Financial institutions must be convinced that there is a long term gain by hiring cyber risk specialists, including in-house specialists that can develop timely and customised solutions based on a deep understanding of the institution’s operating systems, business needs and organisational culture. There is also substantial scope for the financial  2  BIS central bankers’ speeches  industry to work more closely with telecommunications firms, internet service providers and other vendors to ensure that cyber criminals do not take advantage of external vulnerabilities to penetrate the security perimeter. In most countries, such initiatives lacked the coordination necessary to provide an effective system-wide defence against cyber crimes. Part of this change will be influenced by the attention and importance that supervisors place on the management of security risks. The role of supervisors and the public sector In the face of further digitisation of the financial sector, the responsibility of financial supervisors in ensuring the stability and integrity of the financial system will become increasingly challenging. Regulatory and supervisory frameworks need to be updated to acknowledge the significance of cyber security threats. It is necessary for us to establish a clear expectation on the management of such risks by financial institutions. We should outlined clearly in key areas that could cause threats such as outsourcing arrangements with third party service providers, stress testing, anti-money laundering requirements and business continuity plans.

To carry out our oversight responsibilities effectively, supervisors will also need to develop the capacity to assess and identify key vulnerabilities in the increasingly sophisticated web of information networks and systems upon which the financial sector depends. For one, supervisors need to arm themselves with the skills and knowledge to make assertive and rigorous assessments of a financial institution’s IT risks and be able to form judgments about the adequacy of control systems. Training and development programmes for supervisors should therefore give the same emphasis as other critical risks such as credit and market risk. The establishment of specialist supervisory teams or units dedicated to IT risks also plays an important role in building a strong knowledge base within supervisory authorities to support effective supervision of IT risks. Just like industry practitioners, it is imperative that any knowledge and skills acquired by supervisors are in tandem with the latest developments in both cyber security and cyber threats. Beyond efforts to build technical capabilities, supervisors and other law enforcement agencies also need to be equipped with the legal powers to investigate and prosecute cyber criminals. Given the borderless nature of cyber risk, this is a significant challenge. Cyber crimes can be launched from anywhere in the world, with targets in many countries. This underscores the need for a more coordinated global response that should involve criminal law enforcement agencies and financial regulatory authorities. In this regard, cross border collaboration must be intensified to establish information sharing arrangements on cyber risks and trends.