MNB Sets CCyB, Fines Exim Bank, and Conducts Cyber Reporting Pilot

The MNB report examining the cyber threat landscape in the financial sector in Hungary showcases the cyber security threats affecting financial market players, including the key trends and specific incidents experienced by domestic financial players. The report was completed after over a year long project called "Developing a methodology for the analysis of cyber threats in the financial sector and the preparation of a threat landscape," which was initiated by the Central Bank of Hungary and assisted by Ernst & Young Consulting. The central bank collected and analyzed the detailed incident information provided by 39 invited institutions (including 5 banks, 12 insurers, and 10 fund management companies). As a result of this, a data structure was built during the project that was not previously available in Hungary. The institutions that joined the Pilot Project undertook two types of reporting tasks, using bespoke reporting forms; they sent monthly reports summarizing all critical and non-critical incidents that occurred during the month as well as immediate, detailed alerts on critical incidents. This incident reporting framework, which included the specially developed reporting forms, enabled the data-driven conclusions that form the main part of this publication. 

Experience gained on the applicability of this framework and methodology confirms that the developed incident reporting process is methodologically sound and can be adequately applied in practice; the developed form helped institutions to provide all the necessary information, thus reducing the number of further clarification questions. Less than 4% of incidents were reported in the “other” category, which suggests that the form created for reporting incidents could be adequately interpreted and used in practice by the institutions, while further analysis and classification of this unclassified type of incidents may provide future opportunities for fine-tuning the categories and subcategories. Other fine-tuning options identified include the restructuring of fraud incident reporting, the clarification of data recording on the number of affected customers, and the revision of the reporting timeframe for smaller institutions. In view of the future expectations of the Digital Operational Resilience (DORA) Regulation on incident reporting, the feedback from the Pilot Project has provided useful practical experience to the participating institutions in preparing for future expectations, at organizational, decisionmaker, and expert levels.

Keywords: Europe, Cyber Risk, Hungary, Governance, MNB, Banking, Basel, CCyB, Regulatory Capital, Compliance Risk, Cyber Incident Reporting