## gpcrrsea

## Source details

**Canonical URL:** [gpcrrsea](https://www.imf.org/-/media/files/publications/dp/2026/english/gpcrrsea.pdf)

## Other formats

- [Markdown version](/-/media/files/publications/dp/2026/english/gpcrrsea.pdf.md)
- [Structured JSON version](/-/media/files/publications/dp/2026/english/gpcrrsea.pdf.json)

---

### Executive Summary — Importance, Evolution, and Regulatory Implications
- Importance of cyber risk in the financial sector:
  - Financial institutions (FIs) and financial market infrastructures (FMIs) handle sensitive, high-volume, high-value data and are prime targets as digital financial services expand.
  - Critical infrastructure (payments, clearing, settlement) can be targeted for disruption; a systemic cyber incident could incapacitate a systemic FMI and harm financial stability and the macroeconomy.
  - Breaches of data (bank account details, credit card information, customer identification, transaction histories) can lead to identity theft, financial loss, and reputational damage.
- Recent evolution of the threat landscape:
  - Cyberattacks have become stronger, more frequent, and more sophisticated; since 2020 incidents grew markedly.
  - The number of cyberattacks in a single year has almost doubled compared with 2019, with losses increasing by more than 25 percent, and an extraordinary spike of approximately 500 percent more in 2020 compared with 2019.
- Regulatory implications and opportunities:
  - Integrate ICT and cyber-risk-management regulation into one coherent technology-risk-management regulatory framework where feasible.
  - High-impact expectations: cybersecurity testing, crisis exercises, third-party risk management.
  - Cybersecurity testing: value realized through practical application; baseline regulatory expectations have been absent, limiting supervisory utility.
  - Cyber crisis exercises coordinated by supervisors are essential for systemic preparedness.
  - Major challenge: oversight of critical third-party technology providers.

### Supervisory approach and two overarching attributes of effective regulation
- Supervisory presence and thoroughness (frequent contact, analysis, feedback, follow-up) is the most consequential factor in improving cybersecurity stance.
- Two overarching regulatory/supervisory attributes:
  - Balance principles-based and prescriptive elements; regulation should focus on outcomes and be technology agnostic; supervision should rely on professional judgment.
  - Proportionality: one size does not fit all—systemically important and complex FIs/FMIs face highest standards; smaller, less sophisticated FIs have adapted expectations.

### Key conceptual clarifications (definitions per FSB Cyber Lexicon)
- Cyber: relating to, within, or through the medium of the interconnected information infrastructure of interactions among persons, processes, data, and information systems.
- Cybersecurity: preservation of confidentiality, integrity, and availability of information or information systems through the cyber medium; may also involve authenticity, accountability, nonrepudiation, and reliability.
- Cyber incident: an event that jeopardizes cybersecurity, violates security policies, or impacts daily operations; jeopardizing is sufficient; incidents need not be malicious.
- Cyber risk: combination of probability of cyber incidents and their impact; separating ICT risk from cyber risk in regulation can create overlaps and inconsistencies.

*Source: Executive Summary, Good Practices in Cyber Risk Regulation and Supervision (IMF Departmental Papers).*

### Cyber Incidents — Scale, Drivers, and IMF Work
- Key statistics and trends:
  - Approximately 20 percent of all reported cyber incidents during the past two decades have affected the financial sector.
  - Total direct losses from reported cyber incidents impacting the financial sector from 2020 to 2023 stood at $2.5 billion (IMF 2024c).
  - Cyber incidents are under-reported; indirect losses exceed direct losses by several multiples.
  - Over the past four years, the IMF has delivered 108 TA missions to emerging markets and developing economies on cyber risk topics.
- Drivers of increasing cyber risk:
  - Technical: increasing dependency on ICT; faster system development cycles with less testing—major source of vulnerabilities.
  - Technological/geopolitical: rise of AI-augmented capabilities (deepfakes, attack automation); attacks on critical infrastructure linked to geopolitical tensions and insider threats; AI and quantum computing can amplify risks (AI for offensive operations; quantum computing potentially breaking classic cryptography).
- Why cyber risk matters for financial stability:
  - Transmission channels: loss of confidence (deposit outflows, loss of funding), lack of substitutes for critical services (halted FMIs), interconnectedness (shared software, interbank exposures).
  - Possible consequences: decline in domestic credit provision; disruption to payment services (for example, remittances); compromised data integrity/confidentiality; trading halts and asset price volatility; liquidity and default risk; macro-financial spillovers.
- IMF engagement:
  - FSAP piloted cyber risk assessment in 2019; in-depth FSAP coverage targets advanced and larger emerging markets.
  - IMF TA aims at legal/regulatory alignment with international standards, developing supervisory frameworks, incident reporting, supervisory capacity building, and more.
  - Cyber Risk Supervisory Toolbox (eight elements): model regulation; user guides; assessment methodology and tools; supervisory processes; examination guide; pre-examination document request.

### FSAP pillars relevant to cyber risk and challenges
- Pillar 1: Macrofinancial Vulnerabilities/Risk Analysis — cyber strategy, mapping, resilience stress testing.
- Pillar 2: Policy Framework, Oversight, Governance — threat landscape, cyber strategies, institutional/legal framework, regulations on cyber/ICT/operational resilience/third-party risks/cloud, supervisory approach.
- Pillar 3: Safety Net, Crisis Management/Resolution — crisis management, ICT/cyber arrangements conducive to resolution, preparedness of central bank and supervisors.
- Practical FSAP challenges: dearth of reliable data; variation in incident reporting arrangements; unpredictability of threats complicates quantification/valuation.

### IMF TA topics and typical outputs
- Common TA topics: cyber strategy development; cyber/ICT/business continuity/operational resilience/third-party/cloud regulations; incident reporting frameworks; information-sharing networks; cyber simulations/exercises; central bank cybersecurity reviews; supervisory frameworks; testing frameworks; capacity building.
- Typical deliverables: mission reports with findings/next steps; regulatory reviews; supervisory manuals; assistance with onsite inspections; cyber risk simulations/exercises.
- Policy implications for emerging markets and developing economies:
  - Many countries lack supervisory capacity despite improved regulations.
  - Most jurisdictions lack incident reporting frameworks and information-sharing networks; most have not conducted cyber risk simulation exercises.
  - Building cyber resilience is long-term and requires strategy, regulation, supervision, incident reporting, exercises, and information sharing.

### Good Regulatory Practices — Development, Structure, and Key Expectations
- Objective/scope: safeguard confidentiality, integrity, availability of information/systems; cover cyberattacks, technology/process failures, human error, natural/man-made disasters.
- Regulation development process: Initiation → Analyze and plan → Design → Develop → Consult → Implement.
  - “Analyze and plan” considerations: regulatory goals, alternatives, gap identification, costs, deadlines, burdens.
  - “Consult” phase: secure buy-in to avoid overlap/inconsistency/over-stringency.
- Success factors:
  - Unified regulation covering all technology risk areas; outcome-driven, technology-agnostic, risk-and-control taxonomy; tiered approach per proportionality.
- Principles-based vs prescriptive:
  - Principles-based: future-proof, shorter, needs shared understanding; suited to mature systems.
  - Prescriptive: reduces uncertainty, useful for less developed systems; can limit supervisory judgment and be hard to maintain.
  - Balance on a continuum; primarily principles-based often preferred.
- Key expectations that facilitate mitigation (selected):
  - Governance and internal controls: board responsibilities; policies/standards; information asset management; security awareness; dedicated cybersecurity budgets; internal audit capabilities.
  - Technology and cyber risk management: risk-management framework; risk assessment and treatment; monitoring and reporting; project management and SDLC requirements.
  - ICT service management: asset/configuration management, patch management, change management, DC security, physical/environmental controls.
  - Cybersecurity operations: threat intelligence; SOC/monitoring; incident response/management/reporting to supervisors within prescribed criteria/timeframes.
  - Response and recovery: business continuity management, recovery objectives, backups (redundant copies, immutable backups), test restorations.
  - Vulnerability scanning, penetration testing, exercises: regular scanning; external-facing services penetration tested at least annually and after significant changes; remediation tracking.
  - Independent assurance: independent ICT/cyber audits aligned with risk profile.
  - Outsourcing/TSP management: FIs remain fully accountable; risk assessments/due diligence; supervisors’ audit rights over TSPs.

### Good Supervision Practices — Processes, Governance, Staffing, and Capacity
- Core supervisory processes: regulation/guidance development, offsite supervision, onsite examination, monitoring of cybersecurity testing; proportionate priority to systemic importance.
- Supervisory expectations for FIs include ICT/cyber strategies, governance, identification of critical operations, response/recovery capabilities, business continuity exercises, incident data collection for board and supervisors, third-party risk management, change management processes.
- Supervisory governance good practices: board-set agenda; combine on/offsite arrangements; adequate resourcing; clear responsibilities; integrate cyber risk assessments enterprise-wide; use full range of onsite techniques; use technology to monitor; conduct stress tests; collect supervisory data (KRIs, third-party registers, dashboards).
- Staffing and resourcing:
  - Resource scarcity common; resourcing models vary (specialized ICT/cyber units in advanced economies; audit-background examiners and cross-domain expertise in others).
  - Recommendation: build ICT/cyber capabilities within supervision departments; allocate at least two resources to ICT/cyber risk assessment even in smaller jurisdictions.
  - Background checks for supervisors due to access to sensitive information; upskilling and retention are challenges.
- Learning and development:
  - Two approaches: train general supervisors in technical skills or recruit technical staff and train them in supervision.
  - Onboarding programs and rotation across functions recommended; maintain academic qualifications and professional certifications.
- Survey findings on capacity development:
  - Jurisdictions rely heavily on free webinars/online courses; certification training and academic programs are also used.
  - About two-thirds mandate an academic degree in IT for cyber risk supervisors.
  - Some authorities require certifications at senior and all levels, though about 20 percent do not mandate certifications.
  - Capacity development planning: 17 percent had a plan focused on cyber risk supervisors; 38 percent had a general plan for all supervisors but not cyber-specific; 45 percent addressed capacity development without a plan.

