## Preface — IMF Technical Assistance Report (June 24 - 28, 2024 mission to the National Bank of Georgia)

## Source details

**Canonical URL:** [Preface — IMF Technical Assistance Report (June 24 - 28, 2024 mission to the National Bank of Georgia)](https://www.imf.org/-/media/files/publications/tar/2024/english/tarea2024107-print-pdf.pdf)

## Other formats

- [Markdown version](/-/media/files/publications/tar/2024/english/tarea2024107-print-pdf.pdf.md)
- [Structured JSON version](/-/media/files/publications/tar/2024/english/tarea2024107-print-pdf.pdf.json)

---

### Mission scope and meetings
- At the request of the National Bank of Georgia (NBG), a Monetary and Capital Markets (MCM) Department technical assistance (TA) mission visited Tbilisi, Georgia during June 24 - 28, 2024.
- Mission focus:
  - an assessment of NBG’s cyber risk regulation;
  - an assessment of cyber risk supervisory arrangements of NBG;
  - assisting in the development of a cyber testing framework;
  - assisting in the development of a methodology for cyber exercising and stress testing.
- Meetings held with:
  - Aleksandre Ergeshidze, Head, Specialized Risks Department;
  - Nanuli Chkhaidze, Head of Cyber Risk Supervision Division and her team;
  - other NBG departments; select banks; representatives of the Banking Association of Georgia.
- Report presents the mission’s assessment and main conclusions.

### Executive summary — key findings
- Structure of financial sector:
  - Georgia’s financial sector is bank-dominated; banks account for 96% of the financial sector assets.
  - Three domestic – systemically important banks (DSIBs) account for the major portion of the assets.
- Legal and institutional cybersecurity arrangements:
  - Information Security Act (ISA) amended in 2021 grouping CISS into three categories (Tier 1, Tier 2, Tier 3).
  - LEPL Operating Technical Agency (OTA) responsible for Tier 1 and Tier 2; LEPL Digital Governance Agency (DGA) responsible for Tier 3.
  - Georgia CERT, under the DGA, is responsible for responding to cyber incidents, gathering threat intelligence, and increasing cybersecurity preparedness among all CISSs.
- Progress since FSAP:
  - NBG amended the law, introduced cyber incident reporting, and issued cloud outsourcing guideline in line with recent FSAP recommendations.
- Gaps and challenges:
  - NBG has not formulated a financial sector focused cybersecurity strategy.
  - Cyber risk regulation does not cover ICT aspects and has gaps regarding governance, risk management and testing arrangements.
  - Cyber risk regulations and incident reporting exist, but information sharing practices and incident classification require further clarification.
  - Cyber testing and exercises lack coverage on vulnerability scans, testing arrangements, remediation, and breadth of supervisory testing.
  - Overlap of responsibilities: NBG is identified as a CISS under Category I and also recommends CISS within financial sector to DGA under Category III, creating overlap between NBG (prudential supervisor) and DGA.
  - DGA’s regulatory expectations are based on ISO 27000 family of Standards; NBG regulation is based on the NIST framework — this divergence poses compliance challenges for DSIBs.
  - Smaller banks face resource constraints in implementing cybersecurity risk management regulation.

### Background and regulatory context
- National Cybersecurity Strategy:
  - Third strategy covers the years 2021-24 and has four goals and ten objectives (summarized in Table 1).
- NBG responsibilities and CISS designation:
  - NBG identified three DSIBs as Category III so far; DGA designated as responsible agency for Category III (CIIIs).
- Existing NBG regulatory instruments (selected):
  - Operational Risk Management Guideline (ORMG), issued in 2014.
  - Cybersecurity Management Framework of Commercial Banks — Regulation — Approved by Decree N. 56/04 of March 22, 2019.
  - Regulation on Cybersecurity Management Framework of Commercial Banks, 2019.
  - Rules for exchanging information about operational risk events, issued June 2023.
  - Guideline for the Use of the Cloud Outsourcing Services by the Financial Organizations (Cloud guidelines), issued August 2023.
  - Audit Manual for Information Systems and Cyber Security Management Framework in Commercial Banks, issued May 2022.
  - 2023: cyber risk management framework regulation and audit manual issued to micro banks.
- Applicability:
  - Cyber risk regulation currently applies only to commercial banks and micro banks; other supervised entities are not covered.
- Need to align with international standards:
  - Taking into account recent updates of the NIST cybersecurity framework, ISO 27001:2022 and DORA, update of existing regulation is important.
  - Recommendation to convert cyber risk management regulation into a technology risk management guideline addressing both ICT and cyber risk.

### FSAP observations and actions taken (summary)
- FSAP observation: NBG role in declaring CIII should be articulated in law amendments.
  - Action taken: law amended; NBG given powers to identify CIII within the financial sector.
- FSAP observation: strengthen offsite framework and automate compliance monitoring given limited staff resources.
  - Action taken: initiatives to automate incident reporting and information sharing; cyber incident reporting framework in place with two report types (detailed report on major incidents and a summary report covering all incidents); other off-site supervision activities are limited.
- FSAP observation: articulate information/cybersecurity baselines for cloud use (including hosting core banking systems).
  - Action taken: Cloud outsourcing guideline issued.
- FSAP observation: enhance frequency and sophistication of cyber preparedness testing and develop a testing framework strategy.
  - Action taken: Current TA (this mission) to address this.
- FSAP observation: rotating external auditors and periodic review of audit report quality would enhance utility.
  - Action taken: Information systems and cybersecurity management audit guideline for commercial banks issued in 2022.

