Iceland: Financial Sector Assessment Program-Technical Note on Cyber and Operational Resilience, Supervision and Oversight
IMF Staff Country Reports, July 28, 2023
Source details
- Canonical URL
- Iceland: Financial Sector Assessment Program-Technical Note on Cyber and Operational Resilience, Supervision and Oversight
Other formats
Bibliographic details
- Published: July 28, 2023
- Series: IMF Staff Country Reports
- DOI: https://doi.org/10.5089/9798400249860.002
Overview
- Publication date: July 28, 2023
- Focus: cyber and operational resilience, supervision and oversight in Iceland’s financial sector.
- Context: The Icelandic financial sector has not experienced seriously disruptive cyber-attacks or operational issues in recent years, but threats are growing.
Key findings
- Iceland’s dependence on international connectivity for both debit and credit card systems introduces a significant vulnerability into the payment system.
- There is no dedicated cyber security strategy for the finance sector.
- Operational risk experts in the Central Bank of Iceland (CBI) are experienced and well regarded by financial institutions, but more resources are needed to provide adequate coverage of this increasingly important area.
- Supervision of financial institutions’ cybersecurity is highly dependent on self-assessments by the regulated entities and independent reviews carried out by third parties.
Identified vulnerabilities and gaps
- Significant single-point vulnerability: international connectivity for card systems (debit and credit).
- Absence of a sector-specific cyber security strategy for finance.
- Resource constraints at the Central Bank of Iceland (CBI) limiting supervision coverage.
- Reliance on regulated entities’ self-assessments and third-party reviews for cybersecurity supervision.
Supervision, oversight, and operational practices
- CBI operational risk experts are experienced and well regarded by financial institutions.
- Current supervisory approach places considerable weight on self-assessment and external independent reviews.
- The note recommends regular internal processes and reporting to oversight bodies:
- CBI should regularly revise the list of critical operations and critical service providers for internal use and for presentation to the Financial Stability Committee and Financial Stability Council.
- CBI is encouraged to enhance its incident dashboard by summarizing cyber incidents and examining trends.
Policy recommendations (summarized)
- Develop and adopt a dedicated cyber security strategy for the finance sector.
- Increase resources at CBI to provide adequate coverage of cyber and operational risk supervision.
- Reduce overreliance on self-assessments by regulated entities; strengthen supervisory testing and independent verification.
- Regularly revise and maintain lists of critical operations and critical service providers for internal use and for presentation to the Financial Stability Committee and Financial Stability Council.
- Enhance incident monitoring and reporting:
- Improve the incident dashboard to summarize cyber incidents and examine trends.
Content in this bundle
- 1islea2023007 - Executive Summary