### Cybersecurity Training Options — Uptake and Formats
- Training uptake exact figures:
  - 40.5% — Academic programs (for example, undergraduate, graduate, or postgraduate) subsidized by the authority
  - 60.8% — Certification training and exams (for example, CISA, CISSP, and so on) subsidized by the authority
  - 97.3% — Free webinars and online courses
- Capacity development formats: workshops with stakeholders; interviews, speeches, publications; public-private partnerships; academic cooperation.
- Proportionality application examples:
  - Penetration testing: baseline expectation for all; best practice for larger/systemic FIs is annual independent penetration testing; less systemic FIs may adjust frequency/scope.
  - CISO function: expectation of senior oversight role; adapt for smaller FIs or scarce talent pools.
  - IAM: baseline controls for all; small institutions may use manual/Active Directory; complex institutions expected to deploy dedicated IAM systems.
- Challenges in proportionality: defining tiering criteria, maintaining a level playing field, avoiding regulatory arbitrage, implementation resource impacts, interconnectedness.

### Offsite and Onsite Supervision — Practices and Procedures
- Offsite supervision:
  - Continuous monitoring via key cybersecurity metrics, threat intelligence, standardized reporting.
  - Good practices: leverage SupTech, secure platforms, annual offsite plan, predefined minimum reporting tied to technology stack and cyber risk tolerance.
  - Routine reporting examples: number of incidents/breaches; availability metrics; ICT operations metrics.
  - Ad hoc incident reporting: secure channels, 24/7 monitoring aligned to platforms, follow-up until resolution, analytics and escalation mechanisms.
  - Analysis: comprehensive annual assessment plus ongoing assessment; use key risk indicators and cyber mapping; produce risk assessments and horizontal reports; require notification/permission for material changes (outsourcing, offshoring).
- Onsite supervision:
  - Onsite examinations provide stronger assurance on tangible infrastructure quality; phases include planning, information gathering, execution, reporting, follow-up.
  - Good planning practices: front-load review, regular cycle (typically annual), project and interview plans, team independence, team composition with at least two experts, legal counsel availability.
  - Execution: evidence-based testing, professional skepticism, sample testing, meetings with three lines of defense, exit meetings for preliminary observations.
  - Reporting and follow-up: rank findings as Requirements / Recommendations / Suggestions; require approved action plans with deadlines and responsible stakeholders; verify remediation via reports/visits/audits; escalate overdue high-risk items.

### Box 1 — APRA CPS 234 (selected lessons)
- On July 1, 2019, APRA released CPS 234 Information Security, enforcing obligations on boards for information security, comprehensive security testing, and response plans.
- CPS 234 Tripartite independent assessments (2020–24 cyber strategy) required independent auditors to assess compliance; results drove improvements.
- Key Tripartite findings: incomplete asset classification; limited third-party security assessment; inadequate control testing; incident response plans not regularly tested; limited internal audit review; inconsistent incident reporting to APRA.
- Post-review lessons: enhance prevention/detection/response, test preparedness, disseminate lessons across supervisors.

### Cyber Simulation Exercises — Purpose, Benefits, and Good Practices
- Purpose: understand interdependencies, test response and recovery, improve preparedness across FIs and third parties.
- Key benefits:
  - Improved incident response (faster decisions; better coordination).
  - Identify security gaps (infrastructure, policies, procedures).
  - Enhance preparedness and training for technical and non-technical roles.
  - Better risk management and cost-effective testing.
  - Strengthen communication and cross-departmental collaboration.
  - Reinforce cyber hygiene and awareness.
  - Meet regulatory requirements and drive continuous improvement.
  - Boost organizational and stakeholder confidence.
  - Adapt to new threats and simulate sophisticated attacks (for example, APTs).
- Exercise types and program design:
  - Phishing exercises; tabletop exercises; live tests (penetration tests, cyber ranges, adversarial attacks); executive-level crisis exercises; sector-wide exercises.
  - Authorities should drive sector exercises; adopt cyclical program approach building complexity over time.
- Program management components:
  - Stakeholder engagement: program-level and exercise-specific stakeholders; joint committee oversight; appoint a senior lead owner.
  - Multiyear preparedness priorities: incorporate lessons learned; risk-based planning aligned to multiyear priorities; account for budget/resource constraints.
  - Improvement planning: After-Action Report (AAR) linking gaps to measurable corrective actions with responsible parties and target dates.
- Conducting an individual exercise:
  - Structured workflow: planning team → initial planning → concept/objectives → invitations → mid-term planning → conduct → draft AAR/improvement plan → after-action meeting.
  - Design: clear objectives/assessment criteria tied to risk assessments; include multidisciplinary participants; tailor scenario complexity; preserve realism by not fixing identified gaps mid-exercise.
  - Logistics: secure location/technology; label simulation communications; minimize operational disruption; allow exit for real events.
- Assessment:
  - Compare results against objectives; conduct hotwash; assess correct identification, alignment with policies, effectiveness of responses, and awareness of roles.
  - Use assessment outcomes to form improvement plans and strengthen preparedness.
- Conclusion:
  - Simulation exercises are effective tools to raise sector awareness, improve resilience, and catalyze initiatives on governance, communication, incident reporting, information sharing, and response/recovery.

### Oversight and FMIs — Focus Areas and Recommendations
- Supervision versus oversight distinction:
  - Supervision: safety and soundness of individual FIs and conduct safeguards.
  - Oversight: safety and efficiency of financial systems with emphasis on interconnections; activities include monitoring, assessment, and inducing change.
- FMI cyber resilience importance: FMIs can be both sources and channels of financial shocks; cyber resilience is decisive for overall system resilience.
- Standards applied: CPMI-IOSCO Guidance on Cyber Resilience of FMIs and PFMI principles (Principles 2, 3, 8, 17, 20); Annex F for critical service providers.
- Key recommendations to strengthen FMI cyber resilience (selected):
  - Governance: develop cyber strategies, ensure oversight independence, board training and skills.
  - Identification: maintain database of third-party service providers; analyze concentration risk.
  - Protection: document comprehensive attack surface.
  - Detection: enhance 24/7 SOC coverage.
  - Response/recovery: upgrade business continuity plans with extreme-but-plausible cyber scenarios and regular testing.
  - Testing: expedite penetration testing, conduct cyber stress tests, test with participants and FMI links.
  - Situational awareness: establish formal information-sharing arrangements among financial authorities, cybersecurity agencies, and FMI participants.
  - Learning: develop cyber resilience metrics and benchmarking (for example, recovery time objectives).
- Authority responsibilities and recommendations (selected):
  - Strengthen oversight and supervision of FMIs; supplement CPMI-IOSCO guidance with detailed expectations; increase offsite and onsite supervision.
  - Increase skills and expertise among overseers; develop regulatory requirements for FMIs based on Cyber Guidance.
  - Enhance cooperation among authorities for commonly supervised FMIs.

### Conclusions and Supervisory Priorities
- IMF cyber risk work program (since 2017) supports members in strengthening operational and cyber resilience through FSAP assessments and TA on strategies, regulations, incident reporting, testing, simulations, central bank reviews, and capacity building.
- Effective regulatory frameworks are tiered: enforceable mandatory requirements plus non-enforceable guidance reflecting desired outcomes.
- Deliberate regulation development should yield:
  - (1) unified regulation encompassing all technology risk areas;
  - (2) outcome-driven and technology-agnostic expectations;
  - (3) proportionality application; and
  - (4) balance between principles-based and prescriptive approaches.
- Supervisory presence and thoroughness are pivotal—practical supervision can compensate for regulatory weaknesses.
- Focus improvement efforts on practices: skills, people, and processes.
- Immediate implementation priorities, assuming basic elements are covered:
  - Cybersecurity testing (with supervisors in oversight role, not running the tests themselves; consider TLPT proportionally).
  - Crisis simulation exercises (authorities should actively promote/drive sector participation; initial expectations need not be mandatory but trend toward requiring participation for systemic entities).
  - Third-party risk management (bring critical providers under a cyber risk oversight framework).
- Data collection guidance: avoid requiring full technical details of vulnerabilities and exploits; focus on adherence to testing frameworks, risk management of the process, remediation, and follow-up.

*Source: IMF Departmental Papers content provided in the source PDF.*

### Executive Summary.................................................................................................v

### Executive Summary

### Importance of Cyber Risk in the Financial Sector
- Cyber risk is a critical concern because of the sensitivity, volume, and value of the data handled by financial institutions (FIs) and financial market infrastructures (FMIs).
- The financial sector is a prime target of cybercriminals due to the significant growth and still rising prominence of digital financial services and online transactions.
- Critical infrastructure, such as payments, clearing, and settlement, can be targeted by adversaries seeking disruption.
- A systemic cyber incident—for example, a cyberattack that incapacitates a systemic FMI—may adversely impact financial stability and exert negative spillovers on the macroeconomy.
- FIs and FMIs manage vast amounts of personal and financial data, including bank account details, credit card information, customer identification, transaction histories, and other sensitive information; breaches can lead to identity theft, financial loss, and reputational damage.

### Recent Evolution of the Threat Landscape
- Over time, cyberattacks have become stronger, more frequent, and ever more sophisticated.
- Cyber incidents have become much more frequent and more costly in recent times, especially since 2020.
- The number of cyberattacks during a single year has almost doubled compared with 2019, with losses increasing by more than 25 percent, with an extraordinary spike of approximately 500 percent more in 2020 compared with 2019.

