on supervised entities and supervisory authorities.
- Payment systems are not in DORA scope, but FMI oversight expectations are fully aligned with DORA.

### Legal and institutional framework
- Legal powers:
  - The legal basis and relevant regulation convey powers to collect information, assess compliance, impose corrective actions, sanction, and take enforcement action as last resort for SIs and FMIs.
- Key legal gap:
  - ESAs’ power to impose corrective actions on CTPPs is limited under DORA: ESAs can levy periodic penalties for not providing requested information but cannot levy fines for non-compliance with requirements because they can only make recommendations that are not legally enforceable.
- Competent authorities and roles:
  - ECB: competent authority for supervision of SIs.
  - ESAs (EBA, ESMA, EIOPA): designated lead overseers in CTPP oversight.
  - EBA develops cybersecurity standards for banks and payment institutions; EIOPA for insurance and occupational retirement provision; ESMA for CCPs, CSDs, and trading platforms.
  - Eurosystem oversees EA payment systems (TARGET Services—T2, T2S, TIPS, and ECMS).

### Strengths in supervisory and oversight practices
- SI supervision strengths:
  - (i) effective risk-based approach and application of proportionality;
  - (ii) detailed and well validated horizontal reviews complement vertical activities;
  - (iii) intrusive on-site examinations providing strong assurance.
- FMI oversight strengths:
  - (i) comprehensive assessments against the Cyber Resilience Oversight Expectations (CROE);
  - (ii) thorough follow-up of action plans.
- Common strengths:
  - Security testing oversight and effective internal and external coordination and cooperation.

### Weaknesses and operational challenges
- Major operational challenge: coping with DORA-related changes, notably need for significantly more resources for CTPP oversight, third-party risk management (including cloud), TLPTs, and incident reporting.
- Resourcing constraints:
  - Additional headcount approved across authorities for DORA CTPP oversight, but hiring has just started and the cybersecurity job market is tight, creating difficulty meeting deadlines such as designation of CTPPs by late 2025 and operationalization of the oversight framework by early 2026.
  - FMI ICT/cyber risk oversight staffing: for ECB’s lead overseer role for TARGET services there are 3 regular staff; this level is assessed as insufficient for regular deep dives or on-site inspections.
- Incident reporting:
  - DORA incident reporting regime is largely decentralized: reports are sent to the ECB Banking Supervision via NCAs, each NCA operating its own reporting infrastructure and analytical tools—described as inefficient and costly compared to a centralized model.
  - Authorities expect a "very significant increase in the number of reports" as major ICT operational incidents become reportable in all EA jurisdictions.
  - DORA requires financial entities to report major ICT-related incidents to NCAs within "4 hours" per major-incident classification criteria.
- Other notable weaknesses:
  - (i) no on-site supervision of FMIs (resulting in relatively weak assurance on adequacy of risk controls);
  - (ii) scarce cyber risk expertise in FMI oversight;
  - (iii) EU systemic cyber incident coordination framework (EU-SCICF) not finalized;
  - (iv) supervisory findings in SI supervision are piling up and create bottlenecks in follow-up work;
  - (v) some aspects of documentation of supervisory work are not standardized across on-site teams.

### Security testing, TLPTs, and exercises
- TIBER-EU:
  - Provides in-depth assessments; the single TIBER-EU test of TARGET services was executed at a "high-quality level".
  - Not the right tool to uncover weaknesses in business continuity or disaster recovery.
  - Aligned with DORA TLPT requirements and expected to remain fully compatible with the DORA TLPT regime.
- DORA TLPT requirements:
  - DORA requires Threat-led Penetration Tests (TLPTs) to be performed regularly on SIs.
  - The ECB estimates that "slightly over 100 tests need to be executed every three years at SIs".
  - No TLPTs have been executed yet.
- Testing and exercises:
  - ECB system-wide cyber resilience stress test in 2024 involved "all 109 institutions under its direct supervision"; "28 banks underwent enhanced testing" with actual recovery tests.
  - Results indicated response and recovery from severe cyber incidents "could be improved at many institutions".
  - Cyber Dry Run exercises in 2023 and 2024 focused on detection, escalation, information dissemination, and coordination; these were internal tabletop exercises.
  - International and FMI-specific crisis exercises participated in 2023–2024; gap noted that technology breakdown scenarios (leading cause of service disruptions) are not sufficiently considered in authority-run crisis exercises.

### CTPP oversight and timeline risks
- ESAs’ CTPP oversight:
  - ESAs (EBA, ESMA, EIOPA) tasked with CTPP oversight; day-to-day activities planned to start in early 2026.
  - Planned approach: mix of on-site and off-site work; methodology envisaged to use a maturity model with three levels, similar to the CROE.
  - Joint Directorate for CTPP oversight formed; director and key staff assigned; hiring specialists underway; oversight to be performed by Joint Examination Teams (JETs) with voluntary NCA contributions.
  - Directorate expected to be fully staffed and functional by early 2026, but sufficiency of staffing depends on number of CTPPs and planned intensity of activities.
- Timeline risk:
  - Schedule for CTPP designation is "very tight" and risk exists that the Q4 2025 deadline for the final CTPP list might be missed.

