RBNZ Consults on Guidance for Managing Cyber Risks
RBNZ launched consultation on the guidance for what regulated entities should consider when managing cyber resilience. The draft guidance, which is open for feedback until January 29, 2021, outlines the expectations of RBNZ around cyber resilience and draws heavily from leading international and national cybersecurity standards and guidelines. RBNZ will publish a summary of submissions and final guidance in March or April 2021. RBNZ is also developing a detailed framework for information gathering and sharing, for which it plans to consult stakeholders in mid-2021.
The guidance has four parts—namely, governance, capability building, information sharing, and third-party management. Third-party management is an area of growing importance and the guidance includes a special subsection on the use of cloud computing services in light of the rapid adoption of cloud services by financial sector firms. The guidance is aligned with international standard and guidelines on cyber resilience and provides a set of high-level principle-based recommendations. The draft cyber risk management guidance would apply to all entities RBNZ regulates. This includes registered banks, licensed non-bank deposit-takers, licensed insurers, and designated financial market infrastructures. The consultation paper also seeks feedback on how information gathering and sharing by RBNZ with relevant public-sector bodies can help to build cyber resilience.
The consultation paper discusses views of RBNZ on a collaborative approach to information gathering and sharing. In the multi-agency landscape, RBNZ plans to promote information gathering and sharing with other relevant government agencies (for example, National Cyber Security Center, Computer Emergent Response Team NZ, and the Financial Market Authority). RBNZ considers that there are merits in following the broad pattern observed in the international practices of establishing a cyber data collection. As a principle, RBNZ will tailor reporting requirements to ensure they stay relevant and minimize the reporting burden. At a very high level, this includes:
- A regular but fairly infrequent data collection (perhaps annually or once every few years) on cyber capabilities and resources dedicated to building cyber resilience
- Establishing an obligation to report cyber incidents to the prudential authority, perhaps with a materiality threshold for reporting incidents as soon as reasonable after they are detected
- An information collection plan that is applicable to all regulated entities of RBNZ
Related Links
Keywords: Asia Pacific, New Zealand, Banking, Insurance, PMI, Guidance, Cyber Risk, Operational Risk, Cloud Computing, RBNZ
Previous Article
US Agencies Finalize Three Interim Final Rules Issued Amid PandemicRelated Articles
BIS and Central Banks Experiment with GenAI to Assess Climate Risks
A recent report from the Bank for International Settlements (BIS) Innovation Hub details Project Gaia, a collaboration between the BIS Innovation Hub Eurosystem Center and certain central banks in Europe
Nearly 25% G-SIBs Commit to Adopting TNFD Nature-Related Disclosures
Nature-related risks are increasing in severity and frequency, affecting businesses, capital providers, financial systems, and economies.
Singapore to Mandate Climate Disclosures from FY2025
Singapore recently took a significant step toward turning climate ambition into action, with the introduction of mandatory climate-related disclosures for listed and large non-listed companies
SEC Finalizes Climate-Related Disclosures Rule
The U.S. Securities and Exchange Commission (SEC) has finalized the long-awaited rule that mandates climate-related disclosures for domestic and foreign publicly listed companies in the U.S.
EBA Proposes Standards Related to Standardized Credit Risk Approach
The European Banking Authority (EBA) has been taking significant steps toward implementing the Basel III framework and strengthening the regulatory framework for credit institutions in the EU
US Regulators Release Stress Test Scenarios for Banks
The U.S. regulators recently released baseline and severely adverse scenarios, along with other details, for stress testing the banks in 2024. The relevant U.S. banking regulators are the Federal Reserve Bank (FED), the Federal Deposit Insurance Corporation (FDIC), and the Office of the Comptroller of the Currency (OCC).
Asian Governments Aim for Interoperability in AI Governance Frameworks
The regulatory landscape for artificial intelligence (AI), including the generative kind, is evolving rapidly, with governments and regulators aiming to address the challenges and opportunities presented by this transformative technology.
EBA Proposes Operational Risk Standards Under Final Basel III Package
The European Union (EU) has been working on the final elements of Basel III standards, with endorsement of the Banking Package and the publication of the European Banking Authority (EBA) roadmap on Basel III implementation in December 2023.
EFRAG Proposes XBRL Taxonomy and Standard for Listed SMEs Under ESRS
The European Financial Reporting Advisory Group (EFRAG), which plays a crucial role in shaping corporate reporting standards in European Union (EU), is seeking comments, until May 21, 2024, on the Exposure Draft ESRS for listed SMEs.
ECB to Expand Climate Change Work in 2024-2025
Banking regulators worldwide are increasingly focusing on addressing, monitoring, and supervising the institutions' exposure to climate and environmental risks.