### Regulatory Implications and Opportunities for Improvement
- Strengthening cybersecurity expectations and enforcement is the way forward given the continuous strengthening of cyber threat actors and the ever more critical and complex ICT that the financial system depends on.
- A key opportunity for improvement is in the way regulators understand and reflect the interrelationship between ICT and cyber risk in their expectations.
  - Integrate ICT and cyber-risk-management regulation, separated thus far, into one coherent technology-risk-management regulatory framework where feasible.
  - Integration may pose greater operational challenges in countries with multiple and partially overlapping existing regulations.
- Specific expectations with high impact:
  - Cybersecurity testing
  - Crisis exercises
  - Third-party risk management
- Cybersecurity testing:
  - The true value is evident only through practical application; it is imprudent to consider a system, process, or facility secure unless it has been tested for possible intrusion.
  - Industry use of cybersecurity testing has varied in approach and quality due to the absence of baseline regulatory expectations, limiting its supervisory utility.
  - Major jurisdictions recently formalizing and mandating cybersecurity testing are making it a key tool to strengthen national financial system cyber resilience.
- Cyber crisis exercises coordinated and overseen by supervisory authorities are becoming essential to preparing for systemic cyber risk events.
- Next major challenge: respond to risks posed by extraordinary growth and reliance on third-party technology services by bringing critical providers under a cyber risk oversight framework.

### Supervisory Approach and Effectiveness
- The presence and thoroughness of the supervisor is probably the most consequential factor in improving cybersecurity stance.
  - Frequent and inquisitive contact with FIs and FMIs, thorough analyses, strong feedback, and diligent follow-up on identified issues are fundamental—whether through offsite or onsite supervision, industry outreach, or consultations.
- Supervisory tools to be clarified and used proactively to address emerging priorities without increasing complexity.

### Two Overarching Attributes of Effective Regulation and Supervision
- Balanced approach blending principles-based and prescriptive elements, matching cyber-risk-management maturity within the financial system:
  - Regulation: focus on desired outcomes and technology agnosticism to provide flexibility in how FIs and FMIs meet expectations.
  - Supervision: greater reliance on professional judgment (more important in ICT and cyber risk than in many other risk disciplines).
- Proportionality:
  - One size does not fit all for regulation or supervision.
  - Systemically important and complex FIs and FMIs should face the highest standards across all dimensions.
  - Smaller, less sophisticated, non-systemic FIs should have supervisory expectations adapted to their risk profiles.
  - Note: in an interconnected chain, security is as strong as its weakest link.

### Key Conceptual Clarifications
- Definitions follow the Financial Stability Board’s (FSB) Cyber Lexicon (FSB 2023).
- Cyber: relating to, within, or through the medium of the interconnected information infrastructure of interactions among persons, processes, data, and information systems—encompasses people and processes as well as ICT.
- Cybersecurity: the preservation of confidentiality, integrity, and availability of information or of information systems through the cyber medium; may also involve authenticity, accountability, nonrepudiation, and reliability.
- Cyber incident: an event in the cyber domain that either (1) jeopardizes the cybersecurity of an information system or the information the system processes, stores, or transmits; (2) violates security policies, procedures, or acceptable use policies, whether resulting from malicious activity or not; or (3) impacts any daily or normal operations of an organization’s IT infrastructure.
  - Jeopardizing is sufficient; incidents need not breach cybersecurity to be considered cyber incidents.
  - Incidents may occur irrespective of intent (including user error or technology failure).
- Cyber risk: the combination of the probability of cyber incidents occurring and their impact.
  - Some jurisdictions distinguish ICT risk (nonmalicious actions or technology failures) from narrowly defined cyber risk (malicious activity), but splitting risks in regulation can create overlaps and inconsistencies because many controls are shared and effective on both fronts.

*Source: Executive Summary, Good Practices in Cyber Risk Regulation and Supervision (IMF Departmental Papers).*

### 1. Cyber Incidents2. Total Loss Amounts and Affected Records

### 1. Cyber Incidents2. Total Loss Amounts and Affected Records

### Key statistics and trends
- Approximately 20 percent of all reported cyber incidents during the past two decades have affected the financial sector.
- Total direct losses from reported cyber incidents impacting the financial sector from 2020 to 2023 stood at $2.5 billion (IMF 2024c).
- Cyber incidents are generally under-reported, and indirect losses exceed direct losses by several multiples; hence, total losses in the sector are very likely to be much higher than the reported amount.
- Over the past four years, the IMF has delivered 108 TA missions to emerging markets and developing economies on cyber risk topics.

### Drivers of increasing cyber risk
- Technical factors:
  - Increasing dependency on ICT.
  - Faster financial innovation with faster system development cycles and less time spent on testing and fixing software bugs—a major source of security vulnerabilities.
- Technological and geopolitical/economic drivers:
  - Rise of AI-augmented capabilities enabling next-generation phishing (deepfakes) and advanced attack automation (IMF 2024a).
  - Attacks on critical infrastructure largely attributable to rising geopolitical tensions and increased insider threats because of economic uncertainty.
  - Progress in AI and quantum computing development can amplify cyber risks (AI used for offensive operations; quantum computing has the potential to break classic cryptography).

### Why cyber risk is important for financial stability
- Cyber risk is a material risk for the financial services sector because of:
  - Financial sector reliance on ICT and interconnectedness of the financial system.
  - Potential for large-scale incidents at key FIs and FMIs to disrupt continuity of financial services and trust in the sector.
- Main transmission channels of cyber incidents to the financial system:
  - Loss of confidence (e.g., deposit outflows—cyber runs; loss of access to funding).
  - Lack of substitutes for critical services (e.g., halted FMIs like real-time gross settlement systems, clearinghouses, or trading systems).
  - Interconnectedness (e.g., shared software, interbank market exposures).
- Possible consequences include:
  - Decline in domestic credit provision.
  - Disruption to payment services (for example, remittances).
  - Data integrity compromised; data/systems unavailable; data confidentiality compromised.
  - Trading halts, asset price volatility; liquidity risk; default risk; spillovers to macro-financial stability.

### IMF work on cyber risk regulation and supervision
- Surveillance:
  - IMF began piloting assessment of cyber risk as part of its FSAP in 2019.
  - FSAP in-depth coverage of cyber risk has targeted advanced and larger emerging market economies, deepening assessment of operational risks in the banking sector and of FMIs.
  - FSAP coverage identified in Table 1 (selected jurisdictions and years) and Figure 3 show expanded engagement across jurisdictions and regions.
- Capacity development and technical assistance (TA):
  - Demand for TA to develop and strengthen cybersecurity regulations and supervisory frameworks has increased, largely tailored to emerging markets and developing economies.
  - TA aims to achieve outcomes including:
    - Enact or strengthen legal and regulatory frameworks aligned with international standards.
    - Develop, strengthen, and implement cyber risk supervisory frameworks.
    - Ensure timely availability of information on cybersecurity threats and incidents to supervisors.
    - Develop sufficient supervisory capacity to effectively supervise cyber risk.
  - Over the past four years, IMF delivered 108 TA missions on a range of topics (see list below).
- Cyber Risk Supervisory Toolbox (eight elements):
  1. Model cyber risk regulation.
  2. User guide for model cyber regulation.
  3. Assessment methodology.
  4. User guide for the technology- and cyber-risk-management assessment tool.
  5. Assessment tool based on the model regulation.
  6. Supervisory processes.
  7. Examination guide.
  8. Pre-examination document request.
- IMF staff contributions:
  - Work under FSB leadership on effective practices in cyber incident response and recovery.
  - Support for harmonizing regulatory reporting of cyber incidents to promote fast response and recovery.
  - Engagement on frontier topics such as AI and Privacy-Enhancing Technologies.
  - Collaboration with international standard-setting bodies (BCBS, CPMI, IOSCO) and organizations (BIS, ITU, World Bank, World Economic Forum).

### FSAP role and scope for cyber risk assessments
- FSAP pillars and relevance to cyber risk:
  - Pillar 1 (Macrofinancial Vulnerabilities/Risk Analysis): Cyber strategy; macro-level interconnectedness of digital landscape; cyber mapping; financial stability analysis; cyber resilience stress testing; reckoning cyber risk/stress testing with cyber scenario.
  - Pillar 2 (Policy Framework, Oversight, Governance): Threat landscape; cyber strategy for the financial sector; institutional/legal framework; regulations on cyber, IT, business continuity, operational resilience, third- and fourth-party risks, cloud arrangements, digital onboarding, digital banks, incident reporting, information sharing, testing arrangements; supervisory approach (onsite/offsite); operational resilience arrangements.
  - Pillar 3 (Safety Net, Crisis Management/Resolution): Crisis management at individual institutional level; ICT/cybersecurity arrangements conducive to resolution; resilience arrangements; crisis preparedness of central bank and supervisory agencies.
- Practical challenges for FSAP cyber work:
  - Dearth of reliable data due to hesitancy to disclose cyber incidents for reputational reasons.
  - Variation in cyber incident reporting arrangements across regulators; convergence in this area is a work in progress.
  - Unpredictability and wide-ranging threat sources make quantification and monetary valuation of cyber impacts challenging.

### IMF TA topics and typical mission outputs
- Common TA topics delivered in the past four years (examples):
  - Developing a cyber strategy for the financial sector.
  - Developing regulations focused on cyber, information technology, business continuity, operational resilience, third-party risks, and cloud computing.
  - Developing cyber incident reporting frameworks.
  - Establishing and operationalizing information and intelligence sharing networks.
  - Conducting cyber simulations and exercises.
  - Reviewing the cybersecurity of, and developing a cybersecurity framework for, central banks.
  - Developing a cyber supervisory approach and framework, including onsite and offsite supervision.
  - Enhancing operational resilience arrangements and applying principles of operational resilience within the financial sector.
  - Developing cyber testing frameworks.
  - Building capacity and expertise of cyber risk supervisors.
- Typical TA deliverables:
  - Comprehensive mission reports with findings and next steps.
  - Reviews of existing regulations.
  - Development of cyber risk supervisory manuals.
  - Assistance with onsite inspections at commercial banks.
  - Running cyber risk simulation exercises.

