BCBS D454
Definition
BCBS D454 is a document published by the Basel Committee on Banking Supervision on December 2018 in the Operational Risk category.
Title
Cyber resilience: Range of practices.
Abstract
The Basel Committee on Banking Supervision today published the report. It identifies, describes and compares the range of observed bank, regulatory and supervisory cyber-resilience practices across jurisdictions.
Based on analysis of authorities' responses to previous international surveys and on exchanges between international experts, the report gains insight into the effective practices and expectations in place. It also benefited from industry participants' input.
The current challenges and initiatives to enhance cyber-resilience are summarised in 10 key findings and illustrated by case studies which focus on concrete developments in the jurisdictions covered.
1. General Landscape
Despite convergence in high level expectations, the technical specifications and supervisory practices differ across jurisdictions. This diversity of approaches results in a complex and fragmented landscape, but is also a necessary reflection of actual differences in Members' legal frameworks and degree of digitalisation.
2. Strategy
Regulators generally do not require a specific cyber strategy, however institutions are expected to ensure that systems are "secure-by-design" and that emphasis is placed on resilience in light of current threats rather than compliance to a standard.
3. Cyber risk management
In most jurisdictions broader IT and operational risk management practices are more mature and are used to address cyber risk and supervise cyber resilience.
4. Governance / organisation
Models such as "three lines of defence" are widely adopted, but cyber resilience is not always clearly articulated across the technical, business and strategic lines, which hampers their effectiveness.
5. Workforce
Skills shortage leads to recruitment challenges. A few jurisdictions have implemented or leveraged specific cyber certifications to address this.
6. Testing
Protection and detection testing is evolving and prevalent; response and recovery less so.
7. Incident response
Although an incident management framework is not required, incident response plans are.
8. Metrics
Although some forward-looking indicators of cyber resilience are being picked up through the most widespread supervisory practices, no standard set of metrics has emerged yet.
9. Information sharing
The content and use of information collected or shared by banks and supervisors varies widely across jurisdictions. The speed, latitude and security of communications required to cope with a cross-border cyber incident has led a few jurisdictions to take specific formal steps in this area.
10. Third party risk
Regulatory frameworks for outsourcing activities across jurisdictions are quite established and share substantial commonalities, but there is no common approach regarding third parties beyond outsourced services. While third parties may provide cost-effective solutions to increase resilience levels, the onus remains on the banks to demonstrate adequate understanding and active management of the third party dependencies and concentration across the value chain.
By describing the diversity of approaches thematically, the report will help banks and supervisors navigate the regulatory environment and will serve as useful input for identifying areas where further policy work by the Committee may be warranted. Going forward, the Committee will integrate the cyber dimension into its broader operational resilience work.
Document Profile
- Publication Date: December 2018
- Publication Type: Other
- Publication Status:
- Publication Category: Operational Risk
- Number of Pages: 45
- Keywords: Operational Risk
See Also
Disclaimers
For definitive information on regulatory matters always consult primary sources, especially where it concerns legally binding rules and regulations.
The above regulatory document abstract is quoted verbatim in this Open Risk Manual entry and provided free of charge for the convenience of all internet users. There is no explicit or implicit endorsement of this web service by the Bank of International Settlements. The copyright of the included material rests with the original authors (Links to the original texts are duly provided).