### Data, coordination, and systemic tools
- Centralized incident reporting:
  - ESAs issued a joint report in January 2025 assessing feasibility of a single EU Hub for ICT-related incident reporting and deemed the centralized model feasible (footnote in source).
  - Recommendation to implement an EU-wide centralized cyber incident reporting technical infrastructure to reduce inefficiencies and costs.
- ESRB data access:
  - ESRB lacks access to anonymized granular incident and loss data; availability of anonymized granular cyber risk data would allow better systemic cyber risk modelling.
  - Suggestion: use Privacy Enhancing Technologies (PETs) to provide anonymized granular data while satisfying legal requirements.
- EU-SCICF:
  - Intended to support EU-level coordinated response for systemic ICT/Cyber incidents in crisis and non-crisis modes.
  - Elements for non-crisis mode largely in place; some crisis-mode elements are work in progress; full implementation subject to legislative action or supporting initiatives by the European Commission.

### Enforcement and supervisory processes
- ECB supervisory and enforcement powers:
  - Corrective and sanctioning powers under the SSM Regulation include: (i) public disclosure, (ii) operational restrictions, (iii) suspension of activities, (iv) change of management; enforcement measures and sanctions can be used in parallel or sequentially.
  - In the last three years, the ECB imposed a pecuniary penalty on a supervised entity for breach of cyber risk regulation.
- Supervisory processes and documentation:
  - Off-site supervision performed by JSTs; on-site inspections by specialist teams, typically spanning 6 to 10 weeks.
  - JSTs use formal SREP operational risk methodology incorporating ITRQ, targeted reviews, on-site findings, TLPTs, and CTPP oversight.
  - An internal pooled ICT/cyber risk support unit ("IT Hub") is being formed to improve access to specialist resources and follow-up on findings.
  - Supervisory findings use an empirical 4-level severity grading system; repeated high-risk findings may be escalated to a Supervisory Board decision making them legally binding.
  - Documentation is thorough but not uniformly consistent across teams; gaps in standardized templates and unified filing are noted.

### Select major policy recommendations and timing
- Institutional and regulatory framework recommendations:
  - 1. Amend the regulatory framework so that it is possible to levy fines on CTPPs for non-compliance with requirements. Timing: MT. Ref. 39 (i). Responsible: EC.
  - 2. Increase cyber risk expert capacity in FMI oversight. Timing: ST. Ref. 39 (ii). Responsible: ECB.
  - 3. Finalize the development of the EU-SCICF, commence testing, and operationalize as soon as possible. Timing: ST. Ref. 39 (iii). Responsible: ESAs and EC.
  - 4. Implement an EU-wide centralized cyber incident reporting technical infrastructure. Timing: MT. Ref. 39 (iv). Responsible: EC.
  - 5. Make available anonymized granular cyber risk data to the ESRB so that more accurate systemic cyber risk estimates can be made. Timing: ST. Ref. 39 (v). Responsible: ECB and EC.
- Supervisory and oversight practices recommendations:
  - 6. Carry out on-site examinations regularly as part of FMI oversight. Timing: ST. Ref. 85 (i). Responsible: ECB.
  - 7. Leverage institutions’ internal audit or external audit to reduce the workload of following up the increasing number of supervisory measures. Timing: ST. Ref. 85 (ii). Responsible: ECB.
  - 8. Use a systemic risk impact scenario in the next cyber stress test for banks, for example unavailability of a cloud service provider. Timing: ST. Ref. 85 (iii). Responsible: ECB.
  - 9. Strengthen internal standards on the documentation of bank supervision activities, for example using common templates across all on-site examination teams for all work products, and a unified filing and archiving approach in the supporting applications. Timing: ST. Ref. 85 (iv). Responsible: ECB.
- Timing legend: Immediate (within 1 year); ST Short term (within 1-2 years); MT Medium Term (within 3−5 years).

### Operational implications and next steps
- Authorities need to scale up specialist cyber risk capacity to meet DORA obligations, notably for CTPP designation by late 2025 and operationalization by early 2026.
- Consider centralizing ICT-related incident reporting infrastructure to achieve efficiencies and reduce duplication across NCAs, FMIs, and PSPs.
- Address FMI oversight gaps by initiating regular on-site examinations and increasing cyber risk expertise within FMI oversight teams.
- Finalize and operationalize EU-SCICF and commence testing to strengthen systemic incident coordination.
- Enhance follow-up capacity on supervisory findings to avoid bottlenecks, including leveraging audits to reduce workload.
- Incorporate systemic scenarios (for example, CSP unavailability) into cyber stress testing for banks.