### Key observations and policy implications for emerging markets and developing economies
- Capacity and regulatory gaps:
  - Many countries have significant work left to do in strengthening cyber risk regulatory and supervisory frameworks.
  - Although many countries now have strong regulations, capacity to effectively supervise adherence is often lacking due to paucity of resources and expertise.
  - Most countries do not yet have cyber incident reporting frameworks in place or information and intelligence sharing networks among relevant agencies.
  - Most jurisdictions have yet to conduct cyber risk simulation exercises.
  - Most are still building dedicated cyber risk supervision units responsible for comprehensive cyber strategies, robust regulation, and effective supervision.
- Policy implications:
  - Cyber risk requires increased regulatory and supervisory attention to avoid negative systemic implications.
  - Cybersecurity should be treated as a shared public good necessary for the smooth functioning of the financial system and the broader economy.
  - Building cyber resilience is a long-term endeavor requiring a structured, comprehensive program including strategy, regulation, supervision, incident reporting, simulation exercises, and information sharing.
  - The IMF’s continued engagement to provide TA, training, tools, and FSAP coverage is valuable to help countries undertake long-term capacity building.

*Source: IMF Departmental Papers content provided in the source PDF.*

### 3. Good Regulatory Practices

### 3. Good Regulatory Practices

### Objective and Scope
- Key objective: safeguard the confidentiality, integrity, and availability of information and systems within supervised entities.
- Scope of threats covered: cyberattacks, technology and process failures, human error, natural or man-made disasters.
- Regulatory framework: typically tiered and includes mandatory requirements and guidance; requirements and recommendations whose enforceability is not essential are collectively referred to as expectations. The term “regulation” includes both mandatory requirements and guidance.

### A. Regulation Development Process
- Deliberate and structured approach recommended to deliver effective and internally consistent cyber-risk-management requirements (see Figure 4).
- Example process flow phases: Initiation → Analyze and plan → Design → Develop → Consult → Implement.
- “Analyze and plan” phase key considerations:
  - What is required from the regulation (as opposed to what requirements the regulation will contain).
  - Whether there are alternatives (for example, amending an existing ICT-risk-management regulation).
  - If alternatives exist, identify gaps to be addressed.
  - At what cost and by what deadline regulation can be developed.
  - What costs (and nonmonetary burdens) the regulation will likely impose.
- “Consult” phase: crucial to secure buy-in from internal and external stakeholders; seek feedback to avoid overlapping, inconsistent, or overly stringent requirements.

Success factors for development (recommended practices)
- Strive for unified regulation encompassing all technology risk areas rather than separate ICT and cyber risk regulations.
- Prefer principles-based and outcome-focused regulations; consider prescriptive approaches on an exceptional basis depending on industry maturity.
- Ensure expectations are outcome-driven and technology agnostic.
- Allow flexibility in how outcomes are achieved to support proportionality and supervisory judgment.
- Structure expectations according to a risk and control taxonomy without requiring adherence to any specific cybersecurity or IT control standard; use a taxonomy easily mapped to well-known standards or frameworks.
- Consider a tiered approach according to the proportionality principle with a baseline for all and successive tiers for larger, more complex, and riskier entities.

Principles-based versus prescriptive approaches
- Principles-based:
  - Establishes more future-proof expectations.
  - Shorter and easier to maintain.
  - Requires shared understanding between regulator and industry.
  - Suited to more developed financial systems with mature risk-management practices.
- Prescriptive:
  - Reduces uncertainty with detailed expectations and fewer divergent interpretations.
  - May benefit less developed financial systems.
  - Leaves less room for supervisory judgment, challenges proportionality, and can become voluminous and difficult to maintain.
- No dichotomy—continuum exists; regulators should strike an appropriate balance. An approach primarily principles based is often more beneficial given rapidly evolving threats and technologies.

### B. Key Expectations that Facilitate Effective Risk Mitigation

Governance and Internal Controls
- Board of directors: key roles and responsibilities include:
  - Possess requisite experience to understand ICT and cyber risks and principles of risk management.
  - Ensure an effective system of ICT and cybersecurity internal controls.
  - Set ICT and cyber risk tolerance levels.
  - Ensure an ICT and cyber-risk-management strategy and framework are established and executed.
  - Grant senior executives responsible for executing the technology-risk-management strategy sufficient authority and resources.
  - Ensure that the risk management and internal audit functions are properly resourced to deal with ICT and cyber risks.
  - Regularly review the technology-risk-management strategy and risk assessments.
- Policies, standards, and procedures: establish, incorporate industry standards/best practices where appropriate, and review/update regularly.
- Management of information and ICT assets:
  - Establish information asset management practices for hardware, software, and data.
  - Classify information assets based on criticality.
  - Designate data owners and custodians with clearly defined responsibilities.
- Security awareness: establish comprehensive cybersecurity awareness training covering staff, consultants, and third-party vendors.
- Budget for cybersecurity: adequate provisions must be made; cybersecurity budget should be independent from the overall ICT budget.
- Audit: internal audit should assess cybersecurity controls, governance, compliance, and outsourcing; internal audit teams should have requisite qualifications or access to external expertise; high-risk observations and corrective actions should be reported to the board without undue delay.

Technology and Cyber Risk Management
- Risk-management framework:
  - Establish framework, assign risks to accountable risk owners, execute process regularly.
  - Regularly review adequacy and effectiveness; implement corrective measures.
  - Prepare summary report, risk register, and remediation plan for board approval on a regular basis.
- Risk assessment and treatment:
  - Estimate likelihood of threat exploitation and magnitude of consequences.
  - Assign a risk-level metric and develop mitigation measures consistent with approved risk tolerances.
- Risk monitoring, review, and reporting: institute a process for monitoring changes in risk; major risks reported regularly to the board and senior management.
- Project management framework:
  - Establish framework covering initiation to closure, policies, standards, procedures.
  - Implement stage-gate mechanism to validate security adherence at each phase of the project lifecycle.
- System acquisition and development lifecycle:
  - Establish vendor evaluation and selection standards and procedures commensurate with project criticality.
  - Define processes, procedures, and controls for initiation/planning, requirements analysis, design, implementation, testing, and acceptance.
  - Integrate and evaluate security specifications and tooling consistently across all phases.

ICT Service Management
- ICT service management framework: implement governance, processes, and procedures for asset/configuration management, technology refresh, patch management, change management, software release, incident management, and related activities.
- Documentation: document systems and services to enable skilled substitute staff to run operations with minimal disruption.
- Data center (DC) security:
  - Conduct DC risk assessment; review upon significant changes in threat landscape or DC environment.
  - Ensure adequate redundancy for power, network connectivity, cooling, and other electrical and mechanical systems.
  - Monitor physical security and environmental controls on a 24/7 basis.
  - Establish and test escalation and response plans and procedures for physical and environmental incidents at DCs.
- Physical and environmental controls: cover all physical infrastructure including data centers and disaster recovery sites; include physical access controls, surveillance, and protection against man-made and natural threats.
- Asset and configuration management:
  - Implement configuration management process and maintain accurate hardware/software information.
  - Review and verify configuration information regularly.
  - Use standardized configurations and software images where possible.
- Technology refresh and patch management:
  - Avoid using outdated and unsupported hardware or software; develop technology refresh plan to replace before end of support.
  - Establish patch management process for timely implementation of functional and nonfunctional patches based on criticality.
  - Test patches before applying to production.
- Change management: establish process to assess, test, review, and approve changes; conduct risk assessment before implementation.
- Incident management:
  - Establish incident management framework to recover ICT services/systems to secure and stable state quickly and safely.
  - Maintain knowledge base capturing lessons learned and root cause analyses.
- Identity and access management (IAM):
  - Implement IAM processes for provisioning, changing, and retiring accounts and access rights.
  - Grant access according to “need-to-know” and “least privilege” principles with appropriate approvals.
  - Enforce strong password/passphrase controls; at a minimum, multifactor authentication should be enforced for privileged accounts and remote access.
  - Conduct periodic user access reviews; address exceptions as soon as practicable.
  - Monitor and assess privileged access regularly.
- Data security and privacy:
  - Adopt measures to detect and prevent unauthorized access, modification, copying, or transmission of confidential data.
  - Consider data in motion, data at rest, and data in use in tandem.
  - Restrict use of confidential production data in nonproduction environments.
  - Permanently erase data on storage media, systems, and endpoint devices before disposal or redeployment.

Cybersecurity Operations
- Threat intelligence: establish system to collect, process, and analyze cybersecurity-related information for relevance and potential business/ICT impact; include voluntary and collaborative industry and national information-sharing networks where they exist; active participation recommended.
- Cyber event monitoring and detection: establish a security operations center, obtain managed security services, or at minimum run cyber incident monitoring, detection, response, and recovery functions.
- Cyber incident response, management, and reporting:
  - Establish response and management plan to isolate and neutralize threats and securely resume affected services.
  - Plan should outline communication, coordination, and response procedures for plausible scenarios and integrate with wider crisis response.
  - Use lessons learned to enhance controls and improve the incident management plan.
  - Cyber incidents must be reported to the supervisor and oversight authority according to prescribed criteria and within specified timeframes.

Response and Recovery
- Business continuity management and disaster recovery:
  - Establish business continuity management process including business impact analysis; determination of recovery time objectives and recovery point objectives; development, training, testing, and maintenance of recovery plans for systems and business processes.
  - Update and test plans after significant changes in ICT systems and business processes, or at least annually.
- Backups:
  - Establish comprehensive backup regimen enabling recovery from system disruption, data corruption, or deletion; include data archival for long-term retention.
  - Limit physical and logical access to backup media, especially write access, to authorized staff, systems, and processes.
  - Consider immutable backups for critical data to address ransomware risks properly.
  - Backups of critical data should be redundant (for example, at least in two equivalent copies) and stored in separate secure locations unlikely to be affected by the same disaster.
  - Periodically perform test restorations from backups.

Vulnerability Scanning, Tests, and Exercises
- Establish process for regular vulnerability scanning.
- Carry out penetration testing to obtain in-depth understanding of cybersecurity effectiveness.
- Ensure external-facing digital services are subject to penetration tests at regular intervals—at least annually—and after significant changes to underlying systems.
- Conduct regular cyber exercises to validate incident response and recovery procedures, including communication plans; exercises could include tabletop exercises and attack simulations and be combined with penetration testing and business continuity/disaster recovery testing.
- Establish comprehensive remediation process to track and address issues identified.
- Frequency of scanning, testing, and exercises should be commensurate with criticality of ICT systems and security risk.