### Supervision and resourcing findings
- Cyber risk supervision practices need improvements and clearer supervisory priorities.
- Staffing and structure:
  - Banking supervision vertical function staff compliment: 32, with a potential to increase it to 40 eventually.
  - Horizontal specialized risks department staff compliment: about 30.
  - Cyber risk supervision unit currently has four staff members.
  - Unit scheduled to conduct one onsite examination this year.
  - About 30% of the unit’s time is spent on product reviews and approvals/no objection.
- Unit responsibilities:
  - One resource dedicated to managing cyber incident reporting.
  - One resource primarily focused on keeping the registry of products and analyzing submitted products.
  - Governance and risk management aspects generally handled by the unit head.
  - All the D-SIBs fall under responsibility of the unit head.
- Examination and QA:
  - Onsite examinations planned in agreement with vertical function; questionnaire issued about six weeks prior to examination.
  - Onsite visits typically for a week with all four members participating.
  - Examinations are joint with operational risk division; reports contain two sections (operational risk and cyber risk).
  - Quality assurance of examination reports is handled by the same team and lacks independent review.
  - There is no supervisory manual; assessments rely on individual experience and collective wisdom.
- Governance reporting:
  - Financial Sector Supervisory Committee (FSSC) headed by the Governor and the Vice Governor; departmental heads are members.
  - The Board of the NBG does not directly get involved in Banking Supervision per legal mandate.
  - No standard cyber agenda items or reports covering threat landscape, major incidents, progress in implementing the regulation, major supervisory findings and cyber awareness go to senior management.
- Integration and metrics:
  - Cyber risk assessment integrated with overall risk assessment through General Risk Assessment Program (GRAPE) framework.
  - Operational risk and cyber risk together are given a weight of 5%.
- Offsite supervision and suptech:
  - Offsite information collected includes one off collection of cybersecurity strategies, cloud outsourcing compliance data, pen test reports, audit reports, product review information and inputs from operational risk division.
  - ISAC portal exists for reporting cyber and operational incidents from commercial and digital banks.
  - MISP is in testing mode where systemic banks share technical details about cyber threats.
  - Unit does not collect key risk indicators or gap assessments referenced to regulations and does not have dashboards or digital risk profiles.
  - Incident reports are facilitated by the Fintech unit using a Suptech solution primarily leveraging Tableau for visualization.

### Testing, exercises and information sharing — assessment
- Regulatory testing requirements (Article 8):
  - (i) management obliged to regularly check efficiency of the organization's cyber security / information security program,
  - (ii) annual self-assessment of cyber security,
  - (iii) banks shall conduct a penetration test at least once a year, which includes all the information systems of the bank that are connected to the network,
  - (iv) annual independent audit of all components of the Bank's Cyber Security Management Framework. The information security audit must include risks associated with confidentiality, integrity and availability of systems.
- PT and audit handling:
  - PT reports and Audit reports reviewed by cyber risk supervision team; critical findings are followed up with the banks.
  - Two staff dedicated to reviewing PT and Audit reports focusing significantly on technical aspects.
- Exercises:
  - NBG usually does not conduct cyber exercises but has coordinated exercises with local or foreign agencies.
  - Recent coordinated exercise involved Banking association, NBG, commercial banks and DGA organized by USAID CIDR program.
  - Five years ago the World Bank organized an exercise for the NBG and commercial banks.
  - Bankers Association conducts cyber exercises periodically.
  - DSIBs conduct red team testing periodically but note limited accredited testers in Georgia; DGA requires testers to be accredited.
  - Smaller banks are not yet ready for advanced testing frameworks.
- Information sharing:
  - Three DSIBs have access to MISP platform; smaller banks do not.
  - Threat intelligence and DGA inputs available only for the three largest banks.
  - Three DSIBs share information among themselves but reluctant to share with other banks due to concerns about reciprocity and costs.
  - CISO forum is not active.
  - DGA runs a Public-Private Partnership (PPP) platform; Banking Association runs forums and has trust of member banks to run CISO forums or other information sharing initiatives.
- Incident reporting template:
  - NBG prescribes a reporting template and expects banks to define the category of incidents themselves.
  - Template compares well with industry best practices but allowing banks to categorize incidents gives discretion and potential inconsistent classifications across banks.
  - Banks suggested that clear definitions by the NBG could help.