*Source: EXECUTIVE SUMMARY, 1eurea2025010.*

### EXECUTIVE SUMMARY __________________________________________________________________________ 4

### 1eurea2025010 - EXECUTIVE SUMMARY

### Executive summary: key findings
- The FSAP reviewed the supervision and oversight of cyber risk and operational resilience of Significant Banking Institutions (SIs) in the Single Supervisory Mechanism (SSM) and the Financial Market Infrastructures (FMIs) operated by the Eurosystem. The review included the ECB’s relevant organizational units in the ECB Banking Supervision, Directorate General Market Infrastructure and Payments (DG-MIP), and the European Supervisory Authorities’ (ESA) joint Directorate in charge for Digital Operational Resilience Act (DORA) oversight; jointly referred to as ‘authorities’.
- ICT/cyber risk is among the most significant operational risk categories for the banking sector, with potentially systemic implications due to sector reliance on and interconnectedness of ICT systems.
- ICT/cyber risk has been increasing globally; however, the observed general risk level in the EA banking sector in 2024 remained relatively stable compared to 2023. The top three risk categories with worsening trends were ICT security risk, ICT outsourcing risk, and ICT change risk.
- Underlying causes identified:
  - (i) more frequent and impactful cybersecurity incidents;
  - (ii) rising reliance on cloud services;
  - (iii) a growing number of critically important ICT projects.
- DORA, applicable since January 2025, strengthens cyber resilience by converting previous ESA guidance into binding legal requirements and creates an oversight framework for Critical Third-Party Providers (CTPPs). DORA is expected to improve stability and reliability of the financial sector in the EU but has a cost impact on supervised entities and supervisory authorities.
- While payment systems are not in the scope of DORA, FMI oversight expectations are fully aligned with DORA.
- The legal basis and relevant regulation convey adequate powers for effective ICT/cyber risk supervision and oversight of SIs and FMIs, including powers to collect information, assess compliance, impose corrective actions, sanction, and take enforcement action as a last resort.
- A key legal gap: ESAs’ power to impose corrective actions on CTPPs is limited under the DORA oversight framework. ESAs can levy periodic penalties for not providing requested information but cannot levy fines for non-compliance with requirements because they can only make recommendations that are not legally enforceable.
- Strengths in supervisory and oversight practices:
  - SI supervision: (i) effective risk-based approach and application of proportionality; (ii) detailed and well validated horizontal reviews complement vertical activities; (iii) intrusive on-site examinations providing strong assurance.
  - FMI oversight: (i) comprehensive assessments against the Cyber Resilience Oversight Expectations (CROE); (ii) thorough follow-up of action plans.
  - Both: strengths in security testing oversight and effective internal and external coordination and cooperation.
- Major operational challenge: coping with changes brought by DORA, notably need for significantly more resources for CTPP oversight and third-party risk management (including cloud), TLPT, and incident reporting.
- Resourcing constraints: additional headcount approved across authorities for DORA CTPP oversight, but hiring has just started and the job market for specialized cyber risk expertise is tight, creating difficulty in meeting deadlines such as designation of CTPPs by late 2025 and operationalization of the oversight framework by early 2026.
- Incident reporting regime under DORA is served by a largely decentralized infrastructure: reports are sent to the ECB Banking Supervision via National Competent Authorities (NCAs), each NCA operating its own reporting infrastructure and analytical tools; this is inefficient and costly compared to a centralized model. Parallel reporting exists for FMIs and PSPs; requirements largely overlap with DORA.
- Notable weaknesses that negatively impact cyber risk supervision and oversight:
  - (i) there is no on-site supervision of FMIs, resulting in comparatively weaker risk assurance;
  - (ii) cyber risk expertise in FMI oversight is scarce;
  - (iii) the development of the EU systemic cyber incident coordination framework (EU-SCICF) is not finalized;
  - (iv) findings in SI supervision are piling up and create bottlenecks in follow-up work;
  - (v) some aspects of documentation of supervisory work are not standardized, leading to different practices across on-site examination teams.

### Introduction: context and scope
- Contextual indicators cited:
  - the number of cyberattacks has almost doubled since before the COVID-19 pandemic;
  - nearly one-fifth of all incidents affect financial firms, with banks being the most frequent targets;
  - geopolitical tensions contributed to a surge of cyberattacks after Russia’s invasion of Ukraine in February 2022.
- The note adopts the SSM convention that ICT risk (non-malicious) and cyber risk (malicious) are addressed together.
- Assessment scope:
  - Reviewed cyber risk regulatory framework and supervisory practices for the SI segment in the EA and the FMIs operated by the Eurosystem.
  - FMIs in scope: TARGET Services—T2, T2S, TIPS, and ECMS.
  - Mission collected information from questionnaires, interviews, regulation, and authorities’ documentation.
- Basis for assessment included: DORA and its RTS/ITS; PFMI; CROE; CPMI-IOSCO Guidance on cyber resilience for FMIs; FSB stocktake; BCBS cyber-resilience practices; IMF Departmental Paper on Cyber risk Supervision.

