## crsea ## Source details **Canonical URL:** [crsea](https://www.imf.org/-/media/files/publications/dp/2019/english/crsea.pdf) ## Other formats - [Markdown version](/-/media/files/publications/dp/2019/english/crsea.pdf.md) - [Structured JSON version](/-/media/files/publications/dp/2019/english/crsea.pdf.json) --- ### Executive Summary — Overview and Key Findings - Purpose: Highlights emerging supervisory practices that contribute to effective cybersecurity risk supervision and emphasizes adoption by agencies at an early stage of developing a supervisory approach. - Context and nature of risk: - Cyber attacks can be immediate, stealthy, persistent (advanced persistent threats), destructive, and able to render risk management and business continuity arrangements ineffective. - Cyber incidents can implicate national security and produce cross-border spillovers. - Trends and magnitude: - Cyber crime costs businesses close to US$600 billion annually, up from US$445 billion in 2014 (McAfee and Center for Strategic & International Studies 2018). - A 2017 survey estimated that a typical financial institution faces an average of 85 targeted cyber attacks every year, a third of which are successful (Accenture 2017). - An IMF staff modeling exercise (2018) estimates that annual losses to financial institutions from cyber attacks could reach several hundred billion dollars a year in an extreme scenario (Bouveret 2018). - Nature of attacks shifted from predominantly destructive malware in 2015–16 to mainly phishing attacks in 2018. - Supervisor role and capabilities: - First line of defense rests with firms’ own risk management; supervisors influence, incentivize, and shape firms’ cybersecurity capabilities to internalize spillovers and address systemwide aspects. - An IMF survey of 40 developing jurisdictions revealed that 92.5 percent face skills shortages in cybersecurity regulation and supervision. - Even resource-constrained supervisors can: build information-gathering and sharing systems, improve basic security practices (“cyber hygiene”), identify and deploy resources toward key assets, and carry out basic cyber exercises. ### Achieving Cyber Resilience — Core Supervisory Activities - Core activities supervisors should pursue: - Identify the threat landscape. - Map the cyber and financial system. - Create coherent regulation. - Conduct supervisory assessment. - Establish formal information sharing and reporting mechanisms. - Provide adequate response and recovery. - Ensure preparedness of supervisory agencies. - Standards and alignment: - Supervisors generally leverage existing standards such as the US National Institute of Standards and Technology Cybersecurity Framework, ISO 27000 series, and CPMI/IOSCO guidance for cyber resilience of financial market infrastructures. - Regulatory design principles: - Emphasize “what to achieve” over “how to achieve.” - Use a combination of broad principles, outcome-focused rules, and baseline expectations. - Maintain proportionality: smaller firms focus on cyber hygiene; largest and most globally connected firms and key system nodes face heightened standards. - Promote regulatory consistency across national and international authorities to avoid unnecessary divergence. - Regulations should be enforceable and adaptable; “control coverage” applies to all supervised firms while “maturity” scales with complexity/systemic importance. ### Identifying the Threat Landscape and Incident Reporting - Information gathering: - Supervisors should develop relationships with national agencies (computer emergency response teams, cyber crime units), peer supervisors in other jurisdictions, and industry sources. - Threat information examples include technical indicators, adversary tactics/techniques/procedures, best practices, security tool configurations, threat analysis, and incident details. - Goal: Build a threat profile for each supervised firm and for the sector as a whole. - Incident reporting frameworks: - Well-designed incident reporting frameworks are needed to gather trend data; convergence in taxonomies (for example, the Financial Stability Board’s “Cyber Lexicon” of approximately 50 core terms) is underway. - Reporting requirements should establish thresholds that balance sufficient information on significant issues with avoidance of excessive noise; thresholds may combine importance of systems affected, duration of downtime, type of incident, and firms’ internal risk classification. - 72 percent of jurisdictions reported plans to issue new regulations, guidance, or supervisory practices addressing cybersecurity for the financial sector within the next year (FSB stocktake). ### Mapping the Cyber and Financial System (Annex 2 approach) - Purpose and two-step process: - Step 1 (Firm level): in-depth understanding of a firm’s ICT systems, business model, ICT risk management, and importance for the financial sector. - Step 2 (Sector wide): consolidate firm-specific financial and technical connections to form a systemwide financial sector network map that combines financial connections and ICT connections. - Uses of the cyber map: - Assess vulnerabilities, identify concentrations in third-party service providers, and estimate impact of an attack on nodes (payment and settlement systems, clearing agents, etc.). - Identify dependencies on critical infrastructure (telecommunications, power) and connect to national critical infrastructure processes. - Stylized mapping features: - Entities: FIs in pink; third-party technology providers in green. - Node size proportional to degree of centrality (interconnectedness and importance). - Inset concept: a smaller node may serve as a gateway to crucial correspondent relationships. - Practical guidance and steps for supervisors: - Scoping and data model selection, data collection, classification to discrete attribute values, database load, visualization (three layers: data flow, organizational dependencies, technological dependencies), and analysis using network tools. - Recommended limits to keep effort practical (e.g., include top ICT third parties such as those in the top five providers per mapped financial firm). - Tools referenced for stylized visualization: Gephi; other options include R and Tableau; Access is adequate for supporting database. ### Regulation, Supervisory Assessment, and Testing - Supervisory assessment: - Cybersecurity risk should be assessed within the supervisory review process as part of operational risk/ICT risk assessments; supervisory manuals and dedicated onsite guidance are needed. - Supervisors should assess inherent cyber risk and control maturity; expect control maturity to exceed inherent risk level for critical nodes. - Examples of indicators to monitor: level of internet dependencies of critical ICT systems; complexity of ICT landscape; outdated nature of critical ICT systems. - Remediation plans are used where control maturity is below expectations; capital add-ons are not a solution for deficient risk management but may be used to incentivize mitigation. - Testing and exercises: - Security testing (penetration tests, red-team tests) at firm and sector levels supports detection, response, and recovery capability assessment. - Supervisory role: set expectations, review scope and parameters, vet third-party test providers if engaged, review test results and mitigation strategies, and follow up on gap closures. - Penetration testing recommendations: require regular tests for high-risk and/or internet-facing applications; alternatives include vulnerability scanning where cost/affordability issues exist. - Supervisors can mandate and coordinate industrywide crisis management exercises, starting with tabletop exercises for systemically important firms. ### Third-Party Risk, Outsourcing, and Governance - Key supervisory priorities: - Understand reliance on third-party service providers and concentrations that can be systemic. - Ensure ICT security requirements in contracts (minimum