4  A fuller definition of financial stability is that the financial system shall fulfil its fundamental functions and be resilient to various shocks occurring, see the Riksbank (2013) The Riksbank and financial stability, Stockholm February 2013. BIS central bankers’ speeches  5  The static tools can be illustrated by adding a variable ( z ) denoting how regulation affects interest rate margins and credit terms in the simple definition of the lending rate:  itlending  it   t (z ) . The primary purpose of static regulation is to adapt resilience according to the structural factors which give rise to systemic risk, such as the size, concentration and degree of maturity transformation of the banks. The introduction of static regulation involves a one-time shift in the interest rate margin. Monetary policy may need to take account of this. Monetary policy must naturally also take account of the extent to which the measure affects the risks of financial instability ahead. However, variations in the view of risk-taking and credit growth also involve variations in systemic risk over time. A time-varying macroprudential policy tool is therefore also needed. This is also a way of attempting to make the regulation slightly cheaper, i.e. managing the balance between stability and efficiency. An example of time-varying regulation is the countercyclical capital buffer. It aims to induce banks and other financial institutions to build up capital buffers in good times, which they can then reduce in bad times.

Cyber security The consequences of cyberattacks can be considerable. What we are now witnessing is probably just the beginning. We must find a suitable way to mitigate risk, without making our systems needlessly expensive. Cyber-security challenges are among the most significant challenges to our payment system. Without an efficient defence system, trust in the system can be undermined over time. For its part, Norges Bank is devoting considerable resources to securing its systems, oversight of activities and implementing measures to protect against cyber attacks. As part of oversight and supervision, we will increase our monitoring of cyber-security risks in the payment system. This requires cooperation, both nationally and internationally, to identify and combat cyberattacks. Nationally, this takes place through, for example NorCERT, part of the Norwegian National Security Authority (NSM), and for the financial sector through the Norwegian Financial Sector Cyber Security Center (FinansCERT) under Bits. The Nordic financial sector has established 3/5  BIS central bankers' speeches  Nordic Financial CERT as an extension of the Norwegian FinansCERT. The need for cooperation does not stop at a Nordic level. The challenges are international, and are shared by private financial undertakings, their service providers and subcontractors and authorities in many countries. Measures to promote cyber security are technically complicated and require specialist expertise. But it is management and boards of directors in institutions and companies that have the final responsibility and decide strategy and resource use. This responsibility cannot be delegated or outsourced to others. Owners and managers must be aware of their ultimate responsibility.