Their experience is relevant, nonetheless, for the Euro area Member States as well, as the common market and free movement of capital is a two-ways street. Financial and business cycles in euro-area and non-euro area are not perfectly aligned. Growth is now much stronger in Eastern Europe, and the output gap has turned positive earlier than in the euro-area. Inflation has also reemerged in non-euro area. Some of it is cyclical, as it comes from international commodity prices, other supply side factors, but also from a strong domestic demand. Yet, some of it is structural, as any catching-up process is inflationary in nature. Higher wage growth pressure is normal, up to a point, in view of large wage differentials, migration flows, and labor market tightening. Despite the wage growth, CEE countries are becoming increasingly competitive, as productivity also grows. This is why the current account position of non-euro member states is better now than before the crisis. The monetary policy normalization cycle runs also at a different pace. Even within CEE countries, while the monetary stance remains largely accommodative, the situation is quite heterogeneous regarding inflationary expectations, policy objectives, and policy tools used. As regards Romania, we started the tightening of monetary policy by hiking the rate twice this year, after further narrowing the corridor around the policy rate last year, but a gradual approach is warranted by the need to avoid sharp currency appreciation in the regional context. In our case, the policy normalization has been supported by two favorable developments in the banking sector.

Given the scope, relevant intelligence on threats and attack types is drawn together from threat intelligence providers, including government sources, and is used to design a series of tests that mimic the methods that are most likely, according to the threat intelligence, to be deployed against the firm. The companies providing the penetration test are accredited within a framework that has benefitted from GCHQ input and delivery of the test is within a controlled testing process agreed between the firm, the authorities and the test provider. The results should provide firms – and us – with a direct read on the robustness of their defences to more sophisticated attack types and a gaps analysis so that firms know what steps they need to take to improve their resilience. This is not a regulatory requirement though we are encouraging firms to participate. Rather it is a voluntary process. But we think the benefits to firms of CBEST are significant. This is why the FPC in December encouraged firms to undergo a CBEST as “soon as practicable” 5. By going through this process, firms will not only understand where their vulnerabilities lie, but also which threats should cause them most concern and what steps they should take to combat them. Access to direct feeds of commercial and government intelligence, via accredited red team testing by cyber experts, ensures that the test involves the most up-to-date threats, most relevant to their specific situation. And we are keen for other sectors, and other jurisdictions, to benefit from our experiences 6.