Independent Assurance
- Ensure independent ICT and cyber risk audits provide board and senior management with objective opinions on adequacy and effectiveness of risk management, governance, and internal controls relative to existing and emerging technology risks.
- Scope and frequency should align with criticality and risk profile of information assets, functions, and processes.
- At a minimum, employ internal audit staff with competence and skills to develop an annual ICT and cyber risk audit plan and understand findings and recommendations of specialist external providers.

Outsourcing and Technology Service Provider (TSP) Management
- FIs remain responsible and fully accountable for regulatory obligations regarding functions outsourced or delivered using TSPs.
- Use of TSPs must not result in increased ICT and cyber risks.
- Undertake risk assessment and due diligence before contracting a TSP; update risk assessment regularly.
- Contracts should explicitly reserve the right for the regulator/supervisor or its designees to audit the TSP to the extent of its involvement in delivering services for the FI.

*Source: IMF staff.*

### 4. Good Supervision Practices

### 4. Good Supervision Practices

### Core supervisory processes and high-level approach
- Supervision agendas in cyber risk supervision generally focus on four core processes: regulation and guidance development, offsite supervision, onsite examination (inspection), and monitoring of cybersecurity testing.
- These core processes operate collaboratively rather than in isolation; a generalized model of core processes and interlinkages is presented in Figure 5 (source: IMF).
- Supervisory priority should be proportionate to an FI’s cyber risk profile and systemic importance; supervisory attention is achieved through continuous offsite supervision and regular onsite examinations.
- Supervisors should prioritize monitoring cybersecurity defenses of systemically important FIs.
- More granular priorities may be set within the core processes (for example, prioritizing financial stability analysis and information sharing in offsite supervision, or security testing in onsite supervision).

### Governance and management of cyber risk supervision
- Several jurisdictions have adopted the Basel Core Principles for Effective Banking Supervision (BCP), including those related to ICT and cyber risk; supervisory authorities show broad variability in internal governance and cyber responsibilities.
- BCP 25 on operational risk and operational resilience has been extended to enhance supervisory focus on: governance, operational risk management, business continuity planning and testing, mapping interconnections and interdependencies, third-party dependency management, incident management, cybersecurity, and ICT.
- Supervisory expectations include:
  - Requiring FIs to have appropriate ICT/cyber strategies, policies, procedures, systems, controls, and processes consistent with their risk profile, systemic importance, risk appetite, tolerance for disruption, and emerging risks, and approved at an appropriate level of management or the board.
  - Expecting FIs to identify and protect themselves from threats and potential failures, and to respond to and recover from ICT/cyber incidents.
  - Requiring FIs’ boards to oversee senior management in implementing policies and procedures and to have the capacity to identify external and internal threats and potential failures in people, processes, and systems on an ongoing basis.
  - Expecting FIs to identify their critical operations and map the people, technology, processes, data, facilities, third parties, interconnections, and interdependencies required to deliver such operations through disruption.
  - Requiring FIs to have response and recovery capabilities.
  - Requiring FIs to conduct business continuity exercises under a range of severe but plausible scenarios to test their ability to deliver critical operations through disruption.
  - Ensuring FIs can compile and analyze ICT/cyber incident data with sufficient granularity and facilitate appropriate reporting to the board and the supervisory authority.
  - Ensuring FIs understand and manage risks associated with third parties.
  - Requiring FIs to implement a comprehensive, appropriately resourced change management process that includes adequate controls and risk oversight.
- Supervisory authorities are expected to identify common points of exposure across FIs to ICT/cyber risk (for example, dependence on common service providers, technology, or geographies) and assess concentration risks that could trigger systemic risks.
- Good governance practices for supervisory authorities include:
  - Boards of the supervisory authorities set the agenda for cybersecurity supervision.
  - Combining on- and offsite supervision arrangements.
  - Providing human, technological, and financial resources in adequate quantity and quality.
  - Clearly assigning responsibility and accountability for supervision and oversight of ICT/cyber risk.
  - Integrating cyber risk assessments with enterprise-wide risk management for a holistic picture.
  - Using a full range of onsite supervision techniques (full scope, limited scope, thematic examinations, short visits).
  - Using technology to monitor activities to increase efficiency and monitoring compliance.
  - Conducting stress tests considering a severe but plausible cyberattack or cyber incident to sensitize the board.
  - Recognizing cyber resilience testing as an emerging practice that enhances preparedness.
  - Collecting supervisory data including key risk indicators, organizational structure, third-party registers, relevant policies, board agenda items on ICT/cybersecurity, mapping data, dashboards, risk profiles, and incident reporting (both individual-level beyond thresholds and summary-level covering all incidents).
  - Focusing on capacity building among stakeholders, facilitating information sharing between financial sector entities, and improving coordination among central bank units and other stakeholders (for example, law enforcement and government agencies).

### Staffing, planning, and resource allocation
- Resource scarcity is a universal challenge, more acute for emerging risks like ICT/cyber and especially pronounced in emerging markets and developing economies.
- Resourcing depends on the supervisory model used for assessing cyber risks; approved positions may remain unfilled due to limited available talent.
- Approaches observed:
  - Advanced economies often embed cyber risk assessments in specialized risk units within supervision authorities; general supervisory teams request resources from these units. Benefits include specialist assessments, integration into overall risk assessment, and shared benefits for supervisors and supervised entities.
  - Jurisdictions unable to establish specialized ICT/cyber units may select examiners with audit backgrounds for ICT/cyber examinations and provide training.
  - Where supervision lacks skilled resources, authorities commonly leverage expertise from other domains (information technology, payment systems, risk management, internal audit) within the central bank or supervisory authority as a short- to medium-term measure.
- Long-term recommendation: build ICT/cyber capabilities within supervision departments given the trajectory of digitalization.
- Supervisory considerations:
  - Cyber risk increases with digitalization and interconnectedness; risk profiling should focus on the weakest link.
  - Supervisors must address sector-wide cyber risks and collect information to identify risk concentrations and remediate as needed.
  - It is desirable that at least two resources be allocated to ICT/cyber risk assessment, even in smaller jurisdictions, to ensure checks and balances and informed discussions.
  - Many governance, risk management, and audit aspects can be covered by experienced generalist supervisors; external audit firms can serve as a stopgap until internal capabilities are established.
  - Background checks on cyber risk supervisors are required because of access to sensitive financial-sector information and regular dealings with FIs and critical third parties.
  - Upskilling and retention are challenges; leveraging technology to automate and analyze supervisory information can improve efficiency and reduce human resource demand.

### Learning and development
- Cybersecurity is dynamic; supervisors and overseers must build capacity to keep pace and acquire necessary skills.
- Jurisdictions face the challenge of developing staff who are both strong supervisors and technically capable; two main approaches:
  - Train general supervisors in technical skills.
  - Recruit technical staff and provide them supervisory training.
- Recommended practices:
  - Develop onboarding programs for cyber risk supervisors covering: country banking and financial structures, technologies deployed locally, the threat landscape, entity maturity levels, governance and risk-management expectations, the supervisory role, and job effectiveness requirements.
  - Maintain IT and cyber academic qualifications and professional certifications on an ongoing basis.
  - Hold periodic debriefing sessions in formalized forums to share industry practices and supervisory responses.
  - Rotate supervisors among regulation development, offsite supervision, onsite supervision, incident reporting and response, and testing and exercises to develop well-rounded teams.

### Survey findings on capacity development (Figure 6 highlights)
- Jurisdictions heavily depend on free webinars and online courses, followed by certification training and exams (for example, CISA, CISSP), and academic programs (for example, undergraduate, graduate, or postgraduate) subsidized by authorities.
- About two-thirds of the authorities mandate an academic degree in IT to become a cyber risk supervisor.
- Some authorities require cyber risk supervisors, at senior and all staff levels, to obtain and maintain professional certifications, though such requirements are not mandated by about 20 percent of jurisdictions.
- In terms of capacity development planning:
  - 17 percent had a plan focused on cyber risk supervisors.
  - 38 percent had a general plan focused on all supervisors but not one focused on cyber risk supervisors.
  - 45 percent addressed capacity development without having any plans.

*Source: IMF. gpcrrsea - 4. Good Supervision Practices. gpcrrsea - 4. Good Supervision Practices*

### 2. Cybersecurity Training Options Available

### 2. Cybersecurity Training Options Available

### Training uptake and formats
- 40.5% — Academic programs (for example, undergraduate, graduate, or postgraduate) subsidized by the authority
- 60.8% — Certification training and exams (for example, CISA, CISSP, and so on) subsidized by the authority
- 97.3% — Free webinars and online courses
- Sources: Survey responses, IMF, and Ravikumar (2025).
- Note: CISA = Certified Information Systems Auditor; CISSP = Certified Information Systems Security Professional.
- For capacity development among stakeholders:
  - Workshops with key stakeholders remained the preferred option.
  - Interviews, speeches, and publications by supervisory authorities helped build awareness and capacity.
  - Participating in or encouraging public-private partnerships and cooperation with academic institutions was another way authorities built capacity.

