In addressing these threats, it is important to operate under the assumption that it is not a matter of “if” but rather “when” these threats will occur, and focusing solely on “protection” and “detection” is no longer sufficient. In other words, cybersecurity alone is not enough, but we also need to proactively think about cyber resilience: how do we not only prepare, but also withstand and recover from disruptions. In the short time I have today, I’d like to highlight three key drivers for effective cyber resilience. First, cyber resilience is not only the responsibility of a company’s IT department, but rather an important, organization-wide agenda. The board of directors and senior management must understand and endeavor to prioritize cyber risk management frameworks into the organization’s operation. This includes making sure that cyber resilience policies put in place are applied effectively, setting a clear organizational structure that includes the roles and responsibilities of staff across all levels, establishing a risk management process according to international practices, and ensuring that employees are always vigilant on cyber security issues. The Bank of Thailand, for example, requires financial institutions to have at least one member with IT knowledge or IT-related experiences to be on the board of directors. We also organize regular capacity-building courses for board members and high-level executives from Thai financial institutions to provide them with the knowledge and 2  understanding of how to address cyber threats.

Close cooperation and sharing of cyber threat information will help organizations better monitor the development of cyber threats, recognize unfamiliar threats, and develop more comprehensive plans for dealing with such issues. Cooperation is also more than just information sharing: whether it is cooperation in terms of supervision, development of standards, cyber exercises, or capability building. These kinds of cooperation that would eventually create a “Cybersecurity Ecosystem” requires efforts from all sides, including governments, regulatory agencies, the private sector, and the education sector. It is very welcoming that today there are already a number of information sharing platforms available at the national, regional, and international levels. Thailand’s finance, banking, capital markets, and insurance industries have established a Computer Emergency Response Team (CERT) for their respective industry. The teams share cybersecurity information on a daily basis. At the regional level, ASEAN has established the Cybersecurity Resilience and Information Sharing Platform (CRISP). The Central Banks, Regulators, and Supervisors (CERES) forum serves as a  3  platform for the international community. These collaborations on multiple levels present opportunities for countries to learn from one another. More recently, under our capacity as the 2019 ASEAN Chairman, Thailand has collaborated with the Bank for International Settlement (BIS) to organize the ASEAN Financial Regulators’ Program on Cyber Resilience, a series of training programs, the last of which concluded just yesterday. We envision that these Cyber Range collaborations will continue to be held for ASEAN members going forward.