### Institutional and regulatory framework: analysis
- DORA is fundamental, and is lex specialis for financial entities relative to NIS2 and CER.
- Competent authorities and roles:
  - ECB is competent authority for supervision of SIs.
  - ESAs (EBA, ESMA, EIOPA) are designated as lead overseers in CTPP oversight.
  - EBA develops cybersecurity standards for banks and payment institutions; EIOPA for insurance and occupational retirement provision; ESMA for CCPs, CSDs, and trading platforms.
  - Eurosystem oversees EA payment systems.
- EBA Guidelines on ICT and security risk management (EBA/GL/2019/04) largely superseded by DORA and was updated with a narrower scope to be applicable later in 2025. Other EBA guidelines not directly related to ICT/cyber risk remain applicable (for example, EBA/GL/2021/05; EBA/GL/2022/03; EBA/GL/2017/05).

### Recommendations (select major policy recommendations and timing)
- Institutional and regulatory framework recommendations:
  - 1. Amend the regulatory framework so that it is possible to levy fines on CTPPs for non-compliance with requirements. Timing: MT. Ref. 39 (i). Responsible: EC.
  - 2. Increase cyber risk expert capacity in FMI oversight. Timing: ST. Ref. 39 (ii). Responsible: ECB.
  - 3. Finalize the development of the EU-SCICF, commence testing, and operationalize as soon as possible. Timing: ST. Ref. 39 (iii). Responsible: ESAs and EC.
  - 4. Implement an EU-wide centralized cyber incident reporting technical infrastructure. Timing: MT. Ref. 39 (iv). Responsible: EC.
  - 5. Make available anonymized granular cyber risk data to the ESRB so that more accurate systemic cyber risk estimates can be made. Timing: ST. Ref. 39 (v). Responsible: ECB and EC.
- Supervisory and oversight practices recommendations:
  - 6. Carry out on-site examinations regularly as part of FMI oversight. Timing: ST. Ref. 85 (i). Responsible: ECB.
  - 7. Leverage institutions’ internal audit or external audit to reduce the workload of following up the increasing number of supervisory measures. Timing: ST. Ref. 85 (ii). Responsible: ECB.
  - 8. Use a systemic risk impact scenario in the next cyber stress test for banks, for example unavailability of a cloud service provider. Timing: ST. Ref. 85 (iii). Responsible: ECB.
  - 9. Strengthen internal standards on the documentation of bank supervision activities, for example using common templates across all on-site examination teams for all work products, and a unified filing and archiving approach in the supporting applications. Timing: ST. Ref. 85 (iv). Responsible: ECB.
- Timing legend: Immediate (within 1 year); ST Short term (within 1-2 years); MT Medium Term (within 3−5 years).

### Operational implications and next steps for authorities
- Authorities need to scale up specialist cyber risk capacity to meet DORA-related obligations, notably for CTPP designation by late 2025 and operationalization by early 2026.
- Consider centralizing ICT-related incident reporting infrastructure to achieve efficiencies and reduce duplication across NCAs, FMIs, and PSPs.
- Address FMI oversight gaps by initiating regular on-site examinations and increasing cyber risk expertise within FMI oversight teams.
- Finalize and operationalize EU-SCICF and commence testing to strengthen systemic incident coordination.
- Enhance follow-up capacity on supervisory findings to avoid bottlenecks, including leveraging audits to reduce workload.
- Incorporate systemic scenarios (for example, CSP unavailability) into cyber stress testing for banks.

*Source: EXECUTIVE SUMMARY, 1eurea2025010.*

### 13.      The ECB issues guides on specific topics, including ICT/cyber risk, to clarify

### 1eurea2025010 - 13.      The ECB issues guides on specific topics, including ICT/cyber risk, to clarify

### Oversight framework and standards
- Oversight of FMIs in scope is based on the ECB Regulation on oversight requirements for systemically important payment systems regulation (SIPSR) and follows the Eurosystem Cyber Resilience Strategy.
- The Eurosystem Cyber Resilience Strategy was issued in 2017 and revised in 2024 and is part of the Eurosystem Oversight Framework.
- The strategy is aligned with CPMI-IOSCO international standards and guidance:
  - Principles for financial market infrastructures (PFMIs).
  - Guidance on cyber resilience for FMIs.
- Within the PFMIs, key principles relevant to cyber risk management are:
  - Principle 2 on governance;
  - Principle 3 on the comprehensive risk management framework;
  - Principle 17 on operational risk.