### Proportionality
- Definition: Proportionality in financial sector supervision means calibrating regulatory requirements and supervisory practices according to an institution’s size, complexity, systemic importance, and risk profile.
- Purpose: Balance effective supervision with consistency and compliance; apply highest standards to systemically important and complex FIs; adapt expectations for smaller, less sophisticated, non-systemic FIs.
- Application:
  - Can be applied in the regulatory framework and through supervisory practice while maintaining a single rulebook calibrated by size, scale, and complexity.
  - Supervisory resources and intensity (frequency, scope, depth of onsite examinations) can be adjusted according to institution characteristics and risk profile.
  - For IT and cybersecurity controls, vary maturity expectations of control procedures in line with complexity, size, and risk profile while keeping most control objectives consistent across institutions.
- Examples:
  - Penetration testing:
    - Baseline expectation: all regulated entities undertake security testing at some frequency.
    - For larger and systemic FIs: best practice is penetration testing performed at least annually by an independent and globally recognized third party.
    - For less systemic FIs: frequency may be adjusted; third party may be an intra-group function for foreign FI subsidiaries; scope could be narrowed.
    - Supervisory practice: at minimum, supervisor should receive the executive summary and issues list, track issues to remediation, and consider them in supervisory risk rating.
  - CISO function and position:
    - Many countries require a senior staff member with oversight responsibilities for information security and cyber risk, with a degree of independence and typically part of senior leadership.
    - For smaller FIs or scarce local talent pools, supervisors may adapt expectations for the CISO role.
  - Identity and Access Management (IAM):
    - All entities required to control identities and access based on “need-to-know” and “least privilege.”
    - Small institutions: may use a manual solution or Active Directory.
    - Complex institutions: expected to deploy a dedicated IAM system with interfaces to business and HR systems and automation.
- Governance and board awareness:
  - Supervisors should consider proportionality when differentiating qualitative requirements related to corporate governance and risk management.
  - Boards often lack in-depth technology/cyber expertise; proportionality may allow technological expertise to be concentrated in one board member or an expert the board regularly accesses.
- Proportionality and nonfinancial risks:
  - Calibrating proportionality for nonfinancial risks such as cyber risk or operational risk involves greater supervisory judgment.
  - Example: business continuity planning and testing—frequency and/or complexity adjustments for non-internationally active banks remain a matter for debate.
- Challenges:
  - Design phase: defining tiering criteria, maintaining a level playing field, avoiding regulatory arbitrage.
  - Implementation phase: achieving a net reduction in compliance costs and supervisory resource stress.
  - Interconnectedness: security is as strong as its weakest link.
- Conclusion:
  - Proportionality helps align supervisory expectations with FIs’ risk profiles, complexity, and systemic importance.
  - Can be applied across all FIs or to different groups (for example, internationally active FIs required to fully implement all requirements; smaller/simpler FIs required to implement a limited or simplified set).

### Offsite supervision
- Overview:
  - Offsite supervision enables continuous monitoring of FIs’ cybersecurity posture without physical presence.
  - Allows tracking of key cybersecurity metrics, threat intelligence analysis, assessment of security controls, and earlier identification of emerging cyber risks.
  - Facilitates collection and analysis of standardized cybersecurity metrics across institutions to identify industry-wide trends and vulnerabilities.
- Offsite supervision phases (conceptual elements provided):
  - Timing; Sources; Threat landscape; Permanent file; Memos; Databases; Dashboards; Cyber map; Risk assessment (Idiosyncratic, Systemic); Stress test; Gap analysis; Compliance position; Threat intel; Incident reporting; Info sharing; Industry reports; Meetings; Validation; Scope; Team; Workplan; Planning; Info. Gathering; Analysis; Reporting; Off-site assessment (continuous).
- Good practices:
  - Leverage SupTech and secure communication platforms, secure document-sharing systems, encrypted channels, and data analysis tools.
  - Develop an annual offsite cyber risk supervision plan including timing, scope, and team assignments.
- Information gathering and sources:
  - Establish a predefined set of minimum reporting requirements for both quantitative and qualitative information tied to the technology stack; use the cyber risk tolerance statement as the backbone.
  - Require submission of key documents: business plans, strategic plans, investment plans, operational expenditure, risk registers, audit reports.
  - Annual qualitative submissions: risk tolerance statement; business, ICT, and cybersecurity strategies; internal audit plan; information security policies; results of tests, assessments, and audits; list of material outsourcing service providers; board papers.
  - Routine reporting examples:
    - Number of incidents and breaches.
    - Key availability metrics of critical and important systems and services (for example, uptime, frequency, and duration of downtimes).
    - Key metrics of ICT operations.
  - Ad hoc cyber incident reporting good practices:
    - Secure communication channel and technology platform for submitting and processing cyber incident reports.
    - Monitoring aligned with platform operational schedule (for example, if open 24/7, monitoring is 24/7).
    - Follow up all reports until resolution.
    - Identify trends and act to prevent/mitigate further incidents at the reporting FI and system-wide.
    - Use data analytics tools, machine learning, and AI to augment incident report analysis.
    - Defined and tested escalation mechanism to involve senior leadership and other relevant agencies for severe incidents.
  - Consolidate and leverage existing supervisory information; limit new information requests to changes and uncovered areas.
  - Avoid collecting cyber risk information the supervisor cannot evaluate; for granular technical reports, request executive summaries and action plans instead of full logs.
- Analysis:
  - Distinguish two components:
    1. Comprehensive annual assessment of all material risks (including cybersecurity and operational resilience, often Pillar 2 assessment).
    2. Ongoing assessment of routine supervisory reporting and other information throughout the supervisory cycle.
  - Use key cyber risk indicators for trend analysis and forecasting; set risk level thresholds to trigger warnings.
  - Cyber mapping:
    - Map main technologies, services, and connections between FIs, service providers, and in-house or third-party systems.
    - Mapping need not be exhaustive; selective criteria and thresholds can yield useful maps.
  - Assess cybersecurity holistically within operational-risk-management and cyber frameworks to recognize enterprise-wide strengths and weaknesses.
- Reporting:
  - Outputs include regular risk assessments of specific FIs and horizontal analysis reports across the sector (can be published stripped of confidential information).
  - Internally, visualize risks on dashboards; use data analytics and visualization tools.
  - Collate offsite reporting into a “permanent file” as input to risk ratings and supervisory action plans.
- Notifications and permissions:
  - Require notification or permission for material changes (outsourcing, offshoring) to evaluate altered risk profiles; supervisors review, approve, or provide non-objection.
- Other activities:
  - Offsite supervision can support pre-licensing, mergers and acquisitions, and resolution processes; develop checklists and processes recognizing entity types, IT/business strategies, and digital products.

### Onsite supervision
- Overview:
  - Onsite supervision provides stronger assurance on the quality of cyber risk management than offsite work; important because much risk is tied to tangible infrastructure (DCs, ICT equipment).
  - Onsite cyber risk examinations align with general supervisory rules and typical onsite examination phases (planning, information gathering, execution, reporting, follow-up).
- Onsite examination phases (conceptual elements provided):
  - Timing; Notification; Planning; Scope; Team; Workplan; Information Gathering; Execution; Reporting; Closure; Follow-up; On-site Examination (periodical); Information request; Presentations; Draft report; Debrief; Assessment of remedial action; Escalation as needed; Feedback; Filing; Management response; Evaluation; Quality assurance; Final report; Resolution; Interviews; Evidence collection; Validation; Analysis; Exit meeting.
- Good practices — Planning:
  - Front-load effort; thoroughly review relevant material; allow time for sample testing.
  - Follow a regular cycle (typically annual) for optimal resource allocation; distribute onsite missions across the year and reserve a small capacity buffer for unplanned visits.
  - Prepare a project plan covering all phases; prepare an interview plan with topics, timeframes, supervisors, bank staff, and logistics.
  - Reserve time for internal deliberations and follow-up; prepare pre-examination information requests to avoid re-asking known information.
  - Transmit draft interview plan and information request with the notice to the bank or shortly thereafter.
  - Allocate time for review of initial return, initial risk assessment, and preparatory work.
  - Fully assign the team to onsite work during the examination period.
  - Ensure independence and objectivity of the onsite team; team members must not have direct stakeholder affiliations or be shareholders of the FI.
  - Team composition:
    - At least two experts even for small entities.
    - Diverse backgrounds and competencies, including ICT GRC (governance, risk, and compliance) experts.
    - Assign junior supervisors for hands-on training and internal knowledge transfer.
    - Counsel from the legal department should be assigned and available during the visit.
- Information gathering and analysis:
  - Primary sources: documentation collected during offsite supervision, pre-examination return, outputs of offsite analysis, and incident reporting.
  - Review and validate returns for reasonableness, completeness and consistency, compliance with governance requirements, and recency of strategies/policies.
  - Understand business model and technology stack, including outsourcing and third-party providers:
    - Enterprise ICT architecture, main technological platforms, age of technology assets, physical location of infrastructure, main service providers and contract terms.
  - Preliminary risk assessment should inform focus areas.
  - Indicators of potentially higher-risk areas include:
    - Areas lacking proper documentation.
    - Unaddressed internal or external audit findings.
    - High risks in internal risk assessments without credible mitigation.
    - Outdated cyber-risk-management documentation, strategies, policies, or procedures.
    - Obsolescence in technology stack (for example, use of superseded software versions).
    - Major changes in ICT architecture.
    - Budget and time overruns in ICT projects.
    - High turnover or prolonged vacancies for key ICT and cybersecurity managerial positions.
    - Severity or frequency of reported cyber incidents, especially outages of key systems, above the peer benchmark.
    - ICT and cybersecurity staffing or budgets below the peer benchmark.
    - Negative media coverage related to ICT performance and cybersecurity.
- Execution:
  - Examinations focus on cyber risk governance and risk management; adopt auditors’ approaches (evidence, firsthand observation, control testing).
  - Emphasize professional skepticism (“trust but verify”).
  - Prioritize testing effectiveness of risk management through sample testing.
  - Typical sequence: deepen understanding of frameworks and IT architecture, probe and sample-test control effectiveness, follow up with meetings with risk owners and lines of defense.
  - Schedule board meetings to assess oversight and board awareness of cybersecurity.
  - Meet all three lines of defense; meet second and third lines independently of the first.
  - Conduct exit meetings to communicate preliminary observations promptly after onsite work.
- Reporting:
  - Present preliminary findings at conclusion to CIO, CISO, and senior management.
  - Use standardized report finalization processes across examinations.
  - Rank findings and set deadlines for resolution; segment priorities into:
    - Requirements — where FI is not fulfilling regulatory obligations.
    - Recommendations — partial compliance where improvements are in scope.
    - Suggestions — strengthen risk management where FI is materially in compliance.
  - Consider FI feedback on feasibility and timelines; focus on desired outcomes and allow FI to decide means.
- Closure and follow-up:
  - Require FI to submit an approved action plan with steps, deadlines, and responsible stakeholders.
  - Verify execution via progress reports, short visits, or independent audits.
  - Where internal audit is independent and capable, delegate follow-up on lower-risk issues but validate remediation risk-basedly.
  - Track remediations past due; prioritize high-risk overdue items with assertive supervisory action, including summoning senior management or legal enforcement if needed.