cybersecurity, data life cycle, data center locations, encryption) match supervisory expectations. - Maintain incident handling and escalation effectiveness irrespective of outsourcing. - Supervisory approaches and guidance: - Due diligence, contract review, continuous oversight, business continuity requirements, documentation, sub-outsourcing provisions, access/audit rights, and termination rights are emphasized (European Banking Authority Guidelines on Outsourcing Arrangements cited as example). - Board and senior management responsibilities: - Assignment of cybersecurity responsibility to the board and senior management; designated independent chief information security officer or equivalent; documented cybersecurity program/policy and governance; identification of critical information assets and control assessments; identity and access management; software development lifecycle controls. ### Information Sharing, Legal Impediments, and Reporting - Information sharing benefits and impediments: - Sharing among firms, supervisors, and other authorities improves detection and coordinated response. - Challenges include establishing trust, interoperability and automation, safeguarding sensitive information, evaluating quality of information, and legal fears of reprisal from sharing too broadly. - Mechanisms to mitigate trust and national security concerns: cross-border submissions without naming the source, severity indicators without loss data, limited submissions relevant to detection and response, and consistent information classification protocols. - Supervisory and legal considerations: - Data protection requirements should be considered but not used as a reason to avoid sharing; sufficiently detailed anonymized data is encouraged. - In multi-authority jurisdictions, develop protocols and platforms for interauthority sharing and coordination. ### Crisis Preparedness, Business Continuity, and Recovery Objectives - Crisis preparedness and coordination: - Authorities need comprehensive tools and powers, adequate resources, efficient procedures, and strong legal/institutional foundations; crisis plans should be continually updated. - Regular sector-wide exercises involving public and private entities are recommended. - Clear lines of reporting, succession for strategic functions, and crisis communication preparedness plans are essential. - Business continuity and recovery objectives: - Firms should review and test business continuity plans at least annually and report results to supervisors. - Supervisors should ensure business continuity plans include fallback data centers, remote recovery copies of critical production data, and regular business continuity and disaster recovery tests (including simulation exercises). - Recovery time objectives (RTO) and recovery point objectives (RPO) should align with financial stability needs, but overly rigid RTOs/RPOs can be counterproductive if forensic analysis is incomplete. ### Supervisory Capacity, Skills, and Resourcing - Capacity challenges: - Filling staffing and skills gaps is critical, especially in developing and emerging economy countries. - Effective models combine generalist supervisory skills (operational risk) with technical specialists (often from central bank ICT staff). - Capacity building approaches: - Acquire specialists, train generalist supervisors, and leverage internal resources; treat capacity building as an ongoing process. ### Cyber Risk Insurance and Modeling (Annex 1, Box 4) - Role and limitations of cyber insurance: - Can provide protection for residual risks and create incentives to improve risk management, but is no substitute for mitigation. - Insurability challenges include difficulty estimating probability and cost of losses, unspecified maximum losses, difficulties measuring claims, and underwriting viability. - Insurers can add value via underwriting assessments, assistance with risk management, and post-event response; insurers may refuse coverage if standards are not met. - Market and regulatory observations: - Approximately 90 percent of the world’s cyber insurance market is in the United States. - The EU General Data Protection Regulation (effective May 2018) is expected to spur cyber insurance market development in the EU. - Government-run insurance pools could increase capacity and information sharing but may limit competition and pricing differentiation. - Cyber risk modeling challenges and developments: - Challenges: incomplete/scarce historical data, rapidly evolving threats, borderless risks and accumulation uncertainty. - Industry developments: March 2018 RMS probabilistic cyber risk model (five loss categories: data exfiltration, contagious malware, financial theft, cloud outages, denial of service); AIR Worldwide accumulation methodology used with Lloyd’s; Lloyd’s/AIR/RMS collaboration on standard definitions for common cyber insurance data. ### Mapping Implementation — Practical Steps and Recommendations - Main mapping steps: - Preparation: finalize scoping criteria and data models; create database. - Data collection: inventory entities per scoping criteria; collect attributes (market share, main service providers, data flows, critical IT systems). - Finding interconnections: list connections between entities. - Classification: map continuous data to discrete attribute values; assign attributes. - Database load and visualization: load entities/connections; programmatically visualize layers. - Analysis: identify risk concentrations with network analysis tools. - Design recommendations: - Prefer simpler entity and attribute sets for supervisory utility. - Define map layers (data flow, organizational dependencies, technological dependencies). - Use weights from market shares, transaction volumes, or synthetic metrics where applicable. - Keep final outputs flexible to country specificity. - Stylized three-step illustration: - Step 1: Develop inventory of systemically important participants and their ICT networks. - Step 2: Map connections between participants. - Step 3: Add analysis (for example, degree of centrality for node sizing; data flow weights for link volumes). ### Conclusion — Policy Priorities and Forward Agenda - Priority policy themes: - Address third-party reliance and concentration risks. - Overcome chronic supervisory skills shortages with targeted capacity building. - Emphasize recovery planning, simulation exercises, and industrywide crisis-management drills. - Strengthen domestic and international information sharing, foster trust, and adopt common taxonomies. - Leverage existing international standards and supervisory cooperation to promote convergence and avoid regulatory arbitrage. - Supervisory framework essentials: - Grant supervisors sufficient authority and flexibility to adapt to evolving cyber risk. - Anchor supervisory programs in cyber and financial system mapping, firms’ risk assessments, incident reporting, testing, and continuous improvement. *Source: IMF staff (crsea).