IMF published a paper that discusses the emerging supervisory practices that contribute to effective cyber-security risk supervision. This paper highlights emerging supervisory approaches with the intention of promoting good practices. The focus is on how these practices can be adopted by the agencies that are at an early stage of developing a supervisory approach to strengthen cyber resilience. The paper notes that regulatory requirements ensuring that good cyber-security risk management practices are in place are critical.
The paper discusses the importance of addressing cyber risk and points out that financial sector supervisory authorities worldwide are working to establish and implement a framework for cyber risk supervision. Progress, however, is uneven, particularly for lower-income countries and lower-capacity supervisors, which face a number of challenges developing an effective regulatory and supervisory framework for cyber risk supervision. The goal of cyber-security risk supervision should be to influence, incentivize, and shape cyber-security capabilities of firms. Supervision activities to build resilience should include the following:
- Identify the threat landscape
- Map the cyber and financial network
- Create coherent regulation
- Conduct supervisory assessment
- Establish formal information-sharing and reporting mechanisms
- Provide adequate response and recovery
- Ensure preparedness of supervisory agencies
The experience from IMF technical assistance shows that establishing a framework for cyber-security risk supervision involves many challenges, with the dearth of specialist skills being one of the biggest challenges. Notwithstanding these, all supervisors can take action to build information-gathering and sharing systems, improve basic security practices, and identify and deploy resources toward key assets and carry out basic cyber exercises. The report highlights that the transfer of knowledge across the community of supervisors, especially lower-income and lower-capacity supervisors, will help raise resilience globally. Regulations should leverage established approaches, including those developed by industry, which will help with a convergence of standards. Although all firms face cyber-security risk, smaller- and lower-capacity firms should focus on strengthening cyber hygiene while the largest and most globally connected firms and key system nodes should be subject to heightened standards.
The report notes that authorities should work together to promote a more consistent and coordinated approach that promotes consistency and convergence. A strong regulatory and supervisory framework should allow supervisors to substantially improve the resilience of financial sector to cyber attack. Whether the regulatory framework is based on principles or rules, the framework must grant supervisors sufficient authority to address cyber-security risk and allow supervisors to be sufficiently adaptive to the dynamics of the risk.
Related Link: Report on Cyber Risk Supervision
Keywords: International, Banking, Insurance, Securities, Cyber Risk, Cyber Resilience Framework, Supervisory Practices, Operational Risk, IMF
Previous ArticleBundesbank Updates Plausibility Checks for Bank Reporting in Germany
EBA issued a revised list of validation rules with respect to the implementing technical standards on supervisory reporting.
EBA published its response to the call for advice of EC on ways to strengthen the EU legal framework on anti-money laundering and countering the financing of terrorism (AML/CFT).
NGFS published a paper on the overview of environmental risk analysis by financial institutions and an occasional paper on the case studies on environmental risk analysis methodologies.
MAS published the guidelines on individual accountability and conduct at financial institutions.
APRA published final versions of the prudential standard APS 220 on credit quality and the reporting standard ARS 923.2 on repayment deferrals.
SRB published two articles, with one article discussing the framework in place to safeguard financial stability amid crisis and the other article outlining the path to a harmonized and predictable liquidation regime.
FSB hosted a virtual workshop as part of the consultation process for its evaluation of the too-big-to-fail reforms.
ECB updated the list of supervised entities in EU, with the number of significant supervised entities being 115.
OSFI published the key findings of a study on third-party risk management.
FSB is extending the implementation timeline, by one year, for the minimum haircut standards for non-centrally cleared securities financing transactions or SFTs.