{
  "title": "Sweden: Financial Sector Assessment Program–Technical Note on Cybersecurity Risk Supervision and Oversight",
  "publication": "IMF Staff Country Reports, April 5, 2023",
  "sourceUrl": "https://www.imf.org/en/publications/cr/issues/2023/04/05/sweden-financial-sector-assessment-programtechnical-note-on-cybersecurity-risk-supervision-531869",
  "canonical": "https://www.imf.org/en/publications/cr/issues/2023/04/05/sweden-financial-sector-assessment-programtechnical-note-on-cybersecurity-risk-supervision-531869",
  "overlayPath": "/en/publications/cr/issues/2023/04/05/sweden-financial-sector-assessment-programtechnical-note-on-cybersecurity-risk-supervision-531869/index.md",
  "summary": "This technical assistance report discusses Cybersecurity Risk Supervision and Oversight in Sweden. Sweden’s financial sector is highly digitized and interconnected, and the related technological developments heighten cyber threats and vulnerabilities.",
  "sections": [
    {
      "heading": "Executive summary and context",
      "content": "- The report discusses Cybersecurity Risk Supervision and Oversight in Sweden.\n- Sweden’s financial sector is described as highly digitized and interconnected, with technological developments that heighten cyber threats and vulnerabilities.\n- Sweden has multiple agencies engaged with cybersecurity, but roles and responsibilities regarding the cyber security of the financial sector need clarification.\n- Cyber incident reporting frameworks exist; limited information sharing arrangements exist, but financial institutions still desire more information on threats and incidents.\n- The report advises identifying and addressing barriers to information sharing between government agencies, the financial authorities, and the private sector.\n- Contingency plans and crisis protocols are recommended for large-scale cyber-attacks affecting the Swedish financial sector.\n- The financial sector is encouraged to engage with and help shape the activities of the National Cyber Security Centre."
    },
    {
      "heading": "Key findings",
      "content": "- Sweden is well-served with agencies engaged with cybersecurity, yet:\n  - Roles and responsibilities of each agency in respect to financial sector cybersecurity should be clarified.\n  - Barriers to sharing information should be resolved.\n- Cyber incident reporting frameworks are in place.\n- Information sharing is limited and there is appetite from financial institutions to receive more information on threats and incidents.\n- Contingency plans and crisis protocols for large-scale cyber-attacks are not sufficiently established."
    },
    {
      "heading": "Policy recommendations",
      "content": "- Clarify roles and responsibilities among agencies for financial sector cybersecurity.\n- Identify and address barriers to information sharing between:\n  - Government agencies,\n  - Financial authorities, and\n  - The private sector.\n- Enhance engagement between the financial sector and the National Cyber Security Centre so the sector helps shape the Centre’s activities.\n- Establish contingency plans and crisis protocols for large-scale cyber-attacks affecting the Swedish financial sector.\n- Improve the flow and content of threat and incident information provided to financial institutions."
    },
    {
      "heading": "Subject matter and keywords (as listed)",
      "content": "- Subject: Cyber risk, Economic sectors, Financial institutions, Financial regulation and supervision, Financial sector, Financial Sector Assessment Program, Financial sector policy and analysis, International organization, Monetary policy, Operational risk, Securities, Technology\n- Keywords: Baltics, crisis management exercise, Cyber risk, Financial sector, Financial Sector Assessment Program, Finansinspektionen organization chart, NIST cyber security framework, Operational risk, Securities, supervisory authority, telecom authority"
    },
    {
      "heading": "Publication and document metadata",
      "content": "- Pages: 28\n- Volume: 2023\n- Issue: 135\n- Series: Country Report No. 2023/135\n- DOI: https://doi.org/10.5089/9798400237911.002\n- Stock No: 1SWEEA2023005\n- ISBN: 9798400237911\n- ISSN: 1934-7685\n- Publication date on landing page: April 5, 2023\n\nInternational Monetary Fund. Monetary and Capital Markets Department \"Sweden: Financial Sector Assessment Program–Technical Note on Cybersecurity Risk Supervision and Oversight\", IMF Staff Country Reports 2023, 135 (2023).\n\n---\n\n Content in this bundle\n\n- 1sweea2023005\n  - 1sweea2023005 (Markdown version){rel=\"alternate\" type=\"text/markdown\"}\n  - 1sweea2023005 (PDF){rel=\"external\" type=\"application/pdf\"}"