* ### references. ### References ### Identifiers and Classification - ISBN 9781513507545 (paper) - LCSH: Financial institutions—Risk management. | Financial institutions—Computer networks—Security measures. | Hacking—Prevention. - LCC HG173.W55 2019 ### Table of Contents (sections and page indicators where shown) - Executive Summary ��������������������������������������������������������������������������������������������������������������������v - Glossary ������������������������������������������������������������������������������������������������������������������������vii - Overview ����������������������������������������������������������������������������������������������������������������������1 - 1� The Nature of Risk .........................................................................................................3 - 2� Achieving Cyber Resilience ������������������������������������������������������������������������������������7 - Identifying the Threat Landscape .....................................................................................8 - Mapping the Cyber and Financial System ........................................................................9 - Regulation ......................................................................................................................10 - Supervisory Assessment ..................................................................................................16 - Information Sharing and Reporting ...............................................................................21 - Role of the Supervisor to Encourage Adequate Response and Recovery .........................24 - Preparedness of Supervisory Agencies for a Cyber Attack ...............................................29 - Conclusion ������������������������������������������������������������������������������������������������������������31 ### Appendices - Appendix 1� Cyber Insurance ����������������������������������������������������������������������������������������33 - Appendix 2� Cyber Mapping �����������������������������������������������������������������������������������������37 ### Boxes - Box 1. International Standard-Setting Efforts ................................................................14 - Box 2. US FFIEC Cybersecurity Assessment Tool .........................................................20 - Box 3. The European Banking Authority and US Federal Reserve Bank’s Approach to Supervising Third-Party Risks ..............................................................................22 - Box 4. Cyber Risk Modeling in the Insurance Industry .................................................36 ### Figures - Figure 1. Supervision to Build Resilience .........................................................................8 - Figure 2. An Example of a Mapping Exercise ................................................................11 - Figure 3. Cyber Risk Maturity-Control Matrix ..............................................................19 - Figure 4. Basel Committee for Banking Supervision Illustration of Interlinkage of Different Types of Cybersecurity Information-Sharing Practices ..............................24 *crsea - references (PDF chapter/section).* ### Executive Summary ### Executive Summary ### Overview - Purpose: Highlights emerging supervisory practices that contribute to effective cybersecurity risk supervision and emphasizes adoption by agencies at an early stage of developing a supervisory approach. - Context: - Financial sector supervisory authorities worldwide are establishing and implementing frameworks for cyber risk supervision. - Cyber risk often stems from malicious intent and can shut down a supervised firm immediately and lead to systemwide disruptions and failures. - Probability of attack has increased as financial systems rely more on information and communication technologies (ICT) and as threats evolve. - Supervisor role: - First line of defense rests with firms’ own risk management, but supervisory authorities play a crucial role in ensuring resilience of both firms and the system. - Information gathering and analysis, including relationships with other national agencies and supervisors in other jurisdictions, are essential to develop understanding of the evolving “threat landscape.” - Developing a “cyber map” of key elements of the financial sector (payment systems, exchanges, financial market infrastructures, financial institutions) and key technology systems in use by each supervised firm provides a systemwide view for assessment and anchoring of supervisory programs. ### The Nature of the Risk - Key characteristics: - Cyber attacks can be immediate, stealthy, persistent (advanced persistent threats), and able to render certain risk management and business continuity arrangements ineffective. - Broader range of entry points than other risks; attacks can propagate rapidly within networks and may be destructive rather than profit-motivated. - Cyber incidents can implicate national security considerations and cross-border spillovers. - Trends and magnitude: - Cyber crime costs businesses close to US$600 billion annually, up from US$445 billion in 2014 (McAfee and Center for Strategic & International Studies 2018). - A 2017 survey estimated that a typical financial institution faces an average of 85 targeted cyber attacks every year, a third of which are successful (Accenture 2017). - An IMF staff modeling exercise (2018) estimates that annual losses to financial institutions from cyber attacks could reach several hundred billion dollars a year in an extreme scenario, eroding bank profits and potentially threatening financial stability (Bouveret 2018). - Nature of attacks has shifted from predominantly destructive malware in 2015–16 to mainly phishing attacks in 2018. - Dependencies and amplification: - Growing interconnectedness and complexity of ICT systems and dependencies on sectors such as telecommunications increase impact. - Extensive outsourcing can increase systemic risk where not well managed. - Standards and alignment: - Supervisors generally leverage existing standards such as the National Institute of Standards and Technology’s Cybersecurity Framework, ISO 27000 series, and CPMI/IOSCO guidance for cyber resilience of financial market infrastructures. ### Achieving Cyber Resilience (Objective of Supervision) - Supervisory goal: Influence, incentivize, and shape firms’ cybersecurity capabilities to internalize spillovers and externalities and address systemwide aspects. - Core supervisory activities to build resilience: - Identify the threat landscape. - Map the cyber and financial system. - Create coherent regulation. - Conduct supervisory assessment. - Establish formal information sharing and reporting mechanisms. - Provide adequate response and recovery. - Ensure preparedness of supervisory agencies. - Resourcing and priorities: - Building skills and supervisory resources is a key challenge; IMF technical assistance experience shows dearth of specialist skills is one of the biggest challenges. - An IMF survey of 40 developing jurisdictions revealed that 92.5 percent face skills shortages in cybersecurity regulation and supervision. - Even resource-constrained supervisors can: build information-gathering and sharing systems, improve basic security practices (“cyber hygiene”), identify and deploy resources toward key assets, and carry out basic cyber exercises. ### Identifying the Threat Landscape - Information gathering and analysis: - Supervisors should develop relationships with national agencies (computer emergency response teams, cyber crime units in law enforcement) and supervisors in other jurisdictions, and gather industry sources. - Cyber threat information examples: technical indicators (malicious IP addresses, domains, indicators of compromise), adversary tactics/techniques/procedures, best practices, security tool configurations, threat analysis, and incident details. - Goal: Build a threat profile for each supervised firm and, in combination, for the complete financial sector. - Incident reporting: - Well-designed incident reporting frameworks are needed to gather trend data and inform the threat landscape. - Convergence in taxonomies and templates is underway (e.g., Financial Stability Board’s “Cyber Lexicon” comprising approximately 50 core terms). ### Mapping the Cyber and Financial System - Purpose: A full picture of supervised firms and their ICT systems underpins supervisors’ understanding of vulnerabilities and systemic risks. - Two-step mapping process: - Step 1: Firm level — in-depth understanding of a firm’s ICT systems, business model, ICT risk management, and importance for the financial sector. - Step 2: Sector wide — consolidate firm-specific financial and technical connections to form a systemwide financial sector network map that combines financial connections and ICT connections. - Uses of the cyber map: - Help assess