### Annex I — Comparison of NBG regulation vs Model Regulation (high-level gaps)
- Governance and Board expectations:
  - Missing: clear expectation from the Board and senior management including requisite experience, appointment of CIO/CISO, IT/Cyber strategy, risk tolerance / risk appetite, tone from the top and culture, accountability and responsibility, resources / financial / human / technical, training and awareness, review, independent audit, promptly informing the Board.
- Policies, standards, procedures:
  - Present: Cybersecurity framework aligned broadly with NIST identification, Protection, Detection, Response and Recovery.
  - Gaps: Revised NIST framework’s governance focus yet to be reflected; risk identification’s people aspects not in focus; need for periodic inventory review and software license tracking.
- Third party management and procurement:
  - Covered: Identification – Management.
  - Missing: No mention about list of third parties; exit strategy not mentioned.
- Competence, training, and budgeting:
  - Gaps: Job descriptions, background checking not clearly articulated; Board level training or awareness not explicitly mentioned; separate cybersecurity budget not clearly articulated.
- Audit and assurance:
  - Mention: Independent audit annually (Article 8).
  - Gap: Need for internal audit function that is qualified and trained; high risk observations to be reported to the Board.
- Technology, IT service management, and operations:
  - Gaps: SDLC, secure development, secure coding, devsecops, APIs not covered; recommendation to include in cyber risk or IT risk guidelines.
  - Missing/limited: IT service management framework, technology refresh management, patch management, change management, secured disposal.
- IAM and network:
  - Covered: Article 4 – Access control; least privilege under ‘protective technologies’.
  - Gaps: User access reviews and privileged access policy elements missing; network segregation present but could be improved; no explicit mention of firewall, NAD, isolating web browsing from endpoints, DDoS protection.
- Cloud and virtualization:
  - Separate cloud guidelines exist; scope for inclusion of virtualization security management in regulation.
- Operations, incident response, recovery:
  - Covered: cyber threat intelligence and information sharing (Article 3), cyber event monitoring and detection (Article 5), incident response and restoration (Article 6 and Article 7).
  - Gaps: Testing DR not explicitly covered; data center not covered; resilience emphasis recommended.
- Scanning, testing, exercising, and remediation:
  - Vulnerability scan: No mention; identified as important.
  - Penetration testing: Article 8 – once a year; can be elaborated.
  - Incident response exercises: Article 6 – e; scope for improvement and elaboration.
  - Remediation management: Not covered in detail; identified as important.

### Annex II — Extant regulations — selected items (highlights)
- Cybersecurity Management Framework of Commercial Banks — Regulation — Approved by Decree N. 56/04 of March 22, 2019.
- Information systems and cybersecurity management audit guideline for commercial banks — Regulation — Approved by the decree No48/04 May 2, 2022.
- Guideline for the Use of the Cloud Outsourcing Services by the Financial Organizations — Regulation — Order N195/04 of the President of the National Bank of Georgia August 1, 2023.
- Cybersecurity management framework for microbanks — Regulation — Order No165/04 of the Acting president of NBG June 30, 2023.
- The information sharing requirements for operational risk events — Regulation — Order No139/04 of the Acting President of NBG, 26 June, 2023.
- Incident form 1 — Template — Annex of the Order No139/04 of the Acting President of NBG, 26 June, 2023 (immediate reporting: send relevant information per email within the 24 hours; the indicated form should be filled in within one week; upload on ISAC portal).
- Incident form CSSFID-BBB-QQ-YYYYMMDD — Template — Serves for all incidents including the immediate ones.
- Registry of cybersecurity requirements for digital banks — Registry of requirements — Not approved in form of the official framework.
- Rule on Inclusion in Open Banking — Regulation — Order No80/04 by President of NBG, 3 May, 2023.
- Cybersecurity checklist for nonbanking financial institutions — Checklist — Not approved, need to be agreed with the nonbanking supervision department.
- Cybersecurity inspection checklist — Checklist — Not approved.
- IS Questionnaire for new and changed products — Checklist — Not approved, but agreed with banks, obligatory from 1st of January 2024.

### Recommendations (selected — preserved verbatim numbering, reference and priority)
- 1.1 Develop a financial sector focused cybersecurity strategy incorporating key elements with an outlook for 3 to 5 years — Paragraph 14 — Priority: MT
- 1.2 Revise and update the cyber risk management regulation by addressing gaps and converting it into a technology risk management guideline — Paragraph 15 — Priority: MT
- 1.3 Consult the industry before finalizing the regulation — Paragraph 16 — Priority: NT
- 1.4 Require a gap assessment within six months of issuing the regulation along with a road map for implementation with milestones and timelines — Paragraph 16 — Priority: MT
- 1.5 Provide a differentiated timeline for full implementation by prioritizing implementation among top 3 banks followed by longer timeline for other banks — Paragraph 16 — Priority: NT
- 1.6 Sensitize the Board and the senior management of banks by conducting outreach programs to explain the rationale, expectations and provisions of the revised regulation — Paragraph 17 — Priority: MT
- 1.7 Develop a supervisory manual based on the Toolkit shared and aligned with the proposed regulation — Paragraph 28 — Priority: MT
- 1.8 Review the activities carried out by the cyber risk supervision team and streamline the processes to ensure primacy for supervision activities — Paragraph 27 — Priority: NT
- 1.9 Augment the compliment of staff in the cyber risk supervision team by inducting two to three generalist supervisors with exposure on assessing governance and risk management aspects — Paragraph 25 — Priority: NT
- 1.10 Ensure independent quality assurance of supervisory reports before its finalization — Paragraph 25 — Priority: NT
- 1.11 Expand the scope of supervision activities in alignment with the revised regulation and ensuring the same team assess ICT and Cyber risks — Paragraph 27 — Priority: MT
- 1.12 Constitute a small working group drawing members from supervisory policy department to develop the new regulation and comprehensive testing framework — Paragraph 26 — Priority: NT
- 1.13 Consider setting up a Standing Committee on Cyber to better harness cybersecurity skills available within the NBG — Paragraph 26 — Priority: MT
- 2.1 Develop a comprehensive testing framework with a suite of possible tests, scenarios, processes, and expected outcomes that could be applied proportionally — Paragraph 38 — Priority: MT
- 2.2 Encourage the financial sector to voluntarily share information among themselves by leveraging the PPP working group and / or the Banking Association — Paragraph 39 — Priority: NT
- 2.3 Collaborate with the industry to develop information sharing protocols and frameworks and play a catalyst role — Paragraph 39 — Priority: MT
- 2.4 Strengthen the cyber incident reporting framework by clearly defining severity of incidents and incorporating the recommendations of the cyber incident reporting framework — Paragraph 40 — Priority: NT