*IMF DEPARTMENTAL PAPERS • Good Practices in Cyber Risk Regulation and Supervision (excerpt: 2. Cybersecurity Training Options Available)*

### Box 1. Australian Prudential Regulation Authority’s Supervisory Approach—CPS 234

### Box 1. Australian Prudential Regulation Authority’s Supervisory Approach—CPS 234

### Independent Assessment
- APRA maintains a principles-based prudential framework and a risk-based approach to supervision, including technology and cyber supervision.
- Prior to July 1, 2019, this approach was supported by the 2013 Prudential Practice Guide CPG 234 Information Security, which offered guidance while providing regulated entities with flexibility in implementation.
- As cyber threats grew in sophistication and frequency, APRA recognized the need to intensify supervision with a whole-of-industry intervention to embed nonnegotiable cyber controls across all regulated industries.
- On July 1, 2019, APRA released a legally enforceable information security standard, CPS 234 Information Security, placing obligations on all regulated entities to maintain capabilities and controls to address cyber threats. Key tenets include:
  - an obligation on boards to maintain information security;
  - comprehensive security testing; and
  - response plans.
- The intent of the standard was to ensure regulated entities have prevention, detection, and response capabilities to withstand cybersecurity threats.
- To “shift the dial” on cyber, APRA initiated the CPS 234 Independent Assessments (the CPS 234 “Tripartite” review) as part of its 2020–24 cyber strategy.
  - The assessments required APRA-regulated entities to appoint an independent auditor to assess their compliance with the prudential standard.
  - Assessment results and remediation efforts, conducted over multiple years, drove significant improvements in uplifting cyber practices and bolstering boards’ confidence to direct management to address cyber exposures.

### Key Findings from the Tripartite Review
- Incomplete identification and classification of critical and sensitive information assets
- Limited assessment of third-party information security capability
- Inadequate definition and execution of control testing programs
- Incident response plans not regularly reviewed or tested
- Limited internal audit review of information security controls
- Inconsistent reporting of material incidents and control weaknesses to APRA

### Post-Review Supervision and Lessons Learned
- APRA continues to reinforce the need for entities to:
  - enhance their prevention, detection, and response capabilities;
  - test their preparedness; and
  - work collaboratively with peers, researchers, and government to improve cyber resilience.
- Lessons from onsite examinations should be disseminated broadly among cyber risk supervisors through debriefing sessions to discuss strengths and weaknesses and continuously improve cyber risk supervision.
- General conclusions can be shared across the supervisory function in internal training curricula to attune non-specialist supervisors to cyber risk.

*IMF DEPARTMENTAL PAPERS • Good Practices in Cyber Risk Regulation and Supervision — Box 1 content*

### 5. Cyber Simulation Exercises

### 5. Cyber Simulation Exercises

### A. Overview
- Purpose: Understand interdependencies within the financial system and between FIs and third parties; test ability of FIs to respond to and recover from incidents through cyber simulation exercises (“cyber war games” or “cyber tabletop exercises”).
- Operators: Conducted by regulatory and supervisory authorities and by market participants; jurisdictions worldwide are increasing focus on such exercises.
- Observed role of IMF TA and FSAP assessments: Identified several key benefits of exercises (see Key Benefits).

### Key Benefits (summary of Table 3)
- Improved incident response
  - Faster decision making under pressure.
  - Improved coordination among IT, security, communications, legal, and other teams.
- Identifying gaps in security
  - Uncover vulnerabilities in infrastructure, policies, procedures.
  - Test backup systems, incident response plans, and recovery procedures.
- Enhanced preparedness
  - Training for employees, including non-technical roles.
  - Scenario customization to reflect specific risks.
- Better risk management
  - Evaluate potential impact of attack vectors (example: phishing, ransomware, insider threats).
  - Cost-effective testing of risk-management strategies without real-attack consequences.
- Strengthening communication and collaboration
  - Refine internal communication strategies across IT to C-suite.
  - Promote cross-departmental collaboration (IT, Human Resources, legal, others).
- Reinforce cyber hygiene and awareness
  - Education on best practices (secure passwords, phishing prevention, software updates).
  - Awareness of emerging threats and tactics such as social engineering.
- Meeting regulatory requirements
  - Test compliance procedures, including data breach notification laws.
- Continuous improvement
  - Actionable insights from debriefs to track progress and refine incident response.
- Boosted confidence
  - Organizational confidence in handling cyber threats.
  - Stakeholder assurance (customers, clients, investors).
- Adapting to new threats
  - Simulate novel attacks (example: APT or state-sponsored hacking).
  - Test proactive defense strategies against latest TTPs.

- Note: APT = advanced persistent threats; IT = information technology; TTPs = tactics, techniques, and procedures.

### B. Good Practices
- Exercise types observed
  - Phishing exercises to test employee awareness and training.
  - Tabletop exercises or drills/walk-throughs of incident response and recovery plans/playbooks to build muscle memory.
  - Live tests/simulations: basic and threat-led penetration tests, bug bounties, cyber ranges, adversarial attacks (DDoS, ransomware) to enhance technical response and recovery.
  - Executive-level crisis management exercises to stress decision making, senior management involvement, and communication under challenging scenarios (including no-win situations and prioritization of competing system recoveries).
  - Sector-wide exercises to practice sector coordination and communication in large-scale incidents.
- Authority role: Good practice is for authorities to drive exercises in their financial sectors—reflecting convening power and financial stability mandate.
- Cyclical program approach: design an exercise program following a cycle of exercises, evaluation, improvements, and repetition.
- Phased building on prior exercises:
  - Progressively enhance preparedness by tackling increasingly complex risk scenarios.
  - Develop key risk indicators and metrics to measure improvements to incident management.
  - Ensure common understanding of priorities, threats, and risks.
  - Validate or benchmark incident recovery capabilities.

### Simulation Exercise Program Management
- Core components
  - (1) Stakeholder engagement.
  - (2) Multiyear preparedness priorities.
  - (3) Improvement planning.

- Stakeholder engagement
  - Two stakeholder types: program-level stakeholders (oversee entire program) and exercise-specific stakeholders (involved in individual exercises).
  - Early identification and an ecosystem scan to assess interconnections and third-party interdependencies.
  - Joint committee recommendation for oversight and delivery of the exercise program.
  - Appoint a lead stakeholder in a senior position to “own” the program—responsible for resources, commitment, momentum, and risk prioritization.
  - Good practices: strong stakeholder engagement, clear roles, effective coordination, and stability.

- Multiyear preparedness priorities (observed good practices)
  - Incorporating lessons learned
    - Structured programs transition lessons between systems/exercises and update priorities based on experience.
  - Risk-based planning approach
    - Programs should be based on risk assessments and approved multiyear priorities set by authorities, stakeholders, and senior leadership.
    - Priorities must be clear, concise, measurable, realistic, and tied to risk assessments.
  - Risk assessments and organizational threats
    - Evaluate vulnerabilities, threats, and mitigation strategies affecting the financial sector.
    - Identify risks from external dependencies via ecosystem scans in interconnected sectors like finance.
  - Cybersecurity considerations
    - Frequent reassessment required as threats evolve, balanced against tracking long-term improvements.
  - Budget and resource constraints
    - Account for financial and resource limitations when setting long-term priorities.
  - Summary: Multiyear planning continuously refines risk management and preparedness, integrating lessons learned and adapting to emerging threats.

- Improvement planning
  - Objective: Identify areas for improvement in responding to and recovering from cyber incidents.
  - After-action report (AAR): document assessment results and issue specific recommendations.
  - Link identified gaps to measurable corrective actions with designated responsible parties and target implementation dates.

### Process for Conducting an Individual Exercise
- Structured preparation steps (Figure 10 workflow)
  - Identify the Exercise Planning Team
  - Hold an Initial Planning Meeting
  - Hold a Concept and Objectives Meeting
  - Send the Invitation
  - Hold a Mid-term Planning Meeting
  - Finalize and Distribute the AAR/IP
  - Conduct the Exercise
  - Draft After-Action Report/Improvement Plan
  - Hold an After-Action Meeting
- Simulation exercise design and development
  - Define exercise type, participants and roles, objectives, multiyear alignment, and scenario details.
  - Objectives and assessment criteria should be clear, measurable, achievable, and tied to risk assessments.
  - Participant selection: include diverse experts (technical, legal, communications, law enforcement).
  - Scenario selection: based on risk assessments and threat intelligence; tailor complexity to purpose; complex exercises may require additional training.
  - Use scenario injects to steer exercises if deviations occur; conduct regular planning/educational sessions.
  - Identified gaps should be presented to system owners for action—not prematurely fixed during the exercise—to preserve realism.
- Simulation exercise conduct considerations
  - Logistics: secure location, technology, communication, safety; provide materials in advance; organize briefings when multiple jurisdictions involved.
  - Minimize disruption/confusion:
    - Clearly label simulation communications.
    - Choose date/time/location/method to minimize operational impacts.
    - Distribute materials on roles, responsibilities, communication plans.
    - Notify external parties about the exercise.
    - Allow participants to exit to respond to real events if necessary.

### Assessment
- Purpose: Identify areas for improvement in policies, procedures, operations, and systems; enhance future exercise proficiency.
- Method: Compare results against objectives; analyze recorded events to pinpoint weaknesses.
- Effective assessment criteria:
  - Measure how well objectives are met.
  - Highlight gaps and recognize successful strategies.
  - Avoid incentivizing participants to “pass” artificially; genuine issues must be surfaced.
- Hotwash (hot debrief): immediate post-exercise discussion to collect feedback for improvement planning.
- Assessors should evaluate:
  - Whether participants correctly identified the issue.
  - Whether actions aligned with policies and procedures.
  - The effectiveness of responses.
  - Participants’ awareness of others’ roles and actions.
- Use assessment outcomes to form an improvement plan that strengthens future exercises and overall preparedness.

