{
  "title": "Iceland: Financial Sector Assessment Program-Technical Note on Cyber and Operational Resilience, Supervision and Oversight",
  "publication": "IMF Staff Country Reports, July 28, 2023",
  "sourceUrl": "https://www.imf.org/en/publications/cr/issues/2023/07/26/iceland-financial-sector-assessment-program-technical-note-on-cyber-and-operational-537033",
  "canonical": "https://www.imf.org/en/publications/cr/issues/2023/07/26/iceland-financial-sector-assessment-program-technical-note-on-cyber-and-operational-537033",
  "overlayPath": "/en/publications/cr/issues/2023/07/26/iceland-financial-sector-assessment-program-technical-note-on-cyber-and-operational-537033/index.md",
  "summary": "This technical note focuses on cyber and operational resilience, supervision and oversight in Iceland. The Icelandic financial sector has not experienced seriously disruptive cyber-attacks or operational issues in recent years, but threats are growing.",
  "sections": [
    {
      "heading": "Overview",
      "content": "- Publication date: July 28, 2023\n- Focus: cyber and operational resilience, supervision and oversight in Iceland’s financial sector.\n- Context: The Icelandic financial sector has not experienced seriously disruptive cyber-attacks or operational issues in recent years, but threats are growing."
    },
    {
      "heading": "Key findings",
      "content": "- Iceland’s dependence on international connectivity for both debit and credit card systems introduces a significant vulnerability into the payment system.\n- There is no dedicated cyber security strategy for the finance sector.\n- Operational risk experts in the Central Bank of Iceland (CBI) are experienced and well regarded by financial institutions, but more resources are needed to provide adequate coverage of this increasingly important area.\n- Supervision of financial institutions’ cybersecurity is highly dependent on self-assessments by the regulated entities and independent reviews carried out by third parties."
    },
    {
      "heading": "Identified vulnerabilities and gaps",
      "content": "- Significant single-point vulnerability: international connectivity for card systems (debit and credit).\n- Absence of a sector-specific cyber security strategy for finance.\n- Resource constraints at the Central Bank of Iceland (CBI) limiting supervision coverage.\n- Reliance on regulated entities’ self-assessments and third-party reviews for cybersecurity supervision."
    },
    {
      "heading": "Supervision, oversight, and operational practices",
      "content": "- CBI operational risk experts are experienced and well regarded by financial institutions.\n- Current supervisory approach places considerable weight on self-assessment and external independent reviews.\n- The note recommends regular internal processes and reporting to oversight bodies:\n  - CBI should regularly revise the list of critical operations and critical service providers for internal use and for presentation to the Financial Stability Committee and Financial Stability Council.\n  - CBI is encouraged to enhance its incident dashboard by summarizing cyber incidents and examining trends."
    },
    {
      "heading": "Policy recommendations (summarized)",
      "content": "- Develop and adopt a dedicated cyber security strategy for the finance sector.\n- Increase resources at CBI to provide adequate coverage of cyber and operational risk supervision.\n- Reduce overreliance on self-assessments by regulated entities; strengthen supervisory testing and independent verification.\n- Regularly revise and maintain lists of critical operations and critical service providers for internal use and for presentation to the Financial Stability Committee and Financial Stability Council.\n- Enhance incident monitoring and reporting:\n  - Improve the incident dashboard to summarize cyber incidents and examine trends.\n\n---\n\n Content in this bundle\n\n- 1islea2023007 - Executive Summary\n  - 1islea2023007 - Executive Summary (Markdown version){rel=\"alternate\" type=\"text/markdown\"}\n  - 1islea2023007 - Executive Summary (PDF){rel=\"external\" type=\"application/pdf\"}"
    }
  ],
  "bullets": [
    "[Markdown version](/en/publications/cr/issues/2023/07/26/iceland-financial-sector-assessment-program-technical-note-on-cyber-and-operational-537033/index.md)",
    "[Structured JSON version](/en/publications/cr/issues/2023/07/26/iceland-financial-sector-assessment-program-technical-note-on-cyber-and-operational-537033/index.json)",
    "[Bundle manifest](/en/publications/cr/issues/2023/07/26/iceland-financial-sector-assessment-program-technical-note-on-cyber-and-operational-537033/bundle-manifest.json)",
    "Published: July 28, 2023",
    "Series: IMF Staff Country Reports",
    "DOI: https://doi.org/10.5089/9798400249860.002",
    "Publication date: July 28, 2023",
    "Focus: cyber and operational resilience, supervision and oversight in Iceland’s financial sector.",
    "Context: The Icelandic financial sector has not experienced seriously disruptive cyber-attacks or operational issues in recent years, but threats are growing.",
    "Iceland’s dependence on international connectivity for both debit and credit card systems introduces a significant vulnerability into the payment system.",
    "There is no dedicated cyber security strategy for the finance sector.",
    "Supervision of financial institutions’ cybersecurity is highly dependent on self-assessments by the regulated entities and independent reviews carried out by third parties.",
    "Significant single-point vulnerability: international connectivity for card systems (debit and credit).",
    "Absence of a sector-specific cyber security strategy for finance.",
    "Resource constraints at the Central Bank of Iceland (CBI) limiting supervision coverage.",
    "Reliance on regulated entities’ self-assessments and third-party reviews for cybersecurity supervision.",
    "CBI operational risk experts are experienced and well regarded by financial institutions.",
    "Current supervisory approach places considerable weight on self-assessment and external independent reviews.",
    "The note recommends regular internal processes and reporting to oversight bodies:",
    "Develop and adopt a dedicated cyber security strategy for the finance sector.",
    "Increase resources at CBI to provide adequate coverage of cyber and operational risk supervision.",
    "Reduce overreliance on self-assessments by regulated entities; strengthen supervisory testing and independent verification.",
    "Regularly revise and maintain lists of critical operations and critical service providers for internal use and for presentation to the Financial Stability Committee and Financial Stability Council.",
    "Enhance incident monitoring and reporting:",
    "**1islea2023007 - Executive Summary**"
  ],
  "related": [
    {
      "title": "1islea2023007 - Executive Summary",
      "role": "document",
      "sourceUrl": "https://www.imf.org/-/media/files/publications/cr/2023/english/1islea2023007.pdf",
      "summary": {
        "path": "/-/media/files/publications/cr/2023/english/1islea2023007.pdf.md",
        "mime": "text/markdown"
      },
      "binary": {
        "path": "/-/media/files/publications/cr/2023/english/1islea2023007.pdf",
        "mime": "application/pdf"
      }
    }
  ],
  "alternates": {
    "markdown": "/en/publications/cr/issues/2023/07/26/iceland-financial-sector-assessment-program-technical-note-on-cyber-and-operational-537033/index.md",
    "json": "/en/publications/cr/issues/2023/07/26/iceland-financial-sector-assessment-program-technical-note-on-cyber-and-operational-537033/index.json",
    "bundleManifest": "/en/publications/cr/issues/2023/07/26/iceland-financial-sector-assessment-program-technical-note-on-cyber-and-operational-537033/bundle-manifest.json"
  },
  "generatedAtUtc": "2026-09-11T21:00:47.764Z"
}