*IMF Technical Assistance Report — Preface (June 24 - 28, 2024 mission to the National Bank of Georgia)*

### Preface ................................................................................................................

### Preface

### Mission scope and meetings
- At the request of the National Bank of Georgia (NBG), a Monetary and Capital Markets (MCM) Department technical assistance (TA) mission visited Tbilisi, Georgia during June 24 - 28, 2024.
- The mission focused on:
  - an assessment of NBG’s cyber risk regulation;
  - an assessment of cyber risk supervisory arrangements of NBG;
  - assisting in the development of a cyber testing framework;
  - assisting in the development of a methodology for cyber exercising and stress testing.
- The mission met with Aleksandre Ergeshidze, Head, Specialized Risks Department; Nanuli Chkhaidze, Head of Cyber Risk Supervision Division and her team; other departments within the NBG; select banks; and representatives of the Banking Association of Georgia.
- The report presents the mission’s assessment and main conclusions.

### Executive summary — key findings
- Georgia’s financial sector is bank-dominated; banks account for 96% of the financial sector assets.
- Three domestic – systemically important banks (DSIBs) account for the major portion of the assets.
- Legal and institutional cybersecurity arrangements:
  - Information Security Act (ISA) amended in 2021 grouping CISS into three categories (Tier 1, Tier 2, Tier 3).
  - LEPL Operating Technical Agency (OTA) responsible for Tier 1 and Tier 2; LEPL Digital Governance Agency (DGA) responsible for Tier 3.
  - Georgia CERT, under the DGA, is responsible for responding to cyber incidents, gathering threat intelligence, and increasing cybersecurity preparedness among all CISSs.
- Progress since FSAP:
  - NBG amended the law, introduced cyber incident reporting, and issued cloud outsourcing guideline in line with recent FSAP recommendations.
- Gaps and challenges:
  - NBG has not formulated a financial sector focused cybersecurity strategy.
  - Cyber risk regulation does not cover ICT aspects and has gaps regarding governance, risk management and testing arrangements.
  - Cyber risk regulations and incident reporting exist, but information sharing practices and incident classification require further clarification.
  - Cyber testing and exercises lack coverage on vulnerability scans, testing arrangements, remediation, and breadth of supervisory testing.
  - Overlap of responsibilities: NBG is identified as a CISS under Category I and also recommends CISS within financial sector to DGA under Category III, creating overlap between NBG (prudential supervisor) and DGA.
  - DGA’s regulatory expectations are based on ISO 27000 family of Standards; NBG regulation is based on the NIST framework — this divergence poses compliance challenges for DSIBs.
  - Smaller banks face resource constraints in implementing cybersecurity risk management regulation.

### Background and regulatory context
- National Cybersecurity Strategy: the third strategy covers the years 2021-24 and has four goals and ten objectives (summarized in Table 1).
- NBG responsibilities and CISS designation:
  - NBG identified three DSIBs as Category III so far; DGA designated as responsible agency for Category III (CIIIs).
- Existing NBG regulatory instruments:
  - Regulation of the National Bank of Georgia on the Management of Operational Risks at Commercial Banks (Operational Risk Management Guideline or ORMG), issued in 2014.
  - Regulation of the National Bank of Georgia on Cybersecurity Management Framework of Commercial Banks, issued in 2019.
  - Rules for exchanging information about operational risk events, issued in June 2023.
  - Guideline for the Use of the Cloud Outsourcing Services by the Financial Organizations (Cloud guidelines), issued in August 2023.
  - Audit Manual for Information Systems and Cyber Security Management Framework in Commercial Banks, issued in May 2022.
  - In 2023, cyber risk management framework regulation and audit manual were issued to micro banks.
- Applicability:
  - Cyber risk regulation currently applies only to commercial banks and micro banks; other supervised entities are not covered by the scope of application.
- Need to align with international standards:
  - Taking into account recent updates of the NIST cybersecurity framework, ISO 27001:2022 and DORA, update of existing regulation is important.
  - Recommendation to convert cyber risk management regulation into a technology risk management guideline addressing both ICT and cyber risk.

### FSAP observations and actions taken (summary)
- FSAP observation: NBG role in declaring CIII should be articulated in law amendments.
  - Action taken: the law has been amended; NBG given powers to identify CIII within the financial sector.
- FSAP observation: strengthen offsite framework and automate compliance monitoring given limited staff resources.
  - Action taken: initiatives to automate incident reporting and information sharing; cyber incident reporting framework in place with two report types (detailed report on major incidents and a summary report covering all incidents); other off-site supervision activities are limited.
- FSAP observation: articulate information/cybersecurity baselines for cloud use (including hosting core banking systems).
  - Action taken: Cloud outsourcing guideline issued.
- FSAP observation: enhance frequency and sophistication of cyber preparedness testing and develop a testing framework strategy.
  - Action taken: Current TA (this mission) is to address this.
- FSAP observation: rotating external auditors and periodic review of audit report quality would enhance utility.
  - Action taken: Information systems and cybersecurity management audit guideline for commercial banks issued in 2022.