### Conclusion
- Authorities are increasingly focusing on cyber simulation exercises as highly useful tools to raise sector awareness, improve financial system resilience, and strengthen public and private sector crisis preparedness.
- IMF TA-facilitated exercises have consistently identified significant areas for improvement in institutional governance arrangements, crisis communication protocols, incident reporting, information sharing, and response and recovery arrangements.
- Simulation exercises reinforce importance of core areas and often catalyze further initiatives to drive improvements.

*Source: IMF Staff — gpcrrsea - 5. Cyber Simulation Exercises*

### Box 2. Supervision versus Oversight: Key Differences

### Box 2. Supervision versus Oversight: Key Differences

### Distinction between supervision and oversight
- Supervision focuses on the safety and soundness of individual FIs (prudential supervision) and how FIs protect the interests of customers, investors, and market participants (conduct supervision).
- Oversight, typically conducted by central banks, is about ensuring the safety and efficiency of a financial system with emphasis on the interconnections between participating institutions.
- Supervision and oversight are complementary because they both contribute to safeguarding financial stability.

### Three key activities of oversight
- Monitoring
  - Involves identifying and obtaining sources of information to improve the understanding of a system’s design and operation.
  - Sources of information could include system documentation, reporting on system activity, internal reports, self-assessments, bilateral contacts, multilateral meetings, onsite inspections, expert opinions, and customer feedback.
  - Powers to obtain such information, perform onsite inspections, and induce change help ensure effective oversight.
- Assessment
  - Occurs at two levels:
    - At a general level, assessments take a more holistic view, analyzing contributions to monetary and financial stability objectives.
    - At the system level, assessments determine whether the relevant policy requirements and standards are met.
  - A balance is often struck between self-assessments by regulated entities (for example, a payment system) and external assessments (for example, by the central bank).
- Inducing change
  - Arises when policy requirements or standards are not being met.
  - Tools to induce change include:
    1. moral suasion,
    2. public statements,
    3. voluntary agreements and contracts,
    4. participation of the central bank in systems (as part-owner or official observer),
    5. cooperation with other authorities,
    6. statutory power to require change, and
    7. enforcement and actions.
- Source: CPSS 2005.

### Importance of FMI cyber resilience
- The safe and efficient operation of FMIs is essential to maintaining and promoting financial stability and economic growth.
- FMIs can be sources of financial shocks—such as liquidity dislocations and credit losses—or major channels through which these shocks are transmitted across domestic and international financial markets.
- The level of cyber resilience, a key element of an FMI’s operational resilience, can be a decisive factor in the overall resilience of the financial system and the broader economy.
- The systemic importance of FMIs accentuates the need for their robust oversight.

### Standards and frameworks applied in IMF analysis of FMI cyber risk
- The IMF applies the CPMI-IOSCO Guidance on Cyber Resilience of FMIs (Cyber Guidance) among other international standards.
- The Cyber Guidance is informed by five key principles of the CPMI-IOSCO Principles for Financial Market Infrastructures (PFMI), including:
  - Principle 2 (Governance),
  - Principle 3 (Framework for the comprehensive management of risks),
  - Principle 8 (Settlement finality),
  - Principle 17 (Operational risk), and
  - Principle 20 (FMI links).
- The analysis of operational risk also considers the application of Annex F (Oversight expectations applicable to critical service providers), which includes expectations on information security.
- To further examine cyber risk supervisory and oversight practices, the five major areas of responsibility of central banks, market regulators, and other relevant authorities for FMIs are referenced.

### Key recommendations from Table 4: Strengthening FMI cyber resilience (by Cyber Guidance component)
- Governance
  - Cyber strategy: FMI oversight authorities should keep developing their cyber strategies, both in their own mandates as well as in joint functions, for the financial sector and FMIs, with a clear vision and objectives, clear articulation of roles and responsibilities in operationalizing the strategy, initiatives and tools required to operationalize the strategy, road map for implementation and timelines, and estimates of resources and investment required to achieve the strategy.
  - Independence: The oversight division should be given enough independence and resources to conduct effective oversight of the FMI.
  - Board of directors: Ensure that the board of directors has a member with appropriate skills and knowledge to understand and manage cyber risks. Ensure regular training of the Board on cyber resilience matters.
- Identification
  - Concentration risk: The FMI should maintain a specific database of third-party service providers of systemically important financial entities and FMIs, and conduct analysis to identify critical third-party service providers and determine whether there is concentration risk in the financial system.
- Protection
  - Attack surface documentation: Document a comprehensive attack surface for the FMI and critical systems, covering business operations, IT systems, infrastructure, people, and interconnections.
- Detection
  - SOC operational hours: Enhance 24/7 Security Operations Center operations to cover all perimeters, internal systems, and applications after business hours.
- Response and recovery
  - Cyberattack scenarios in FMI business continuity plan: Continue upgrading FMI business continuity plan with a range of cyber-specific extreme-but-plausible scenarios that are regularly tested.
- Testing
  - Testing with participants and FMI links: Consider conducting cyber exercises or simulations (for example, tabletop exercises) for FMIs with relevant parties (for example, FMI participants and other FMI links) to strengthen the responses to potential cyber incidents that could have material impacts on broader payment and settlement systems.
  - Penetration testing: Expedite penetration testing on FMIs and all critical systems and network infrastructure more regularly and after significant system changes.
  - Cyber stress testing: Conduct cyber stress tests to make quantitative assessments of the impact of cyberattacks on systemically important FIs and FMIs, business continuity arrangements, and financial stability.
- Situational awareness
  - Information sharing: Establish formal information-sharing arrangement between financial authorities, the cybersecurity agency, and FMI participants.
- Learning and evolving
  - Cyber resilience metrics: Develop cyber resilience metrics for FMIs to measure, track, and improve their cyber resilience posture.
  - Benchmarking: Strengthen supervisory and oversight expectations of bank and FMI response and recovery by using metrics for cyber resilience benchmarking, including recovery time objectives for critical functions such as payment, clearing, custody, and settlement.
- Source: IMF.

### Key recommendations from Table 5: Strengthening FMI supervision and oversight (by authorities’ responsibility)
- Responsibility A (Regulation, supervision, and oversight of FMIs)
  - FMI oversight: Strengthen the oversight approach on cyber resilience for FMI.
  - FMI oversight: Supplement the CPMI-IOSCO guidance with more detailed expectations on cyber risk oversight of FMIs.
  - FMI supervision: Increase offsite and onsite supervision of FMIs.
- Responsibility B (Regulatory, supervisory, and oversight powers and resources)
  - Resources: Further increase/enhance the skills and expertise of FMI overseers regarding cyber to address the changing cyber threat landscape surrounding the overseen FMIs.
  - Oversight powers: FMI authority should develop and issue regulatory requirements, based on the CPMI-IOSCO guidance and its cyber strategy, for the FMIs under its oversight mandate.
- Responsibility D (Application of the principles for FMIs)
  - Consistent application: Monitor the observance of the CPMI-IOSCO Guidance on Cyber Resilience by all systemically important FMIs to ensure ongoing efforts to adapt, evolve, and improve cyber resilience.
- Responsibility E (Cooperation with other authorities)
  - Authorities’ cooperation: Enhance coordination and cooperation to strengthen supervisory and oversight approach on cyber for commonly supervised/overseen FMIs.
- Source: IMF.

### Conclusions: supervisory and regulatory priorities
- The IMF’s cyber risk work program, in effect since 2017, has assisted IMF members in strengthening the operational and cyber resilience of financial systems.
- Key elements of the IMF cyber risk work program include FSAP cyber risk regulation and supervision assessments and TA on a wide range of topics, such as developing cyber strategies, cyber risk regulations, incident reporting frameworks, and testing frameworks; conducting cyber simulations and exercises; reviewing the cybersecurity of central banks; and building capacity and expertise of cyber risk supervisors.
- Effective regulatory frameworks are tiered, featuring mandatory requirements that can be enforced using the supervisor’s legal powers, complemented by guidance that reflects desirable outcomes but is not enforceable.
- A deliberate and structured approach to regulation development helps deliver a set of effective and internally consistent cyber-risk-management requirements. Key elements are:
  - (1) a unified regulation that encompasses all technology risk areas instead of separate ICT and cyber risk regulations;
  - (2) outcome-driven and technology-agnostic expectations;
  - (3) application of proportionality; and
  - (4) balancing a principles-based approach with prescriptiveness, based on the maturity of risk-management practices of FIs and FMIs.
- Cyber risk regulatory expectations that effectively facilitate risk mitigation are usually structured according to a risk and control taxonomy that is easy to map to an internationally accepted standard. However, verbatim adoption of one is not necessary and can be counterproductive.
- In supervision, the presence and thoroughness of the supervisor is probably the most consequential factor in improving cybersecurity stance—appropriate presence and thoroughness can compensate for weak regulation, and deficiencies in this area can make strong regulation with strict requirements largely ineffective.
- Going forward, the lion’s share of the improvement effort should be spent on practices—that is, skills, people, and processes.
- Assuming that the basic elements are covered, implementing or improving specific expectations should focus on cybersecurity testing, crisis simulation exercises, and third-party risk management.
  - Supervisors should avoid conducting cybersecurity tests themselves and instead take an oversight role.
  - Requiring TLPT should be considered in a proportional manner.
  - It is not advisable to collect full technical details of the vulnerabilities and exploits used to breach FIs and FMIs. Key aspects to focus on are adherence to the established testing framework, risk management of the process, remediation, and follow-up.
  - Authorities should promote and drive cyber simulation exercises, especially those with broad sectoral participation. Expectations need not be mandatory initially, but the trend is toward requiring systemic FIs and FMIs to regularly participate in such exercises.
  - Although authorities should take a more active role in exercises compared with cybersecurity tests, the focus areas—adhering to an established framework, remediation, and follow-up—are largely similar.
  - The risks posed by the extraordinary growth and reliance on third-party technology services should prompt jurisdictions to bring critical providers under a cyber risk oversight framework.

*Source: IMF departmental paper excerpt, "Box 2. Supervision versus Oversight: Key Differences."*

---


_Source: https://www.imf.org/-/media/files/publications/dp/2026/english/gpcrrsea.pdf_