vulnerabilities, identify concentrations in third-party service providers, and estimate impact of an attack on nodes (payment and settlement systems, clearing agents, etc.). - Identify dependencies on critical infrastructure (telecommunications, power) and connect to national critical infrastructure processes. - Example basic supervisory process for smaller systems: - Step 1. Identify main systemic institutions in the financial sector and extent of financial flows. - Step 2. Survey systemic institutions to detail the use of primary ICT including service providers. - Step 3. Aggregate firm-specific data to form a sector-wide view of ICT use and identify potential concentrations of platforms and service providers. - For complex systems: combine financial sector interlinkages with network linkages for more elaborate cyber mapping. ### Regulation and Supervisory Framework - Regulatory requirements: - Regulations should ensure good cybersecurity risk management practices are in place and should build on existing and widely embraced technical standards. - Regulatory design should be developed in consultation with the financial sector. - Complementary supervisory measures: - Sound and consistent supervisory practices. - Testing mechanisms to inform response planning. - Timely reporting and information-sharing arrangements. - Continuous improvement process for regulatory frameworks and supervisory practices. - Risk-based supervision: - Supervisors should build on risk assessments undertaken by supervised firms, understanding information assets, confidentiality/integrity/availability protection requirements, and maturity of cybersecurity management to implement a risk-based approach. - Both offsite and onsite supervisory review processes should include cybersecurity risk. - Third-party concentration and governance: - Regulation and supervision of key third-party service providers, particularly where services are concentrated in a few providers, is important. - Boards of directors and senior management should be expected to take responsibility for cyber resilience and broader business technology risks. ### Testing, Response, and Information Sharing - Security testing: - Security testing exercises focused on detection, response, and recovery are core elements for building resilience. - Cyber attack simulation exercises at the firm level inform continuous improvement. - Sector-wide tests involving public and private participants complement firm-level exercises and deepen understanding of response, recovery protocols, and information sharing. - Crisis management: - Crisis management planning by supervisors and agencies tasked with financial system oversight is needed to complement private sector exercises. - Information sharing and reporting: - Strong information sharing and reporting practices are fundamental for supervisors to understand and oversee cybersecurity risk management. - Well-defined and enforced incident reporting by firms provides timely, critical information on the threat landscape and firm resilience. - Supervisors can facilitate sharing among firms to enhance collective resilience and coordinate with public sector agencies where necessary. - Data protection requirements should be considered when setting up information-sharing platforms, but should not be used to avoid sharing; sufficiently detailed anonymized data on appropriate platforms is encouraged. *Source: IMF staff (Executive Summary of crsea - Executive Summary).* ### Annex 2 describes one approach to assess the interconnectedness of the financial system network. ### crsea - Annex 2 describes one approach to assess the interconnectedness of the financial system network. ### Approach to mapping interconnectedness - The document illustrates a network-mapping exercise (Figure 2) where: - FIs (supervised entities) are in pink; third-party technology providers (cloud service providers and internet providers) are in green. - The size of the circle on the diagram is proportional to the degree of centrality, the measure of interconnectedness, and the importance of a node to the network. - The stylized scheme shows that important and central nodes (for example, a payment system) can be dependent on a single internet provider, making a technology firm a crucial piece of the system and revealing potential vulnerabilities. - An inset highlights that a node may be smaller than others yet serve as a gateway to small institutions or correspondent relationships that are crucial to a particular sector. ### Key supervisory and regulatory principles for cyber risk - Supervisors should be adaptive to the dynamics of cyber risk; incident reporting should be robust and inform continuous improvement of resilience. - Cybersecurity risk must be incorporated into offsite and onsite processes and into the overall supervisory evaluation of a firm. - Understanding reliance on third-party service providers is a key priority for firms and regulators. - A combination of broad principles, outcome-focused rules, and baseline expectations should form the basis for a robust framework. - Regulations should emphasize “what to achieve” over “how to achieve.” - Requirements and expectations should be abstracted of technology-specific details and primarily state cybersecurity control objectives. - Control objectives improve robustness against future changes in threat vectors, threat actor capabilities, and technologies. - Proportionality: - Smaller and lower-capacity firms should focus on strengthening cyber hygiene. - The largest and most globally connected firms and key system nodes should be subject to heightened standards. - Regulatory consistency across national and international authorities is desirable to promote convergence on minimum standards and coordination and to avoid unnecessary differences. ### Regulatory style and enforceability - A principles-based (rather than prescriptive) approach allows flexibility to react to evolving threats and avoids point-in-time compliance-based treatments that can become outdated. - Regulation must be enforceable and allow supervisory actions where needed. - Cybersecurity requirements should be proportionate to risk; “control coverage” should apply to all supervised firms, while “maturity” reflects depth and sophistication of controls for more complex or systemically important firms. - Cybersecurity regulation should draw on existing internationally accepted technical and regulatory standards without mandating a single standard, to leverage established good practice and invested industry capabilities. - Examples of referenced standards include: the US National Institute of Standards and Technology Cybersecurity Framework, ISO standards (ISO 27000 series, ISO 22301, ISO 31000), and ISACA’s Control Objectives for Information and Related Technology framework. ### Linkages with operational risk, resilience, and business continuity - Cybersecurity regulations should be linked to operational risk management, operational resilience, and business continuity frameworks. - Standards for operational risk management (for example, BCBS Principles for the Sound Management of Operational Risk [BCBS 2011]) form a foundation for cybersecurity supervisory expectations. - Common operational resilience measures (e.g., patch management) also mitigate cyber risk. - Authorities should weigh focused cybersecurity regulations versus comprehensive ICT risk management regulations, but consistency between the two is important. ### Suggested baseline regulatory topics for all supervised firms - Assignment of cybersecurity risk management responsibilities to the board and senior management; documented cybersecurity program/policy and governance - Designation of independent chief information security officer or equivalent - ICT/cybersecurity awareness - Identification of critical information assets, (cyber) threats, and vulnerabilities; assessment of control effectiveness - Identity and access rights management - Software development