## Sweden: Financial Sector Assessment Program–Technical Note on Cybersecurity Risk Supervision and Oversight

_IMF Staff Country Reports, April 5, 2023_

## Source details

**Canonical URL:** [Sweden: Financial Sector Assessment Program–Technical Note on Cybersecurity Risk Supervision and Oversight](https://www.imf.org/en/publications/cr/issues/2023/04/05/sweden-financial-sector-assessment-programtechnical-note-on-cybersecurity-risk-supervision-531869)

## Other formats

- [Markdown version](/en/publications/cr/issues/2023/04/05/sweden-financial-sector-assessment-programtechnical-note-on-cybersecurity-risk-supervision-531869/index.md)
- [Structured JSON version](/en/publications/cr/issues/2023/04/05/sweden-financial-sector-assessment-programtechnical-note-on-cybersecurity-risk-supervision-531869/index.json)
- [Bundle manifest](/en/publications/cr/issues/2023/04/05/sweden-financial-sector-assessment-programtechnical-note-on-cybersecurity-risk-supervision-531869/bundle-manifest.json)

## Bibliographic details
- Published: April 5, 2023
- Series: IMF Staff Country Reports
- DOI: https://doi.org/10.5089/9798400237911.002

---

### Executive summary and context
- The report discusses Cybersecurity Risk Supervision and Oversight in Sweden.
- Sweden’s financial sector is described as highly digitized and interconnected, with technological developments that heighten cyber threats and vulnerabilities.
- Sweden has multiple agencies engaged with cybersecurity, but roles and responsibilities regarding the cyber security of the financial sector need clarification.
- Cyber incident reporting frameworks exist; limited information sharing arrangements exist, but financial institutions still desire more information on threats and incidents.
- The report advises identifying and addressing barriers to information sharing between government agencies, the financial authorities, and the private sector.
- Contingency plans and crisis protocols are recommended for large-scale cyber-attacks affecting the Swedish financial sector.
- The financial sector is encouraged to engage with and help shape the activities of the National Cyber Security Centre.

### Key findings
- Sweden is well-served with agencies engaged with cybersecurity, yet:
  - Roles and responsibilities of each agency in respect to financial sector cybersecurity should be clarified.
  - Barriers to sharing information should be resolved.
- Cyber incident reporting frameworks are in place.
- Information sharing is limited and there is appetite from financial institutions to receive more information on threats and incidents.
- Contingency plans and crisis protocols for large-scale cyber-attacks are not sufficiently established.

### Policy recommendations
- Clarify roles and responsibilities among agencies for financial sector cybersecurity.
- Identify and address barriers to information sharing between:
  - Government agencies,
  - Financial authorities, and
  - The private sector.
- Enhance engagement between the financial sector and the National Cyber Security Centre so the sector helps shape the Centre’s activities.
- Establish contingency plans and crisis protocols for large-scale cyber-attacks affecting the Swedish financial sector.
- Improve the flow and content of threat and incident information provided to financial institutions.

### Subject matter and keywords (as listed)
- Subject: Cyber risk, Economic sectors, Financial institutions, Financial regulation and supervision, Financial sector, Financial Sector Assessment Program, Financial sector policy and analysis, International organization, Monetary policy, Operational risk, Securities, Technology
- Keywords: Baltics, crisis management exercise, Cyber risk, Financial sector, Financial Sector Assessment Program, Finansinspektionen organization chart, NIST cyber security framework, Operational risk, Securities, supervisory authority, telecom authority

### Publication and document metadata
- Pages: 28
- Volume: 2023
- Issue: 135
- Series: Country Report No. 2023/135
- DOI: https://doi.org/10.5089/9798400237911.002
- Stock No: 1SWEEA2023005
- ISBN: 9798400237911
- ISSN: 1934-7685
- Publication date on landing page: April 5, 2023

*International Monetary Fund. Monetary and Capital Markets Department "Sweden: Financial Sector Assessment Program–Technical Note on Cybersecurity Risk Supervision and Oversight", IMF Staff Country Reports 2023, 135 (2023).*

---

## Content in this bundle

- **1sweea2023005**
  - [1sweea2023005 (Markdown version)](/-/media/files/publications/cr/2023/english/1sweea2023005.pdf.md){rel="alternate" type="text/markdown"}
  - [1sweea2023005 (PDF)](/-/media/files/publications/cr/2023/english/1sweea2023005.pdf){rel="external" type="application/pdf"}

---

_Source: https://www.imf.org/en/publications/cr/issues/2023/04/05/sweden-financial-sector-assessment-programtechnical-note-on-cybersecurity-risk-supervision-531869_