### Tools, guidance, and supervisory expectations
- Two specific tools embody ECB/Eurosystem oversight expectations regarding payment systems cybersecurity:
  - (i) the ECB’s Cyber resilience oversight expectations for FMIs (CROE), which provides details and assessment criteria for the implementation of the CPMI-IOSCO Guidance on cyber resilience for FMIs, including a maturity model;
  - (ii) a cybersecurity risk survey to support the aforementioned assessment.
- The ECB issues guides on specific topics, including ICT/cyber risk, to clarify expectations based on higher level regulation; example: a guide on outsourcing to cloud service providers drafted based on DORA’s requirements on third party risk management.
- International standards for ICT risk management and cybersecurity are taken into account as supplementary sources because of their non-binding nature.

### Organization and resourcing of cyber risk supervision and oversight
- ECB ICT and cyber risk supervisory expertise organization:
  - Vertical and horizontal criteria.
  - Related functions are in Non-Financial Risk Inspections of the Directorate General On-Site & Internal Model Inspections, and in Non-Financial Risk Experts of Directorate General Horizontal Line Supervision.
  - Joint Supervisory Teams (JSTs) are responsible for continuous off-site supervision of individual banks; larger JSTs include ICT/cyber risk specialists, smaller JSTs rely on generalist supervisors.
  - JSTs comprise both ECB and NCA staff.
  - Directorate Supervisory Strategy and Risk serves as the risk management function (second line of defense) of the SSM and covers consistency and effectiveness of SREP cyber risk supervision as part of yearly SREP benchmarking.
  - An IT Risk Network at the SSM includes subject matter experts from NCAs and ECB; an ICT Risk Hub is being formed to act as a competence center for JSTs.
- Headcount and capacity:
  - ICT and cyber risk supervisory positions are described as comparatively strong but running at capacity.
  - Additional permanent headcounts have been approved and a hiring campaign is under way.
  - Challenges: a tight job market for cybersecurity skills and parallel hiring by the EASs; internal upskilling and participation of new hires in the ECB curriculum are considered to address shortages.
- FMI ICT/cyber risk oversight staffing:
  - For the ECB’s lead overseer role for TARGET services there are 3 regular staff.
  - This staffing level is assessed as insufficient to conduct regular deep dives or on-site inspections of specific ICT/cyber risk areas such as business continuity and disaster recovery.

### Efficiency, data, and systemic coordination
- DORA and incident reporting:
  - DORA simplified and harmonized incident reporting, but current model routes reports to ESAs via NCAs, each operating their own reporting infrastructure and analytical tools.
  - The current decentralized model is described as very inefficient and costly compared to a centralized model with one central infrastructure and one set of analytical tools.
  - Footnote: In January 2025 the ESAs issued a joint report assessing the feasibility of the establishment of a single EU Hub for ICT-related incident reporting, in which they deemed the centralized model feasible.
- ESRB data access:
  - The ESRB’s work on cyber risk is hindered by limited access to granular data such as actual cyber incidents and losses incurred.
  - The ESRB has no access to granular data on specific institutions from incident reporting.
  - With appropriate privacy technologies anonymized granular data could be provided to satisfy legal requirements and allow better systemic cyber risk modelling.
  - Footnote: Dearth of good quality risk data is a global problem; the new comprehensive incident reporting regime in the EU is expected to improve this over time.
- EU-wide systemic cyber incident coordination framework (EU-SCICF):
  - The ESRB recommended establishment of the EU-SCICF in 2021; DORA entered into application in 2025 and required ESAs to deliver a report on the design by July 2024.
  - The EU-SCICF is intended to support an effective EU-level coordinated response for systemic ICT/Cyber incidents and is to operate in two distinct modes: crisis and non-crisis.
  - Elements for non-crisis mode are largely in place; some crisis-mode elements are work in progress.
  - Full implementation is subject to legislative action or other supporting initiatives that the European Commission may take.

### Conclusions (key findings)
- Legal and regulatory powers:
  - The legal basis and relevant regulation convey adequate powers for effective ICT/cyber risk supervision and oversight of SIs and FMIs, including powers to collect information, assess compliance, impose corrective actions, sanction, and take enforcement action as a last resort.
- Limitations on powers over CTPPs:
  - Under DORA the power to impose corrective actions on CTPPs is limited.
  - Periodic penalties can be levied for not providing relevant information, but ESAs can only make recommendations for non-compliance with requirements, which are not legally enforceable.
  - Effectiveness depends on CTPPs’ willingness to cooperate; lack of cooperation, particularly in a crisis, would leave ESAs with limited legal means and could pose significant reputational risks.
  - As a last resort, institutions may be required to suspend use of an infringing service provided by the CTPP, which could be very difficult or impossible in some cases (e.g., outsourcing of critical functions to the cloud).
- Resourcing concerns:
  - Availability of ICT/cyber risk related supervisory and oversight skills affects all authorities.
  - Uncertainty exists whether approved additional headcounts can be filled with adequately skilled staff.
  - Staff numbers are insufficient in FMI cyber risk oversight and this may become an issue at the ESAs when CTPP-related work scales in 2026.
- Systemic inefficiencies:
  - There are inefficiencies in cyber risk management at the systemic level.
  - Potential reductions in costs and improved systemic risk estimates could be achieved with an EU-wide centralized incident reporting framework and access to anonymized granular data for the ESRB.

