Call us now:
If banks cannot manage the risk then we’re all buggered. Least of all because of the impact on financial stability if they do not, to say the stakes are high is not FUD. See the previous post from Gary Gensler the chair of the SEC, or the reports from financial stability board on cyber resilience, the recent FT article on the Bank of America raising concerns on cyber insurance. Systemically important banks (I’ve worked for 2 as a CISO and global head of cyber risk), have always taken cybersecurity seriously. The consequences on regulatory capital and regulatory oversight under Basel accords alone made operational, tech and cyber risk, risks covered under SREP.
The big challenge ahead for FIs, if they can stay out of trouble in the near term, is cyber risk management regulation from the EU (DORA, NIS 2), the U.S (SEC proposal, NYDFS), Singapore and Australia. Regulation that requires boards to oversight cyber risk management, that in turn requires boards to demonstrate the implementation of a risk management framework (see Basel III), effective cybersecurity practices (see NIST CSF, ISO 27001) and appropriate governance (executive, board, risk, audit, cyber, AML and supplier committees). Attest to their companies cyber risk compliance and inform regulators of their own personal cyber experience and knowledge. Programs that boards of system FIs covered under Basel Accords should be able to demonstrate across the 1st , 2nd and 3rd lines of defense.
The greater challenge will be for those FIs, ICT vendors and cloud firms covered under the extended scope of the SEC cyber proposals, EU NIS 2, DORA and Australia’s CNI guidance. It’s all moving ‘Left of Bang’. Ted Dziekanowski
Stephen Pitt-Walker, JD, FGIA Rachel V. Rose, JD, MBA
#cybersecurity #cyberriskmanagement #cyberregulation #financialstability #financialservices
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7064154256307548160