The latest from CREST for you;
CREST, the global non-profit accreditation body for the cybersecurity industry, has published new guidance urging the financial services sector to unify its cybersecurity posture across the entire market ecosystem.
The new whitepaper, titled ‘Cyber Resilience in Financial Services: A whole ecosystem approach,’ looks at the interconnected roles of financial institutions, financial supervisors and cyber service providers, and sets out a practical maturity pathway to help build collective resilience across the industry.
As the adoption of Artificial Intelligence for cyber security expands both within the financial institutions and their service providers, the importance of a coordinated approach to responsible use and testing increases too. The paper highlights that cyber resilience in financial services depends on more than the strength of individual institutions. Financial institutions operate within a wider system that includes shared infrastructure, technology and data providers, specialist cyber firms and public authorities. A weakness in one critical part of that system can affect the resilience of the whole.
It sets out three core areas of responsibility: financial institutions building and maintaining resilience across critical business services; supervisors establishing proportionate expectations and understanding risk across the wider financial system; and cyber service providers supplying trusted specialist expertise, independent assurance, testing and response capability.
Nick Benson, CEO of CREST, said:
“Financial services are among the most interconnected and systemically important parts of any economy, so cyber resilience has to be developed across the whole ecosystem. Financial institutions, supervisors and cyber service providers each have a distinct role, and the strength of the system depends on their capability developing together.
“This is particularly important as countries strengthen their cyber resilience and build local capability. International standards can provide a common foundation, while investment in local providers, practitioners and supervisory expertise creates sustainable capacity within the market. This paper provides a practical model that jurisdictions can adapt to their own starting point and use to plan that development over time.”
Josh Magri, CEO, Cyber Risk Institute, said:
“Financial sector cyber resilience depends on how well institutions, supervisors, and specialist providers coalesce around a common view of risk and maturity.
At CRI, our work on harmonised frameworks, like the CRI Profile and Maturity Model, and proportionate, evidence-based risk management approaches reflects this principle.
This paper offers a practical model for assessing those interdependencies and sequencing improvement across the wider ecosystem. Non-profits like CREST and CRI, working in partnership with the rest of the ecosystem, are key enablers in this complex and critical effort.”
A key focus of the whitepaper is how the model can support countries and markets at different stages of cyber maturity. Many jurisdictions face challenges in developing sufficient local capacity for more complex cyber security services. Experienced providers and practitioners may be concentrated in a small number of markets, while local firms may have more limited access to specialist experience, training, recognised qualifications and complex engagements.
The paper sets out practical ways to address this, including mentoring, partnerships between international and local providers, knowledge transfer, access to recognised training and examinations, capacity-building programmes and structured pathways towards independent accreditation.
CREST’s Cyber Accelerated Maturity Programme, CREST CAMP, is included as one example of this approach. It combines standards, training, mentorship and progression through the CREST Pathway to support the development of local financial institutions and providers, and help build sustainable, high-quality provision within the financial sector.
The whitepaper also proposes maturity pathways for each of the three groups, helping jurisdictions assess their current position, identify gaps and plan development over a multi-year period. The model progresses from baseline mapping, cyber hygiene and initial standards through to independent assurance, advanced testing, stronger supervisory capability and intelligence-led testing and resilience.
It identifies three priorities for strengthening cyber resilience across the financial ecosystem: measuring maturity across the whole ecosystem and its shared dependencies, adopting a common language across institutions, supervisors and providers, and providing targeted development support where capability needs to accelerate.
The paper also highlights the role of international and non-governmental organisations in supporting this work through standards, frameworks, technical assistance, independent quality assurance and capacity-building.
Cyber Resilience in Financial Services: A whole ecosystem approach is available here
Be the first to comment