### Recommendations (authoritative advice)
- The authorities are advised to:
  - (i) Amend the regulatory framework so that it is possible to levy fines on CTPPs for non-compliance with requirements;
  - (ii) Increase cyber risk expert capacity in FMI cyber risk oversight;
  - (iii) Finalize the development of the EU-SCICF, commence testing, and operationalize as soon as possible;
  - (iv) Implement an EU-wide centralized cyber incident reporting technical infrastructure;
  - (v) Make available anonymized granular cyber risk data to the ESRB so that more accurate systemic cyber risk estimates can be made (for example, Privacy Enhancing Technologies (PETs) could be used for this purpose).

### Supervisory and oversight practices (summary of bank supervision and FMI oversight)
- Bank supervision:
  - Key ECB supervisory approach elements: off-site ongoing supervision (including targeted reviews and sector-wide risk analyses), on-site inspections, and Threat-Led Penetration Testing (TLPT) oversight.
  - Off-site supervision is performed by JSTs and the horizontal supervisory function; on-site inspections are executed by specialist teams.
  - ICT/cyber risk tolerance is low: relevant risk controls should be without major weaknesses or weaknesses must be resolved within a realistic timeframe.
  - Proportionality and a risk-based approach are applied; intensity and resource allocation are proportional to size, complexity, ICT operations, and risk profile.
  - JSTs use a formal SREP operational risk methodology; inputs include documentation, public sources, questionnaires like the IT Risk Questionnaire (ITRQ), targeted reviews, on-site inspection findings, TLPTs, and CTPP oversight.
  - On-site inspections are demand driven, typically span 6 to 10 weeks, and are intrusive by design; methodology is ECB-developed and largely aligned with widely used ICT/cyber risk and control frameworks.
  - An internal pooled ICT/cyber risk support unit (“IT Hub”) is being formed to improve access to specialist resources and follow-up on findings.
  - Supervisory findings use an empirical 4-level severity grading system; banks must submit action plans and JSTs follow up until resolution.
  - Repeated high-risk findings may be escalated to a Supervisory Board decision making them legally binding and enabling enforcement.
  - Supervisory outputs are subject to internal quality assurance, multiple approvals, and periodic reviews by the second line of defense.
  - Documentation is thorough but not uniformly consistent across teams; an audit trail is available for important processes and key documents.
  - Recent increases in findings have created bottlenecks for follow-up, driven by heightened supervisory focus and targeted reviews.
  - Footnote: The SREP section was updated to incorporate operational resilience, integrate DORA requirements, and raise the profile of ICT/cyber risk within operational risk; the operational resilience rating does not impact capital requirement.
  - Footnote: The ITRQ is publicly available.
- FMI oversight:
  - Focus is on compliance assessments against the CROE and assessing cyber resilience through surveys; both CROE assessment and the cyber resilience survey (CRS) are validated self-assessments and complementary.
  - Assertions by FMIs must be supported with documentation; discrepancies are followed up.
  - The CROE assessment has been done only once so far for TARGET services; the CRS is done every two years.
  - No on-site activity was performed yet for TARGET services under the oversight approach; the first deep dive with on-site presence is planned for later in 2025.
  - International standards are agnostic on requirement for on-site inspections, though the ECB Decision detailing powers for SIPS sets out on-site inspections as an option.
  - Footnote: There are only high-level expectations directed to FMI overseers, as opposed to FMIs; CPMI-IOSCO sets out 5 responsibilities for central banks, market regulators, and other relevant authorities.

*Source: https://www.imf.org/-/media/files/publications/cr/2025/english/1eurea2025010.pdf*

### 44.      As a result, the assurance that is obtained on the adequacy of risk controls is relatively

### 1eurea2025010 - 44.      As a result, the assurance that is obtained on the adequacy of risk controls is relatively

### Assurance and resourcing
- The assurance obtained on the adequacy of risk controls for FMIs is "relatively weak" considering their vital nature (paragraph 44).
- The FMI oversight function is scarcely staffed with ICT/cyber risk experts (paragraph 44).
- Hiring to meet new demands has just started and the job market for highly specialized cyber risk expertise is tight, making it difficult to fill open positions (paragraph 72).