### Supervision and resourcing findings
- Cyber risk supervision practices need improvements and clearer supervisory priorities.
- The cyber risk supervision team should be augmented with 2 to 3 additional staff to strengthen supervisory effectiveness.
- Developing a supervisory manual is a priority to achieve consistent outcomes from onsite examinations.
- Offsite supervision activities need strengthening and greater use of technology.
- Forming a working group including supervisory policy department would help develop regulations.
- Consider establishing a Standing Committee on Cyber to harness cybersecurity skills within the NBG.

### Testing, exercises and information sharing
- Information sharing within the financial sector requires strengthening and systematic processes.
  - Existing arrangements within the DGA or the Banking Association could be leveraged to promote public private partnership (PPP).
- Incident reporting requires clearer regulatory classification of incident severity to ensure consistent outcomes.
- Cyber testing and exercises require significant improvements; current regulatory and supervisory testing requirements lack coverage on vulnerability scans, testing arrangements, remediation, and proportional application across banks.
- Development of a comprehensive testing framework will strengthen cyber preparedness, taking into account varying preparedness and resources among banks.

### Recommendations (selected — preserved verbatim numbering, reference and priority)
- 1.1 Develop a financial sector focused cybersecurity strategy incorporating key elements with an outlook for 3 to 5 years — Paragraph 14 — Priority: MT
- 1.2 Revise and update the cyber risk management regulation by addressing gaps and converting it into a technology risk management guideline — Paragraph 15 — Priority: MT
- 1.3 Consult the industry before finalizing the regulation — Paragraph 16 — Priority: NT
- 1.4 Require a gap assessment within six months of issuing the regulation along with a road map for implementation with milestones and timelines — Paragraph 16 — Priority: MT
- 1.5 Provide a differentiated timeline for full implementation by prioritizing implementation among top 3 banks followed by longer timeline for other banks — Paragraph 16 — Priority: NT
- 1.6 Sensitize the Board and the senior management of banks by conducting outreach programs to explain the rationale, expectations and provisions of the revised regulation — Paragraph 17 — Priority: MT
- 1.7 Develop a supervisory manual based on the Toolkit shared and aligned with the proposed regulation — Paragraph 28 — Priority: MT
- 1.8 Review the activities carried out by the cyber risk supervision team and streamline the processes to ensure primacy for supervision activities — Paragraph 27 — Priority: NT
- 1.9 Augment the compliment of staff in the cyber risk supervision team by inducting two to three generalist supervisors with exposure on assessing governance and risk management aspects — Paragraph 25 — Priority: NT
- 1.10 Ensure independent quality assurance of supervisory reports before its finalization — Paragraph 25 — Priority: NT
- 1.11 Expand the scope of supervision activities in alignment with the revised regulation and ensuring the same team assess ICT and Cyber risks — Paragraph 27 — Priority: MT
- 1.12 Constitute a small working group drawing members from supervisory policy department to develop the new regulation and comprehensive testing framework — Paragraph 26 — Priority: NT
- 1.13 Consider setting up a Standing Committee on Cyber to better harness cybersecurity skills available within the NBG — Paragraph 26 — Priority: MT
- 2.1 Develop a comprehensive testing framework with a suite of possible tests, scenarios, processes, and expected outcomes that could be applied proportionally — Paragraph 38 — Priority: MT
- 2.2 Encourage the financial sector to voluntarily share information among themselves by leveraging the PPP working group and / or the Banking Association — Paragraph 39 — Priority: NT
- 2.3 Collaborate with the industry to develop information sharing protocols and frameworks and play a catalyst role — Paragraph 39 — Priority: MT
- 2.4 Strengthen the cyber incident reporting framework by clearly defining severity of incidents and incorporating the recommendations of the cyber incident reporting framework — Paragraph 40 — Priority: NT

*IMF Technical Assistance Report — Preface (June 24 - 28, 2024 mission to the National Bank of Georgia)*

### 12.      The NBG should develop a well-articulated cybersecurity strategy for the financial sector.

### 12.      The NBG should develop a well-articulated cybersecurity strategy for the financial sector.

### Rationale for a financial-sector focused strategy
- The National Cybersecurity Strategy issued by the Government prioritizes a set of actions for the country as a whole.
- The role of the NBG in implementing the action plans under the strategy is rather limited and mostly in the capacity of a partner.
- A financial sector focused cybersecurity strategy could help articulate the goals and objectives of the NBG for the next three to five years and might provide a clear direction to the financial sector.
- The mission recommends development of a financial sector cybersecurity strategy considering key components of a robust cybersecurity framework, duly approved by the top management of the NBG.