lifecycle ### International coordination and standard-setting - The G7 Fundamental Elements of Cybersecurity for the Financial Sector can form a regulatory basis; the framework is succinct, easy for nontechnical audiences, and easy to map to detailed regulations and technical guidance. - The G7 Cyber Expert Group (CEG) comprises 23 financial authorities (finance ministries, central banks, and key regulators) across 8 1 jurisdictions and has identified fundamental elements designed to be tailored and proportionate to entities’ characteristics and cyber risks. - Standard-setting bodies (SSBs) including the Basel Committee, CPMI-IOSCO, and IAIS have supplemented operational risk frameworks with cyber-specific guidance (information sharing, incident reporting, etc.). - An FSB stocktake reported that: - All FSB member jurisdictions drew upon previously developed national or international guidance/standards when developing regulatory or supervisory schemes. - About two-thirds of reported regulatory schemes take a targeted approach to cybersecurity and/or ICT risk; one-third address operational risk generally. - Commonly covered elements include risk assessment, regulatory reporting, role of the board, third-party interconnections, system access controls, incident recovery, testing, and training. - 72 percent of jurisdictions reported plans to issue new regulations, guidance, or supervisory practices addressing cybersecurity for the financial sector within the next year. *Source: IMF staff.* ### Box 1. International Standard-Setting Efforts (continued) ### Box 1. International Standard-Setting Efforts (continued) ### Achieving Cyber Resilience - Regulation should emphasize a continuous improvement approach and the pivotal role of risk and control assessment in cybersecurity risk management. - The continuous improvement cycle concept7 is widely used in ICT and cybersecurity risk management systems and hinges on a realistic and comprehensive risk assessment. - Regulation should: - Promote minimum scope, timing, and follow-up requirements. - Remain agnostic on the actual methodology, which should be assessed in the supervisory process. ### Supervisory Assessment - Cybersecurity risk should be assessed as part of the supervisory review process.8 - Cyber risk is an important subcategory of operational risk because of its potential large impact on a firm’s viability. - Cybersecurity risk assessments are often undertaken within the operational risk assessment as part of the ICT risk assessment. - Cybersecurity risk is relevant to assessments of a firm’s governance, strategy, business model, and risks to capital. - ICT systems form the backbone of almost all banking processes and distribution channels, support automated control environments on which core banking data is based, and are key enablers of firms’ strategy. - Supervisory manuals based on cybersecurity regulation need to be developed to: - Set out concrete guidance for consistent assessment of a firm’s ICT or cyber inherent risk and ICT or cyber control maturity. - Cover all relevant topics ensuring sufficient cyber hygiene for all supervised firms. - Explain how residual risk will influence risk-based ICT/cyber supervision and oversight activities. - Dedicated guidance for onsite examiners should set out minimum procedures for collecting evidence, assessing compliance, and reporting. ### Assessing Firm Cyber Risk Profiles and Control Maturity - Supervisors must understand supervised firms’ cyber risk by assessing relevant threats and identifying vulnerabilities; the general threat landscape informs individual firm assessments. - Supervisors should consider all relevant information about a firm’s cybersecurity risk exposure. - Examples of indicators to monitor potential impact from loss of availability, integrity, or confidentiality: - (1) the level of internet dependencies of critical ICT systems, - (2) the complexity of the general ICT system landscape, - (3) the outdated nature of critical ICT systems. - Regulatory expectations should be commensurate with firm size, scale, interconnectedness, and risk profile: - Smaller and lower-capacity firms should focus on strengthening cyber hygiene. - Largest and most globally connected firms and key system nodes should be subject to heightened standards. - Control maturity expectations increase with a firm’s exposure to ICT or cybersecurity risks; baseline controls apply to all firms, with additional measures for higher inherent risk. - Identity management is a key control requirement; implementation can range from simple manual methods for low-risk small firms to sophisticated automated solutions for large high-exposure firms. ### Testing, Criticality, and Residual Risk - Testing implementation of risk control requirements provides supervisors with important insights. - Supervisors should ensure supervised firms have strong risk assessment programs based on understanding IT assets and their criticality (availability, confidentiality, integrity). - Criticality assessments by firms help supervisors prioritize threats, vulnerabilities, and assess control effectiveness. - Supervisors should enforce enterprise-wide cyber risk management and consider business costs of potential attacks. Examples of attack impacts: - A cyber attack disrupting a firm’s connection to trading platforms and making business continuity arrangements ineffective could leave the firm with exposures it cannot manage and that attackers could exploit. - A cyber attack granting access rights could enable initiation and approval of payments and takeover of fraud monitoring systems, leading to large undetected malicious transactions. - A cyber attack encrypting all accounting and customer data, including backups, could lead to a significant loss of revenue and goodwill. - Significant residual risks (where threats can exploit vulnerabilities due to ineffective or missing controls) can trigger supervisory measures. - Supervisors typically expect a control maturity level that exceeds inherent cyber risk level for critical nodes (see Figure 3 concept). - Where control maturity is below supervisory expectations, remediation plans can incentivize fast risk mitigation. - Capital add-ons are not a solution for deficient risk management, but supervisors may incentivize risk mitigation via capital measures. - Inclusion of probable cybersecurity risk–related loss scenarios in firms’ economic capital calculations should inform management decisions on risk management. ### FFIEC Framework and the US Automated Cybersecurity Assessment Tool (Box 2) - A framework developed by the US Federal Financial Institutions Examination Council (FFIEC) covers cyber risk profile and cyber control maturity assessment and can be adopted by supervisors. - The FFIEC assessment: - Helps firms identify risks and determine cybersecurity preparedness. - Provides a repeatable and measurable process to measure preparedness over time. - The Financial Services Sector Coordinating Council for Critical Infrastructure Protection and Homeland Security developed the Automated Cybersecurity Assessment Tool to: - Provide industry members with guidance outline and means to collect and score responses. - Tailor the assessment specifically for the financial sector. - Supervisors considering the tool should adapt it to their jurisdictions because it is calibrated to the size and maturity of the US financial sector. - Once adapted, the tool can be used as a self-assessment collected, analyzed, validated, and acted upon in the supervisory process; supervisors should prioritize validation during onsite examinations. - A recommended approach: sample-based effectiveness testing of declarative statements marked as implemented.11 Process Flow for Institutions (FFIEC Tool steps) - Step 1: Read Overview for Chief Executive Officers (CEO) and Boards of Directors. - Step 2: Read the User’s Guide (Updated May 2017). - Step 3: Complete Part 1: Inherent Risk Profile of the Cybersecurity