### Security testing: TIBER-EU, TLPTs, and DORA alignment
- TIBER-EU:
  - Provides in-depth assessment of tested entities’ capacity to protect against, detect, respond and recover from cyber attacks (paragraph 45).
  - The single test so far of TARGET services was executed at a "high-quality level" and used realistic attack scenarios based on institution-specific threat intelligence, producing detailed findings that strengthened defenses (paragraph 45).
  - TIBER-EU is not the right tool to uncover potential weaknesses in business continuity or disaster recovery (paragraph 45).
  - TIBER-EU framework is aligned with DORA TLPT requirements and is expected to remain fully compatible with the DORA TLPT regime (paragraph 53).
- DORA and TLPTs:
  - DORA requires Threat-led Penetration Tests (TLPTs) to be performed regularly on SIs, among others (paragraph 51).
  - The ECB estimates that "slightly over 100 tests need to be executed every three years at SIs" (paragraph 51).
  - No TLPTs have been executed yet (paragraph 51).
  - The ECB is involved in identification, validation of scope, attestation, and follow-up of TLPTs; NCAs are expected to contribute significantly (paragraph 51).
- Scope:
  - Payment systems are not in DORA’s scope and thus not required to undergo TLPTs, but systemically important payment systems such as TARGET services are tested under TIBER-EU (paragraph 52).

### Critical Third-Party Provider (CTPP) oversight
- ESAs (EBA, ESMA and EIOPA) tasked with CTPP oversight; day-to-day activities planned to start in early 2026 (paragraph 48).
- Planned approach: mix of on-site and off-site work, similar to the SSM; methodology envisaged to use a maturity model with three levels, similar to the CROE (paragraph 48).
- Joint Directorate for CTPP oversight formed; director and key staff assigned; hiring specialists underway; oversight to be performed by Joint Examination Teams (JETs) with voluntary NCA contributions (paragraph 49).
- Directorate expected to be fully staffed and functional by early 2026, but sufficiency of staffing depends on number of CTPPs and planned intensity of activities (paragraph 49).
- Timeline risk:
  - Schedule for CTPP designation is "very tight" and there is a risk the deadline set in Q4 2025 for the final CTPP list might be missed (paragraph 50).
  - Short time to process and analyze registries, conduct consulting, and finalize the list; uneven data quality across industries and potential delays from consulting with potential CTPPs (paragraph 50).

### Testing and crisis exercises
- ECB system-wide cyber resilience stress test in 2024:
  - Conducted in 2024 involving "all 109 institutions under its direct supervision" (paragraph 54).
  - Scenario focused on response to, and recovery from, a severe but plausible cybersecurity incident affecting databases of each bank’s core systems (paragraph 54).
  - "28 banks underwent enhanced testing" and were required to execute actual recovery tests and submit evidence; the rest executed tabletop testing (paragraph 54).
  - Results indicated response and recovery from severe cyber incidents "could be improved at many institutions" (paragraph 54).
- Cyber Dry Run exercises:
  - In 2023 and 2024 the ECB together with NCAs organized Cyber Dry Run exercises as part of SSM operational resilience testing, focusing on detection, escalation, information dissemination, and coordination during a systemic crisis (paragraph 55).
  - These were internal tabletop exercises within SSM and ECB frameworks, without involvement from external authorities or supervised entities (paragraph 55).
- International exercises:
  - In 2024 the ECB participated in a cross-border cyber crisis coordination exercise conducted by the G7 Cyber Expert Group, scenario involved large-scale cyber attack against FMIs and other institutions in the G7 (paragraph 56).
  - FMI-related cyber crisis exercises conducted via the ECRB in 2023 and 2024; an ECRB working group develops a playbook of scenarios and a multi-year testing program (paragraph 57).
- Gap in exercises:
  - Technology breakdowns remain the leading cause of service disruptions but are not considered in authority-run crisis exercises; suggestion that system-wide tests using such scenarios may be justified (paragraph 58).

### Incident reporting
- DORA changes:
  - DORA consolidated and significantly changed the incident reporting regime; key changes entered into effect in January 2025, including incident classification criteria, reporting process, required information, and deadlines (paragraph 59).
  - Financial entities required to report major ICT-related incidents and cybersecurity threats (voluntary) to NCAs within "4 hours" per clear major-incident classification criteria (paragraph 59).
  - Reports include comprehensive information such as duration of outage, severity/impact, systems and services affected, number of records exposed, threat vector, vulnerabilities exploited, financial loss, and root cause analysis (paragraph 59).
  - ESAs route reports according to predefined rules, disseminate as needed in consultation with ENISA and in cooperation with originating NCAs; authorities only receive incident reports from institutions under their remit (paragraph 59).
- Payment systems:
  - Payment systems under Eurosystem oversight report incidents according to requirements aligned with DORA to their lead overseer; TARGET services report to the ECB under the Eurosystem major incident reporting framework (paragraph 60).
- Operational impacts:
  - Authorities have documented follow-up procedures: monitoring, coordination, information sharing, risk analysis, further scrutiny, developing findings and recommendations; internal dashboards and trend analyses prepared; summaries and key observations may be published (paragraph 61).
  - Authorities expect a "very significant increase in the number of reports" as major ICT operational incidents become reportable in all EA jurisdictions (paragraph 62).
  - At the ECB incident reports are received automatically and continuously but "there is no staff on continuous duty for monitoring and follow up"; alerts are sent to key staff outside office hours (paragraph 63).

