CREST framework strengthens cyber resilience in financial ecosystem

The organisation’s new White Paper, ‘Cyber Resilience in Financial Services: A Whole Ecosystem Approach’, examines the interconnected roles of financial institutions, financial supervisors and cyber service providers and then sets out a practical maturity pathway in order to help build collective resilience right across the industry.

As the adoption of Artificial Intelligence for cyber security expands both within the financial institutions and among their service providers, the importance of a co-ordinated approach to responsible use and testing increases.

The new White Paper highlights the truism that cyber resilience in financial services depends on more than the strength of individual institutions. Financial institutions operate within a wider system that includes shared infrastructure, technology and data providers, specialist cyber firms and public authorities. Any weakness in one critical part of that system can affect the resilience of the whole.

The document sets out three core areas of responsibility: financial institutions building and maintaining resilience across critical business services, supervisors establishing proportionate expectations and understanding risk across the wider financial system and cyber service providers supplying trusted specialist expertise, independent assurance, testing and response capability.

Distinct role 

Nick Benson, CEO of CREST, stated: “Financial services are among the most interconnected and systemically important parts of any economy. As such, cyber resilience has to be developed across the whole ecosystem. Financial institutions, supervisors and cyber service providers each have a distinct role and the strength of the system depends on their capability developing together.”

Benson added: “This is particularly important as countries strengthen their cyber resilience and build local capability. International standards can provide a common foundation, while investment in local providers, practitioners and supervisory expertise creates sustainable capacity within the market. The White Paper provides a practical model that jurisdictions can adapt to their own starting point and use to plan that development over time.”

Josh Magri, CEO at the Cyber Risk Institute, explained: “Financial sector cyber resilience depends on how well institutions, supervisors and specialist providers coalesce around a common view of risk and maturity. At the Cyber Risk Institute, our work on harmonised frameworks, such as the CRI Profile and Maturity Model, and proportionate as well as evidence-based risk management approaches reflects this principle.”

In conclusion, Magri affirmed: “The White Paper offers a practical model for assessing those interdependencies and sequencing improvement across the wider ecosystem. Working in partnership with the rest of the ecosystem, non-profits like CREST and the Cyber Risk Institute are key enablers in this complex and critical effort.”

Cyber maturity 

One key focus of the White Paper is how the model can support countries and markets at different stages of cyber maturity. Many jurisdictions face challenges in developing sufficient local capacity for more complex cyber security services. Experienced providers and practitioners may be concentrated in a small number of markets, while local firms might well have somewhat more limited access to specialist experience, training, recognised qualifications and complex engagements.

The White Paper sets out practical ways in which to address this issue, including mentoring, partnerships between international and local providers, knowledge transfer, access to recognised training and examinations, capacity-building programmes and structured pathways towards independent accreditation.

CREST’s Cyber Accelerated Maturity Programme (ie CREST CAMP) is included as one example of this approach. It combines standards, training, mentorship and progression through the CREST Pathway to support the development of local financial institutions and providers, while also helping to build sustainable and high-quality provision within the financial sector.

The White Paper also proposes maturity pathways for each of the three groups, helping jurisdictions assess their current position, identify gaps and plan development over a multi-year period.

The model progresses from baseline mapping, cyber hygiene and initial standards through to independent assurance, advanced testing, stronger supervisory capability and intelligence-led testing and resilience.

Trio of priorities

Three priorities are identified for strengthening cyber resilience across the financial ecosystem: measuring maturity across the whole ecosystem and its shared dependencies, adopting a common language across institutions, supervisors and providers and providing targeted development support where capability needs to accelerate.

The White Paper also highlights the role of international and non-Governmental organisations in supporting this work through standards, frameworks, technical assistance, independent quality assurance and capacity-building.

*Copies of ‘Cyber Resilience in Financial Services: A Whole Ecosystem Approach’ are available online