Assessment Tool (Updated May 2017). - Step 4: Complete Part 2: Cybersecurity Maturity of the Cybersecurity Assessment Tool (Updated May 2017) to determine maturity across five domains: Cyber Risk Management & Oversight; Threat Intelligence & Collaboration; Cybersecurity Controls; External Dependency Management; Cyber Incident Management and Resilience. - Step 5: Interpret and analyze assessment results to determine alignment of inherent risk profile and cybersecurity maturity and whether strategies are needed to reduce inherent risk and improve maturity. ### Third-Party Risk and Outsourcing - Supervisors should be aware of risks associated with using third-party providers as ICT outsourcing has increased. - Supervisors should ensure ICT security requirements—minimum cybersecurity requirements, data life cycle specifications, location of data centers, and data encryption requirements—match supervisory expectations. - Incident handling procedures, including escalation and reporting, should remain effective irrespective of outsourcing or contractual arrangements. - Supervisors should prioritize assessing firms’ third-party risk management in on- and offsite supervision programs. - Approaches and guidance exist from the US Federal Reserve Bank, the European Banking Authority, and Basel Committee observed best practices. - Outsourcing risk management steps include: - Risk assessment landscape: identify service providers and assess qualifications and risks relative to the institution’s strategy and business model. - Due diligence: business background, reputation, strategy, financial performance, operations, internal controls. - Assessment of contract provisions, incentive compensation, and business continuity/contingency plans. - Continuous oversight and monitoring of service providers. - The European Banking Authority’s Guidelines on Outsourcing Arrangements (2018) include additional requirements such as: - Concrete governance requirements, - Proper outsourcing policy, - Assessment of conflicts of interest, - Business continuity plans covering failure of critical service provider, - Internal audit function, - Documentation, - Specific provisions on sub-outsourcing of critical functions, data and system security, access/information/audit rights, and termination rights, - Oversight of outsourced functions. ### Supervisory Capacity and Skills - Authorities need to ensure supervisors have necessary experience and expertise for effective cyber risk supervision. - Adequate technical skills and an appropriate number of resources are needed to assess cyber risk profile and control maturity. - Skills gaps exist in many jurisdictions; filling staffing gaps should be a key concern given cyber threats’ impact on financial stability. - A combination of generalist supervisory skills (operational risk focus) complemented by technical specialists (often from central bank ICT staff) has proven effective.12 ### Information Sharing and Reporting - Effective information sharing and reporting are essential to combat cyber threats. - Domestic sharing of information on threats, emerging technologies, and intelligence should occur among industry participants and between supervisors and critical infrastructure stakeholders (see Figure 4 concept). - Sufficiently detailed anonymized data on appropriate platforms helps timely reaction to cyber threats. - Regulated entities should report incidents and successful attacks to their supervisors. - Trust is essential for effective information sharing and cooperation among supervisors and supervised firms. - Data protection requirements should be considered when setting up information-sharing platforms but should not be used as an excuse for not sharing information. *Source: IMF staff.* ### Box 3. The European Banking Authority and US Federal Reserve Bank’s Approach to ### Box 3. The European Banking Authority and US Federal Reserve Bank’s Approach to Supervising Third-Party Risks ### Information sharing and impediments - Sharing of information among firms is a key element in strengthening resilience of the financial sector against cybersecurity risks. - The G7 Fundamental Elements state: “Given information sharing’s importance, entities and public authorities should identify and address impediments to information sharing.” - Challenges to effective information sharing include: - the need to establish trust; - achieving interoperability and automation; - safeguarding sensitive information; - evaluating the quality of received information; - legal fears of reprisal, with legal risks arising mostly from sharing too much or too broadly and failing to act on information received.13 - Industry-led initiatives have been successful; supervisors could facilitate effective sharing where industry mechanisms are insufficient. - Supervisory mechanisms to address trust and national security concerns include: - cross-border submissions without naming the source (that is, victims of the attack); - sharing an indication of severity without actual loss data; - submissions limited to information relevant to detection and response; - employing an information classification protocol and consistent adherence to it. ### Cyber incident reporting - Mandatory cyber incident reporting is a fundamental need; many leading jurisdictions have enacted regulation to this end. - Reporting requirements should: - establish a threshold ensuring enough information is reported to focus on significant issues while avoiding excessive reporting that obscures significant issues; - use thresholds combining factors such as importance of systems affected (for example, incidents affecting critical systems),14 duration of downtime (for example, incidents causing downtime, the type of incident such as a data breach), and internal risk classification of the incident (for example, medium and high); - specify required timeliness of reporting; - limit the scope of firms required to do ad hoc reporting based on their importance in the financial system. - International convergence on cyber incident reporting should be envisaged.15 - In jurisdictions with multiple supervisory authorities, protocols and platforms should be developed for interauthority information sharing and coordination of reporting requirements to enable sector-wide cyber risk assessments and coordinated countermeasures. ### Role of the supervisor to encourage adequate response and recovery - Supervisors play a key role in ensuring firms are sufficiently prepared to limit damage from cyber incidents and that incident response feeds ongoing resilience improvements. - Emphasis areas for supervised firms: - incident response planning; - business continuity (including robust backup data and systems replicability); - recovery planning with specific consideration of cyber incidents; - ensuring adequate redundancy across information technology platforms and locations; - procuring cybersecurity liability insurance could help mitigate potential financial losses.16 - Supervisory priorities regarding response include: - based on threat analysis, ensure supervised firms are prepared for probable disruption events originated by cyber attacks; - analyze potential impacts; - ensure that bank’s recovery time objectives (RTO)17 and recovery point objectives (RPO)18 are in line with needs for financial stability objectives; - require one or more fallback data centers at remote sites, at least for critical activities, services, and resources; - require one or more recovery copies of the critical production data at remote sites; - require business continuity and disaster recovery tests, including simulation exercises. ### Testing, simulations, and supervisory expectations - Penetration testing and red-team testing: - Simulated cyber attacks (penetration tests) have been used by firms for many years; supervisors have only recently included them in the supervisory toolkit. - Penetration tests using extreme but plausible scenarios—involving multiple firms, financial