BIS Paper Offers Overview of Cyber Risk in Central Bank Community
The Bank for International Settlements (BIS) published a paper that examines how central banks assess cyber risk and associated macroeconomic costs and how they judge preparedness of the financial sector in their jurisdiction. The paper discusses cyber risk priorities and challenges from the perspective of experts and practitioners in central banks for their own operations, including the critical financial market infrastructures they operate.
The focus of the paper is on the assessment of cyber risk landscape in the central banking community, leveraging a survey conducted in 2021 among 21 participating central banks from advanced and emerging market economies. The survey results show that central banks have increased their cyber-security investments since 2020, with a priority on technical security control and resiliency. Central banks see phishing and social engineering as the most common methods of attack and the potential losses from a systemically relevant cyber-attack are deemed to be large, especially if the target is a big tech providing critical cloud infrastructure. The paper discusses the implications of the increasing cloud adoption by financial institutions, which presents many opportunities for cyber-attacks. One of the challenges of cloud adoption is that, in the absence of a well-defined perimeter, information security is threatened by a lack of consistently applied security controls. Examples include vulnerable application programming interfaces (APIs), incorrect configurations, and weak identity and access management. Another challenge relates to the choice of cloud provider, not least when considering data sovereignty issues. The legal and regulatory framework in place in the country in which the data are hosted and/or processed becomes a key criterion when choosing which critical services to move to the cloud.
The paper notes that, while central banks in most emerging market economies provide a framework for collection of information on cyber-attacks on financial institutions, less than half of those in advanced economies do. Cooperation among public authorities, especially in the international context, could improve the ability of central banks to respond to cyber-attacks. The Committee on Payments and Market Infrastructures (CPMI) and the International Organization of Securities Commissions (CPMI-IOSCO) guidance on cyber resilience for financial market infrastructures represents an important benchmark for governance, business continuity management, and identification of the sources of operational risk. Much international work has been conducted by standard-setting bodies, the FSB, and the G7. The BIS’s Cyber Resilience Coordination Center provides a structured approach to knowledge-sharing, collaboration, and operational readiness among central banks in the areas of cyber resilience. Finally, by providing a platform for collaboration between central banks, regulatory authorities, financial institutions, technology firms, and cyber-security experts, the BIS Innovation Hub aims to facilitate the development of specific projects to limit cyber threats for central banks and the broader financial sector.
Related Links
Keywords: International, Banking, Regtech, Cyber Risk, Cloud Service Providers, Central Banks, Cloud Computing, Suptech, BIS
Previous Article
ACPR Amends Reporting Module Timelines Under EBA Framework 3.2Related Articles
BIS and Central Banks Experiment with GenAI to Assess Climate Risks
A recent report from the Bank for International Settlements (BIS) Innovation Hub details Project Gaia, a collaboration between the BIS Innovation Hub Eurosystem Center and certain central banks in Europe
Nearly 25% G-SIBs Commit to Adopting TNFD Nature-Related Disclosures
Nature-related risks are increasing in severity and frequency, affecting businesses, capital providers, financial systems, and economies.
Singapore to Mandate Climate Disclosures from FY2025
Singapore recently took a significant step toward turning climate ambition into action, with the introduction of mandatory climate-related disclosures for listed and large non-listed companies
SEC Finalizes Climate-Related Disclosures Rule
The U.S. Securities and Exchange Commission (SEC) has finalized the long-awaited rule that mandates climate-related disclosures for domestic and foreign publicly listed companies in the U.S.
EBA Proposes Standards Related to Standardized Credit Risk Approach
The European Banking Authority (EBA) has been taking significant steps toward implementing the Basel III framework and strengthening the regulatory framework for credit institutions in the EU
US Regulators Release Stress Test Scenarios for Banks
The U.S. regulators recently released baseline and severely adverse scenarios, along with other details, for stress testing the banks in 2024. The relevant U.S. banking regulators are the Federal Reserve Bank (FED), the Federal Deposit Insurance Corporation (FDIC), and the Office of the Comptroller of the Currency (OCC).
Asian Governments Aim for Interoperability in AI Governance Frameworks
The regulatory landscape for artificial intelligence (AI), including the generative kind, is evolving rapidly, with governments and regulators aiming to address the challenges and opportunities presented by this transformative technology.
EBA Proposes Operational Risk Standards Under Final Basel III Package
The European Union (EU) has been working on the final elements of Basel III standards, with endorsement of the Banking Package and the publication of the European Banking Authority (EBA) roadmap on Basel III implementation in December 2023.
EFRAG Proposes XBRL Taxonomy and Standard for Listed SMEs Under ESRS
The European Financial Reporting Advisory Group (EFRAG), which plays a crucial role in shaping corporate reporting standards in European Union (EU), is seeking comments, until May 21, 2024, on the Exposure Draft ESRS for listed SMEs.
ECB to Expand Climate Change Work in 2024-2025
Banking regulators worldwide are increasingly focusing on addressing, monitoring, and supervising the institutions' exposure to climate and environmental risks.
