In framing this question, I asked my team to identify the cascading elements of supervisory guidance, oversight requirements, compliance regimes, and maturity frameworks with which we must contend related to risk management and information security. Their list in reply included 17 elements, admittedly some of which are self-induced and at different states of maturity and implementation. All are well intended, all are well designed, and all seek to address different and meaningful dimensions of the control environment. At the same time, compliance across this waterfront has become a consuming pre-occupation, and arguably one that if we are not careful can intrude upon the more tangible actions, and commitments, to increase the resiliency of our infrastructures and enhance the security of our networks. Make no mistake: some form of risk management and control framework and corresponding policy and oversight guidance is absolutely essential to ensure a necessary discipline and accountability. This is not a call for a collective policy/supervisory/industry confab to craft a consolidated and harmonized uber-framework applicable to all parties in every circumstance— that would be as naïve as it is impractical. Indeed, the proliferation of frameworks can serve as a useful prism to ensure that no stone is left unturned in the development of an FMI’s resiliency and security regime. It is an appeal for awareness among standards bodies, supervisors, directors, and other organizational hierarchies that their individual actions, as rational and defensible as they may be, can have a suffocating effect in the aggregate.

(The best aside I ever heard in such a disclaimer came from former Supreme Court Justice Scalia, who was speaking to the Economic Club of New York, coincidentally the same week of his untimely passing. Upon noting that the views expressed do not necessarily represent those of the Supreme Court or the Government of the United States he added, slyly, “they rarely do!” This may be one of those occasions.) Provocative Question Number 1: To what extent might the 2-Hour recovery time objective (known in industry parlance as the “2-Hour RTO”) alter the incentive structure and reaction function of an FMI operator responding to an “extreme but plausible” event, precipitating sub-optimal outcomes? Encouraging timely recovery following a severe disruption is a difficult thesis with which to argue, and our policy brethren are to be commended for urging financial market infrastructures (FMI) to examine critically their recovery capacities. This supervisory impulse has already yielded rich dividends in encouraging the wholesale services operated by the Reserve Banks to question assumptions, to consider out-of-the-box solutions, and to prioritize the achievement of technical diversity and the assurance of data integrity as anchor elements of our resiliency regime. At the same time, I wonder if specifying a two-hour threshold, notwithstanding its noble intent, may alter the incentives and the reaction function for a financial market infrastructure when responding to an extreme event. Could it, for example, encourage an FMI under duress to invoke prematurely contingency and failover procedures before an accurate diagnosis has been rendered?