### Gaps motivating near-term regulatory action
- The extant regulation:
  - does not address ICT issues in detail,
  - contains gaps regarding cybersecurity aspects,
  - leverages NIST standards which poses compliance challenges for supervised entities given the DGA’s regulatory expectations based on ISO standards.
- Governance and risk management components in the regulation need to improve.
- Although the extant regulation does not specify that all financial institutions are subject to a cybersecurity management framework, the NBG does “indirectly” supervise them in terms of online identification and verification of clients, implementation of which must be agreed with NBG.
- Minimal security requirements are imposed when an institution requests to join open banking.

### Industry engagement and differentiated implementation
- The NBG needs to consult the financial sector while finalizing the revised regulation to:
  - provide the industry an opportunity to provide insights,
  - gain industry commitment.
- Levels of preparedness differ significantly between large banks and smaller banks/ non-banks, marked by resource constraints.
- Good practice recommended: require a gap assessment from financial sector participants along with a road map for full implementation with milestones and timelines.
- The NBG should provide differentiated timelines for gap assessments and full implementation based on size, complexity, interconnectedness, and systemic relevance.

### Board and senior management engagement
- Cyber risk has become critical for the financial sector and Boards and senior management need to play an active role in its management.
- The NBG has a role in sensitizing Boards of supervised entities.
- Recommendation: conduct outreach programs to explain rationale, expectations, and provisions of the revised regulation immediately after its finalization to promote active Board engagement.

### C. Cyber Risk Supervision — Assessment (summary of key facts)
- Supervisory strategy:
  - Current strategy is for 2023-25.
  - The NBG has identified five high level strategic priorities for 2023-25 (Table 3):
    1. IMPROVEMENT OF FINANCIAL SECTOR RISK MANAGEMENT FRAMEWORK AND PROACTIVE RESPONSE TO OUTCOMES
    2. PROMOTION OF COMPETITION IN THE FINANCIAL SECTOR
    3. PROMOTION OF FINANCIAL INNOVATION AND DEVELOPMENT OF SUPERVISORY TECHNOLOGIES
    4. APPROXIMATION TO INTERNATIONAL STANDARDS
    5. STRENGTHENING THE SUPERVISORY FUNCTION OF THE NATIONAL BANK AND INCREASING TRANSPARENCY
- Organizational resourcing:
  - Banking supervision vertical function staff compliment: 32, with a potential to increase it to 40 eventually.
  - Horizontal specialized risks department staff compliment: about 30.
  - Cyber risk supervision unit currently has four staff members.
  - The unit is scheduled to conduct one onsite examination this year.
  - About 30% of the unit’s time is spent on product reviews and approvals/no objection.
- Unit responsibilities and allocation:
  - One resource dedicated to managing cyber incident reporting.
  - One resource primarily focused on keeping the registry of products and analyzing submitted products.
  - Governance and risk management aspects are generally handled by the unit head.
  - All the D-SIBs fall under responsibility of the unit head.
- Examination process:
  - Onsite examinations planned in agreement with vertical function; questionnaire issued about six weeks prior to examination.
  - Onsite visits typically for a week with all four members participating.
  - Examinations are joint with operational risk division; report contains two sections (operational risk and cyber risk).
  - Quality assurance of examination reports is handled by the same team and lacks independent review.
  - There is no supervisory manual; assessments rely on individual experience and collective wisdom.
- Governance reporting:
  - Financial Sector Supervisory Committee (FSSC) is headed by the Governor and the Vice Governor; departmental heads are members.
  - The Board of the NBG does not directly get involved in Banking Supervision per legal mandate.
  - No standard cyber agenda items or reports covering threat landscape, major incidents, progress in implementing the regulation, major supervisory findings and cyber awareness go to senior management; supervisory priorities are more bottom-up.
- Integration and metrics:
  - Cyber risk assessment is integrated with overall risk assessment through General Risk Assessment Program (GRAPE) framework.
  - Operational risk and cyber risk together are given a weight of 5%.
- Offsite supervision and suptech:
  - Current offsite information processed includes one off collection of cybersecurity strategies, cloud outsourcing compliance data, pen test reports, audit reports, product review information and inputs from operational risk division.
  - ISAC portal exists for reporting cyber and operational incidents from commercial and digital banks.
  - MISP is in testing mode where systemic banks share technical details about cyber threats.
  - The unit does not collect key risk indicators or gap assessments referenced to regulations and does not have dashboards or digital risk profiles.
  - Incident reports are facilitated by the Fintech unit using a Suptech solution primarily leveraging Tableau for visualization.

### C.2 Recommendations (supervision resourcing and processes)
- Augment the cyber risk supervision team by 2-3 extra staff members and induct two to three generalist supervisors with exposure to assessing governance and risk management aspects.
  - Rationale: Current complement is inadequate; Unit Head is overloaded with governance/risk assessments for all D-SIBs and policy/staff development tasks.
  - Strengthen quality assurance by ensuring independence of the function.
- Constitute a small working group with participation from the Supervisory Policy Department to assist in developing new regulation and testing frameworks.
- Consider constituting a Standing Committee on Cybersecurity with members from supervisory units, Payment System, Internal Security, IT, and Risk Management departments to discuss threat landscape, technological developments, supervisory tools, and policy approach.
- Review the team’s activities to ensure primacy of supervision activities; product approvals/no objection, licensing, and incident reporting currently consume significant supervisory attention.
- Develop a supervisory manual based on the Toolkit shared and align it with the proposed regulation to ensure supervisory consistency and provide guidance for new staff.