regulators, and other authorities—are a key tool in enhancing resilience and assessing detection, response, and remediation capabilities. - Penetration testing required by supervisors is intended to complement and not substitute private tests organized by firms. - Balance cost and benefit: - Penetration tests can be expensive when scope is broad and advanced techniques (such as social engineering or reverse engineering) are required; smaller firms may face affordability issues. - Recommended approach: require penetration testing at regular intervals for high-risk and/or internet-facing applications and application programming interfaces (for example, internet banking and mobile banking). - Alternatives or complements: vulnerability scanning or simplified approaches to penetration testing. - Vulnerability scanning: - Is a cost-effective way to provide assurance over network vulnerabilities; can be automated and relatively inexpensive. - Downsides: discovered vulnerabilities are not validated for exploitability; false-positives can overburden security teams. - Supervisory role in testing: - Generally, supervisors should not be directly involved in executing penetration tests or vulnerability scans; they should set clear expectations and review results. - Recommended supervisory actions: - review the scope of the test and, if engaged, vet third-party service providers; - review the parameters of the test to ensure comprehensiveness and alignment with the risk profile of the system and institution; - review test results, mitigation strategy, and follow up on closure of gaps identified. - Industrywide crisis management exercises: - Supervisors can mandate, coordinate, and monitor industrywide cyber crisis management exercises starting with tabletop exercises involving systemically important firms to test reaction, recovery, and crisis communication protocols. - Other national agencies could participate (national cyber intelligence unit, national computer emergency response team, cyber crime units). ### Business continuity, recovery objectives, and scenario analysis - Business continuity management: - Firms need robust business continuity management to minimize impacts from operational disruptions and resume critical functions rapidly, safely, and with accurate data (CPMI/IOSCO 2016, 16–19). - Firms should be required to review and test (at least annually) business continuity plans and report results to the supervisor; supervisors should assess reports at firm-specific and consolidated system levels. - Supervisors should maintain an up-to-date view of financial and technology networks to inform analysis of business continuity plans and prioritize most systemically important firms, markets, and products. - Scenario analysis and mapping: - Scenario analysis can help institutions understand potential risks, transmission channels, investment priorities, and response strategies. - Aggregate cyber and financial network mapping enriches exercises to identify areas requiring additional response and recovery measures due to systemic importance, dependencies, and concentrations. - Recovery time and point objectives: - RTO and RPO should be based on comprehensive business impact analysis and risk assessment; business impact analysis should: - identify critical processes; - assess consequences over time of not conducting these activities; - identify interdependencies and critical service providers; - set priorities/timeframes to resume critical processes. - Caution: setting too rigid or strict RTOs and RPOs can be counterproductive because forensic analysis might not be completed and recovery could be based on compromised data or components; example: financial market infrastructures might need to recover from an incident in two hours as proposed by CPMI/IOSCO (2016). ### Preparedness of supervisory agencies and crisis management - Crisis preparedness responsibilities: - Authorities’ ability to respond to cyber incidents that impact financial stability depends on a comprehensive set of tools and powers, adequate resources, efficient procedures, and strong legal and institutional foundations. - Authorities should continually evaluate and update crisis plans to reflect threat landscape changes and the changing nature of firms and markets. - Regular exercises across the sector, including public and private entities, are useful to ensure plans produce desired results. - Crisis management framework requirements: - Different authorities responsible for critical financial nodes must plan and work together; orderly management of significant outages or institutional failures depends on inter-authority communication, access to data systems, and access to payments and clearing infrastructure. - Lines of reporting and succession for strategic functions must be clearly established; crisis management must not depend on specific staff. - A crisis communication preparedness plan should define the scope of communication in critical scenarios, alternative means, and strategies for internal and public communication and for reaching agreements among authorities. - Data loss considerations: - Loss of ICT infrastructure and/or data integrity adds complexity; crisis planning must consider potential lack of data. - Loss of access to data may require temporary forbearance; inability to fulfill contractual obligations due to ICT damage should not automatically prompt resolution if the firm’s recovery plan has not been demonstrated ineffective. - Central banks and supervisors will need to consider approaches to temporary liquidity when firm financial condition is difficult to ascertain because of data loss. ### Supervisory framework and global considerations - Cybersecurity risk is a critical issue requiring enhanced supervision building on existing ICT and operational risk approaches. - Key principles: - Transfer of knowledge across the community of supervisors, especially lower-income and lower-capacity supervisors, will help raise resilience globally. - Regulations should leverage established approaches, including industry-developed standards, to help convergence. - Smaller- and lower-capacity firms should focus on strengthening cyber hygiene; the largest and most globally connected firms and key system nodes should face heightened standards. - Supervisory frameworks must grant supervisors sufficient authority to address cybersecurity risk and allow adaptability to dynamics of the risk. - The supervision framework should include mapping of the financial system, its key technologies, and interconnectedness between them; industry standards and firms’ own risk assessments should underpin supervisory programs. - Robust incident reporting should inform continuous improvement of resilience. - Note: Over the past two years, regulators around the world have issued over 30 new cyber rules.1 *Source: Box 3 text from the provided IMF content unit.