### Coordination and cooperation
- Internal SSM coordination:
  - Significant effort expended on internal and external coordination due to SSM complexities (paragraph 64).
  - IT Risk Network (ITRN) composed of subject matter experts from NCAs and the ECB works regularly on IT Risk and cybersecurity topics; ITRN is collaborative forum co-chaired by the ECB and one NCA, not a decision-making body (paragraph 64).
  - FMI overseers are non-permanent members of the ITRN; internal Cyber Security Steering Committee (CSSC) established to facilitate information sharing among ECB business areas (paragraph 64).
- European and international cooperation:
  - ECB and ESAs participate in the European Systemic Cyber Group (ESCG) of the ESRB (paragraph 65).
  - ECB supported ECRB’s CIISI-EU for intelligence sharing and best practice exchange; ECB led establishment of ECRB’s Crisis Coordination Network (CC-Network) with operation set out in the CC-Protocol (paragraph 65).
  - ECB cooperates with other EU agencies (e.g., EBA, ENISA) through meetings, joint working groups, and collaborative frameworks (paragraph 66).
  - ECB and ESAs (represented by EBA) are members of the G-7 Cyber Experts Group (CEG) and follow the G7 cyber incident response protocol (CIRP) for communication and information sharing in G7 contexts (paragraph 67).
  - Regular trilateral meetings with the Federal Reserve Board (US) and the Prudential Regulation Authority (UK) for exchange on cyber risk developments and regulatory trends (paragraph 68).
  - In FMIs and payments, cooperation on cyber risk and standard-setting occurs under CPMI and IOSCO; ECB’s DG-MIP is a regular participant (paragraph 69).

### Enforcement
- ECB enforcement and supervisory measures:
  - ECB’s ability to act is based on corrective and sanctioning powers under the SSM Regulation (paragraph 70).
  - Relevant supervisory measures for cyber risk include: (i) public disclosure, (ii) operational restrictions, (iii) suspension of activities, and (iv) change of management; enforcement measures and sanctions can also be used (paragraph 70).
  - Supervisory measures, enforcement measures and sanctions can be used in parallel or sequentially (paragraph 70).
  - In the last three years, the ECB imposed a pecuniary penalty on a supervised entity for breach of cyber risk regulation (paragraph 70).

### Conclusions: strengths and weaknesses
- Strengths (paragraph 71):
  - SI supervision: (i) effective risk-based approach and application of proportionality; (ii) detailed and well validated horizontal reviews complement vertical activities; (iii) intrusive on-site examinations providing strong assurance.
  - FMI oversight: comprehensive assessments against the Cyber Resilience Oversight Expectations (CROE) and thorough follow-up of action plans.
  - Both: strengths in security testing oversight and effective albeit complicated coordination and cooperation.
- Key operational challenge (paragraph 72):
  - Coping with changes brought by DORA, especially resource needs for CTPP oversight, third-party risk management including cloud outsourcing, TLPT, and incident reporting.
  - Additional headcount approved but hiring constraints may impede meeting deadlines like designation of CTPPs by late 2025 and operationalization of oversight by early 2026.
- Weaknesses (paragraph 73):
  - (i) No on-site supervision of FMIs, resulting in comparatively weaker risk assurance;
  - (ii) Cyber risk expertise in FMI oversight is scarce;
  - (iii) Development of the EU systemic cyber incident coordination framework (EU-SCICF) is not finalized;
  - (iv) Findings in SI supervision are piling up and create bottlenecks in follow-up work;
  - (v) Some aspects of documentation of supervisory work are not standardized, leading to different practices across on-site examination teams.

### Recommendations (paragraph 74)
- Carry out on-site examinations regularly as part of FMI oversight.
- Leverage institutions’ internal audit or external audit to reduce the workload of following up the increasing number of supervisory measures.
- Use a systemic risk impact scenario in the next cyber stress test for banks, for example unavailability of a cloud service provider.
- Strengthen internal standards on the documentation of bank supervision activities, for example using common templates across all on-site examination teams for all work products, and a unified filing and archiving approach in the supporting applications.

*Source: https://www.imf.org/-/media/files/publications/cr/2025/english/1eurea2025010.pdf*

---


_Source: https://www.imf.org/-/media/files/publications/cr/2025/english/1eurea2025010.pdf_