### II. Testing, Exercises and Stress Testing — D. Testing, Exercises, Information Sharing and Incident Reporting

D.1 Assessment — testing and reporting practices
- FSAP desk-based review recommended developing a testing framework: enhance frequency and sophistication for cyber preparedness testing exercises in the short term and develop a testing framework strategy in the medium term.
- Current regulation requirements (Article 8 of the cybersecurity framework regulation):
  - (i) management of the banks is obliged to regularly check the efficiency of the organization's cyber security / information security program,
  - (ii) the organization shall conduct annual self-assessment of cyber security,
  - (iii) the banks shall conduct a penetration test at least once a year, which includes all the information systems of the bank that are connected to the network, and
  - (iv) the commercial bank shall conduct an annual independent audit of all components of the Bank's Cyber Security Management Framework.
  - The information security audit must include risks associated with confidentiality, integrity and availability of systems.
- PT and audit report handling:
  - PT reports and Audit reports are reviewed by the cyber risk supervision team and critical findings are followed up with the banks.
  - Two staff are dedicated to reviewing PT and Audit reports focusing significantly on technical aspects.
- Exercises:
  - The NBG usually does not conduct cyber exercises but has coordinated exercises with local or foreign agencies.
  - Recent coordinated exercise involved Banking association, NBG, commercial banks and DGA organized by USAID CIDR program.
  - Five years ago the World Bank organized an exercise for the NBG and commercial banks.
  - Bankers Association conducts cyber exercises periodically.
  - DSIBs conduct red team testing periodically but note limited accredited testers in Georgia; DGA requires testers to be accredited.
  - Smaller banks are not yet ready for advanced testing frameworks.
- Mission activities:
  - The mission presented on ‘Testing and Exercising’, covering vulnerability scanning, penetration testing, scenario-based testing (market-wide, desktop, simulations and crisis management), and red team testing, including examples.
- Information sharing:
  - Three DSIBs have access to MISP platform; smaller banks do not.
  - Threat intelligence and DGA inputs are available only for the three largest banks.
  - Three DSIBs share information among themselves but are reluctant to share with other banks due to concerns about reciprocity and costs.
  - The CISO forum is not active in the jurisdiction.
  - DGA runs a Public-Private Partnership (PPP) platform with members able to contribute to strengthening cybersecurity.
  - Banking Association runs forums and has trust of member banks to run CISO forums or other information sharing initiatives.
- Incident reporting template:
  - NBG prescribes a reporting template and expects banks to define the category of incidents themselves.
  - The template compares well with industry best practices but allowing banks to categorize incidents gives discretion and potential inconsistent classifications across banks.
  - Banks suggested that clear definitions by the NBG could help.

*Source: tarea2024107-print-pdf - 12.      The NBG should develop a well-articulated cybersecurity strategy for the financial sector.*

### 38.      Current regulatory requirements on testing and exercises are limited and there is a need to

### 38.      Current regulatory requirements on testing and exercises are limited and there is a need to 

### Testing framework, proportionality, and capacity differences
- Finding: Current regulatory requirements on testing and exercises are limited.
- Recommendation: Develop a comprehensive testing framework with a suite of possible tests, scenarios, processes, and expected outcomes that could be applied proportionally.
- Rationale: Three DSIBs and rest of the banks differ in terms of financial, technical, and human resources; proportionality is a key element so banks can choose the right kind of tests and exercises to suit their needs.
- Stakeholder intent: The NBG and banks realize the importance of testing and exercises and are eager to strengthen the practices.

### Information sharing and NBG’s catalytic role
- Finding: Banks, the Banking Association and the DGA recognize the importance and challenges of information sharing; smaller banks are craving for such an initiative.
- Recommendation: The NBG should play a catalyst role in encouraging the financial sector to voluntarily share information by leveraging the PPP working group and/or the Banking Association.
- Operational step: The NBG needs to develop an information sharing protocol and, without directly participating, encourage regulated entities to voluntarily share information.

### Cyber incident reporting framework
- Finding: The incident reporting template is fit for purpose but classification issues remain.
- Recommendation: Strengthen the cyber incident reporting framework by clearly defining severity of incidents and incorporating the recommendations of the FSB’s cyber incident reporting framework.
- Expected outcome: Regulatory clarification on classification of incidents will improve the consistency of reporting by banks.

### Comparison of NBG regulation vs Model Regulation — governance and oversight (Annex I highlights)
- Authority and applicability:
  - Authority reference: Article 15 of the Organic Law.
  - Applicability: Commercial banks – both domestic and branches of commercial banks.
- Governance and Board expectations:
  - Model elements missing: Clear expectation from the Board and senior management including requisite experience, appointment of CIO/CISO, IT/Cyber strategy, risk tolerance / risk appetite, tone from the top and culture, accountability and responsibility, resources / financial / human / technical, training and awareness, review, independent audit, promptly informing the Board.
- Policies, standards, procedures:
  - Present: Cybersecurity framework aligned broadly with NIST identification, Protection, Detection, Response and Recovery.
  - Gaps: Revised NIST framework’s governance focus yet to be reflected; risk identification’s people aspects not in focus; need for periodic inventory review and software license tracking.
- Third party management and procurement:
  - Covered: Identification – Management.
  - Missing: No mention about list of third parties; exit strategy not mentioned.
- Competence, training, and budgeting:
  - Gaps: Job descriptions, background checking not clearly articulated; Board level training or awareness not explicitly mentioned; separate cybersecurity budget not clearly articulated.
- Audit and assurance:
  - Mention: Independent audit annually (Article 8).
  - Gap: Need for internal audit function that is qualified and trained; high risk observations to be reported to the Board.