* ### Conclusion ### Conclusion ### Third-party reliance and supervisory capacity - Understanding the risk of reliance on third-party service providers should be a key priority for firms and regulators. - It will be imperative to overcome chronic skills shortages for this work, especially in developing and emerging economy countries. - Capacity building approaches suggested: - acquire specialists, - train generalist supervisors, - leverage internal resources. - Capacity building should be expected to be a steady and continuous process. ### Recovery planning and simulation exercises - Cyber attacks have become an inevitable feature of daily life for supervised firms, and eliminating attacks and losses is unrealistic. - Emphasis needed on recovery planning for cyber events: - Simulation exercises should focus on the ability of supervised firms to recover from—and limit the extent of—attacks. - Ensure governance structures and decision-making are adequately responsive. - Industrywide cyber crisis management exercises should be encouraged. - Scenario analysis can help firms understand potential risks, transmission channels, investment priorities, and response options when systems are breached. ### Information sharing and public/private collaboration - Increased domestic and international information sharing will improve understanding of the threat landscape and help firms and supervisors improve resilience. - Information sharing relies on development of trust between counterparts and on a common taxonomy. - Policymakers should facilitate sharing of good practices across the supervisory community to raise standards and risk management. - Public/private collaboration, extending beyond traditional regulatory boundaries to include all relevant financial sector agents, should be strongly encouraged. ### Cyber risk insurance (Annex 1) - Cyber risk insurance can add a useful layer of protection for residual risks and provide incentives to improve risk management, but it is no substitute for effective cyber risk mitigation. - Challenges to insurability of cyber risk: - For a risk to be insurable, the probability and cost of losses must be able to be estimated within a tolerable range of error, the maximum loss must be specified, claims for losses must be measurable, and the process of underwriting should be economically viable compared to premiums charged and possible losses. All these aspects are challenged by cyber risk. - Value-add from insurance: - Underwriting assessments can identify improvements in applicants’ cyber risk management practices. - Insurers may assist clients in improved risk management and risk mitigation techniques and reflect improvements through reduced premiums. - Insurers may refuse coverage if industry standards are not implemented by businesses. - Emerging trend in the United States: insurers engaging external cybersecurity organizations to assist with quantifying risk and for postevent response. - Insurance sector exposures: - Insurers maintain personal data and interconnections with the financial and technology sectors, invest across financial markets, use common technology (software and cloud), and outsource activities—exposing them to cybersecurity issues at service providers. - Regulatory heterogeneity: - Regulatory frameworks for insurers are diverse around the world; supervision prioritization and sophistication vary across jurisdictions, posing potential regulatory arbitrage risks. - Data availability and legal disclosure: - Approximately 90 percent of the world’s cyber insurance market is in the United States, and one of the drivers is said to be the data protection legislation in most states of the United States. - It is expected that the European Union’s General Data Protection Regulation, which came into effect in May 2018, will lead to greater development of the cyber insurance market in the European Union. - Legal requirements for companies to disclose cybersecurity incidents will enhance data availability and increase focus on managing and mitigating cybersecurity risks through insurance. - Government-run insurance pools: - Potential benefits: increased market capacity, harmonization of coverage, sharing of information about threats and incidents, facilitating transfer of cyber risk to reinsurance and capital markets. - Drawbacks: limitations on market competition and innovation, and limited pricing differentiation based on risk. ### Cyber risk modeling (Box 4, Annex 1) - Cyber risk modeling needs to develop to aid pricing through premiums and to model insurer exposure through stand-alone cyber policies and silent cyber in other commercial lines. - Three broad issues making modeling particularly challenging: - Available historical data is incomplete and scarce, and it covers only a short period. - Cyber threats are evolving so past incidents may not be indicative of future incidents. - Cyber threats are often borderless, meaning risk accumulation is difficult to predict and potentially reduces the benefits of risk pooling. - Industry developments improving modeling and data: - In March 2018, RMS launched a probabilistic cyber risk model estimating losses at different return periods for five loss categories: data exfiltration, contagious malware, financial theft, cloud outages, and denial of service attacks. - AIR Worldwide has set out a detailed accumulation methodology and, in collaboration with Lloyd’s, used it in analyzing the impact of outages of cloud computing service providers and impacts on the US economy and insurers. - Lloyd’s, AIR Worldwide, and RMS collaborated to develop standard definitions for some common data pertaining to cyber risk insurance. ### Cyber mapping (Annex 2) - Purpose and concept: - Cyber mapping assesses cyber risk concentrations by analyzing interdependencies between financial sector firms and information and communication technology (ICT) providers, integrating financial and cyber networks to identify concentrations and contagion pathways. - Benefits: - Deepens supervisors’ understanding of ICT at firm and systemwide levels. - Informs operational risk analysis (business continuity and disaster recovery) and identifies systemwide risk concentrations not visible from financial exposures alone. - Planning questions: - What should go on the map (scope)? - What network model and underlying data model to use? - How to collect relevant data? - Practical constraints and scope recommendations: - Building detailed maps can be expensive and time-consuming; supervisors should apply constraints to limit effort while preserving useful granularity. - Maps could include important firms of the financial sector, critical ICT systems, and top ICT third parties (for example, practical limit: ICT third parties in the top five at any mapped financial sector firm). - Better suited models for supervisory purposes include a lower number of entity types and discrete empirical attribute scales. - Beneficial to define several map layers: data flow, organizational dependencies, and technological dependencies. - Data collection and weighting: - Weights can be derived from market shares, transaction volumes, or synthetic metrics. - Key technological and organizational dependencies and connection time criticalities should be available at firms in scope (risk assessments, regulatory reports on outsourcing, configuration management databases). - The main steps of the mapping are as follows: - Preparation: finalize scoping criteria, entity attribute sets, connection attributes, value sets; define and create a database. - Data collection: create list of entities per scoping criteria; collect data per entity (market share, main service providers and their relative importance, data flows, critical IT systems, supporting technologies). - Finding interconnections: create list of connections between entities. - Classification: map continuous data to discrete attribute values; assign attribute values to each entity and connection. - Database load: load entities, connections, and attribute values into the database for each layer. - Visualization: programmatically visualize the three layers of the cyber map. - Analysis: identify risk concentrations with network analysis tools. - Implementation notes: - Final outputs may vary significantly by country due to heterogeneity of financial structures and nonfinancial infrastructure; frameworks should be flexible to country and financial sector specificity. - Tools referenced: Gephi for stylized visualizations; other options include R and Tableau; Access is adequate for a supporting database. - Stylized three-step illustration: - Step 1: Collect data to develop an inventory of systemically important participants in the financial system and their ICT networks. - Step 2: Map connections between the participants. - Step 3: Add additional analysis (for example, use degree of centrality to estimate node size and weight of data flow to show volume between nodes). *Source: Conclusion, crsea - Conclusion.* --- _Source: https://www.imf.org/-/media/files/publications/dp/2019/english/crsea.pdf_