    }
  ],
  "bullets": [
    "[Markdown version](/en/publications/cr/issues/2023/04/05/sweden-financial-sector-assessment-programtechnical-note-on-cybersecurity-risk-supervision-531869/index.md)",
    "[Structured JSON version](/en/publications/cr/issues/2023/04/05/sweden-financial-sector-assessment-programtechnical-note-on-cybersecurity-risk-supervision-531869/index.json)",
    "[Bundle manifest](/en/publications/cr/issues/2023/04/05/sweden-financial-sector-assessment-programtechnical-note-on-cybersecurity-risk-supervision-531869/bundle-manifest.json)",
    "Published: April 5, 2023",
    "Series: IMF Staff Country Reports",
    "DOI: https://doi.org/10.5089/9798400237911.002",
    "The report discusses Cybersecurity Risk Supervision and Oversight in Sweden.",
    "Sweden’s financial sector is described as highly digitized and interconnected, with technological developments that heighten cyber threats and vulnerabilities.",
    "Sweden has multiple agencies engaged with cybersecurity, but roles and responsibilities regarding the cyber security of the financial sector need clarification.",
    "Cyber incident reporting frameworks exist; limited information sharing arrangements exist, but financial institutions still desire more information on threats and incidents.",
    "The report advises identifying and addressing barriers to information sharing between government agencies, the financial authorities, and the private sector.",
    "Contingency plans and crisis protocols are recommended for large-scale cyber-attacks affecting the Swedish financial sector.",
    "The financial sector is encouraged to engage with and help shape the activities of the National Cyber Security Centre.",
    "Sweden is well-served with agencies engaged with cybersecurity, yet:",
    "Cyber incident reporting frameworks are in place.",
    "Information sharing is limited and there is appetite from financial institutions to receive more information on threats and incidents.",
    "Contingency plans and crisis protocols for large-scale cyber-attacks are not sufficiently established.",
    "Clarify roles and responsibilities among agencies for financial sector cybersecurity.",
    "Identify and address barriers to information sharing between:",
    "Enhance engagement between the financial sector and the National Cyber Security Centre so the sector helps shape the Centre’s activities.",
    "Establish contingency plans and crisis protocols for large-scale cyber-attacks affecting the Swedish financial sector.",
    "Improve the flow and content of threat and incident information provided to financial institutions.",
    "Subject: Cyber risk, Economic sectors, Financial institutions, Financial regulation and supervision, Financial sector, Financial Sector Assessment Program, Financial sector policy and analysis, International organization, Monetary policy, Operational risk, Securities, Technology",
    "Keywords: Baltics, crisis management exercise, Cyber risk, Financial sector, Financial Sector Assessment Program, Finansinspektionen organization chart, NIST cyber security framework, Operational risk, Securities, supervisory authority, telecom authority",
    "Pages: 28",
    "Volume: 2023",
    "Issue: 135",
    "Series: Country Report No. 2023/135",
    "DOI: https://doi.org/10.5089/9798400237911.002",
    "Stock No: 1SWEEA2023005",
    "ISBN: 9798400237911",
    "ISSN: 1934-7685",
    "Publication date on landing page: April 5, 2023",
    "**1sweea2023005**"
  ],
  "related": [
    {
      "title": "1sweea2023005",
      "role": "document",
      "sourceUrl": "https://www.imf.org/-/media/files/publications/cr/2023/english/1sweea2023005.pdf",
      "summary": {
        "path": "/-/media/files/publications/cr/2023/english/1sweea2023005.pdf.md",
        "mime": "text/markdown"
      },
      "binary": {
        "path": "/-/media/files/publications/cr/2023/english/1sweea2023005.pdf",
        "mime": "application/pdf"
      }
    }
  ],
  "alternates": {
    "markdown": "/en/publications/cr/issues/2023/04/05/sweden-financial-sector-assessment-programtechnical-note-on-cybersecurity-risk-supervision-531869/index.md",
    "json": "/en/publications/cr/issues/2023/04/05/sweden-financial-sector-assessment-programtechnical-note-on-cybersecurity-risk-supervision-531869/index.json",
    "bundleManifest": "/en/publications/cr/issues/2023/04/05/sweden-financial-sector-assessment-programtechnical-note-on-cybersecurity-risk-supervision-531869/bundle-manifest.json"
  },
  "generatedAtUtc": "2026-09-12T04:06:33.25Z"
}