CREST has published ‘Cyber Resilience in Financial Services: A whole ecosystem approach’ which sets out a pathway to help build collective resilience across the financial services sector.
The paper highlights that cyber resilience in financial services depends on more than the strength of individual institutions. Financial institutions operate within a wider system that includes shared infrastructure, technology and data providers, specialist cyber firms, and public authorities. A weakness in one critical part of that system can affect the resilience of the whole.
It sets out three core areas of responsibility: financial institutions building and maintaining resilience across critical business services; supervisors establishing proportionate expectations and understanding risk across the wider financial system; and cyber service providers supplying trusted specialist expertise, independent assurance, testing, and response capability.
The whitepaper also proposes maturity pathways for each of the three groups, helping jurisdictions assess their current position, identify gaps, and plan development over a multi-year period. The model progresses from baseline mapping, cyber hygiene, and initial standards through to independent assurance, advanced testing, stronger supervisory capability, and intelligence-led testing and resilience.
Three priorities for strengthening cyber resilience across the financial ecosystem are identified: measuring maturity across the whole ecosystem and its shared dependencies; adopting a common language across institutions, supervisors, and providers; and providing targeted development support where capability needs to accelerate.
The paper also highlights the role of international and non-governmental organizations in supporting this work through standards, frameworks, technical assistance, independent quality assurance, and capacity-building.