### Technology, IT service management, and operations (Annex I highlights)
- Risk management:
  - Article references: Article 2 focuses on cyber risk framework; Article 3 and Article 6 provide partial coverage.
  - Gaps: Risk treatment, insurance, risk acceptance, metrics, frequency of monitoring and review not covered in detail.
- SDLC, secure development, and testing:
  - Finding: Project management, system acquisition, SDLC, SRA, system design and implementation, system testing and acceptance, secure coding, devsecops, APIs are not covered; recommendation to include in cyber risk or IT risk guidelines.
- IT service management and controls:
  - Missing or limited coverage: IT service management framework, documentation, technology refresh management, patch management, change management, secured disposal.
  - Present but improvable: Physical controls (Article 4 – Access Control); software management (Article 4 – data protection); configuration management (Article 4).
- Identity and Access Management (IAM) and network:
  - Covered: Article 4 – Access control; least privilege under ‘protective technologies’.
  - Gaps: User access reviews and privileged access policy elements missing; network segregation present but could be improved; no explicit mention of firewall, NAD, isolating web browsing from endpoints, DDoS protection.
- Cloud and virtualization:
  - Note: Separate cloud guidelines exist; scope for inclusion of virtualization security management in regulation.

### Cybersecurity operations, incident response, and recovery (Annex I highlights)
- Operations:
  - Cyber threat intelligence and information sharing: Covered under Article 3 – identification.
  - Cyber event monitoring and detection: Covered under Article 5 – discovery.
  - Cyber incident response, management and reporting: Covered under response (Article 6) and restoration (Article 7).
  - Incident reporting: NBG has incident reporting framework; incident reporting template exists.
- Response and recovery:
  - System availability: Shown as one of the audit priorities in Article 8; recommendation to emphasize resilience in regulation.
  - BCP/DR: BCP mentioned in Article 3 in connection with critical service delivery; Article 7 of the ORF regulation covers testing aspects but scope for improvement; testing DR not explicitly covered.
  - Backup and recovery: Mention in Article 4 – d (iv).
  - Data center: Not covered; identified as important.

### Scanning, testing, exercising, and remediation (Annex I highlights)
- Gaps and coverage:
  - Vulnerability scan: No mention; identified as important.
  - Penetration testing: Article 8 – once a year; can be elaborated.
  - Incident response exercises: Article 6 – e; scope for improvement and elaboration.
  - Remediation management: Not covered in detail; identified as important.

### Independent assurance and outsourcing (Annex I highlights)
- Independent assurance:
  - Technology risk audits: Annual independent audit – Article 8; NBG has a separate regulation on Audit.
- Outsourcing and vendor management:
  - Coverage: Some governance coverage across Article 3 and Article 4; ORF regulation Articles 8 and 9 discuss outsourcing in reasonable detail.
  - Gaps: Whether there is a separate outsourcing guideline needs further improvement; NBG’s power to audit vendors not mentioned in regulation; vendor competency covered in ORF regulation.
  - Cloud computing: NBG has a separate cloud outsourcing guidelines.

### Extant regulations — selected items (Annex II)
- Listing of extant instruments (name, type, description, approval date) includes:
  - Cybersecurity Management Framework of Commercial Banks — Regulation — Approved by Decree N. 56/04 of March 22, 2019.
  - Information systems and cybersecurity management audit guideline for commercial banks — Regulation — Approved by the decree No48/04 May 2, 2022.
  - Guideline for the Use of the Cloud Outsourcing Services by the Financial Organizations — Regulation — Order N195/04 of the President of the National Bank of Georgia August 1, 2023.
  - Cybersecurity management framework for microbanks — Regulation — Order No165/04 of the Acting president of NBG June 30, 2023.
  - The information sharing requirements for operational risk events — Regulation — Order No139/04 of the Acting President of NBG, 26 June, 2023.
  - Incident form 1 — Template — Annex of the Order No139/04 of the Acting President of NBG, 26 June, 2023 (immediate reporting: send relevant information per email within the 24 hours; the indicated form should be filled in within one week; upload on ISAC portal).
  - Incident form CSSFID-BBB-QQ-YYYYMMDD — Template — Serves for all incidents including the immediate ones.
  - Registry of cybersecurity requirements for digital banks — Registry of requirements — Not approved in form of the official framework.
  - Rule on Inclusion in Open Banking — Regulation — Order No80/04 by President of NBG, 3 May, 2023.
  - Cybersecurity checklist for nonbanking financial institutions — Checklist — Not approved, need to be agreed with the nonbanking supervision department.
  - Cybersecurity inspection checklist — Checklist — Not approved.
  - IS Questionnaire for new and changed products — Checklist — Not approved, but agreed with banks, obligatory from 1st of January 2024.

*IMF Technical Assistance Report | Annex – I and Annex – II content as provided in the source PDF*

---


_Source: https://www.imf.org/-/media/files/publications/tar/2024/english/tarea2024107-print-pdf.pdf_