responding to malicious behaviors and incidents, because even the best preventative controls will not prevent all incidents. there is just no such thing as perfect protection. as there are more and more innovative financial inclusion initiatives coming on - board, we will all need to continually reassess how much risk and controls are appropriate. the disparity between the speed of compromise and the speed of detection is one of the starkest failures discovered in breach investigations. according to a 2015 report by mandiant, the average targeted malware compromise was present for 205 days before detection. the longest malware presence was 2982 days, and 69 % were actually discovered by external parties and not internal it security functions. additionally, the 2015 verizon data breach investigations report highlighted that, “ in 60 % of cases, attackers are able to compromise an organization within minutes. " in this digital world, the pace of change and innovation is already too fast to anticipate and, combined with advanced and persistent attacks, it will be impossible to defend against every type of cyber - attack. organisations must invest in technical, procedural and human capabilities to detect when a compromise occurs. they must provide the tools for first responders to react quickly and investigate the source and impact of breaches, compromises and incidents. most essentially, there is a need to balance the right mix of investments across prevention, detection and response capabilities vis - a - vis an organisation ’ s risk appetite. not only are new and advanced tools needed to supplement existing protection solutions, but also new skills and culture need to be developed within existing security teams and the larger organization, more so within the ambit of digital financial services whereby regulatory compliance plays a major role in cybersecurity. 2 / 3 bis central bankers'speeches regulatory compliance does not equal cybersecurity regulations are designed to protect organisations, clients, and consumers against the potentially devastating consequences of cyber - attacks. regulatory requirements for financial institutions have undeniably become tougher, and organisations are continuously burdened by the need to interpret what a fragmented global regulatory landscape means for their operations. financial institution often find themselves chasing regulatory compliance, rather than leading independent security planning. regulatory compliance by itself is not cybersecurity. when new cybersecurity requirements or frameworks are published, organisations must first determine their current security state and identify gaps. if routine testing and remediation are conducted, being compliant or meeting regulations should be easier to achieve. of course, some parties will want or need

duty to ensure and oversee the effective design and implementation of a sound control environment. work has also commenced to update and streamline the current regulatory guidelines on corporate governance for banks, insurers and takaful operators with a view to reduce the duplication across different standards and to sharpen the focus on the overall responsibility of the board for risk and control. existing prescriptive rules would give way to broader principles of behaviour. the review will also better align the regulatory framework with the current supervisory approach. a thematic review of the remuneration practices in the financial sector is also planned to take into account how it might influence risk - taking behaviours. also in train is a review of the supervisory process for assessing the suitability of persons that can serve on boards of financial institutions. this review will leverage on the work by the fide forum. looking further ahead, the financial sector blueprint sets out additional recommendations to further strengthen incentives and enablers for sound governance and risk management standards in anticipation of the growing complexities of our financial landscape. bis central bankers ’ speeches let me draw my remarks to a close. the task of providing stewardship, direction and oversight of financial institutions essentially falls squarely on the board. the responsibilities that go with this are great and i believe that we need the best directors in the financial industry – not just because of the importance of the financial sector to the broader economy, but because financial institutions, through their pervasive role in supporting economic activity, can be a powerful influence in raising the standards of corporate governance across corporate malaysia. i expect that the fide forum will have an instrumental role is realising this vision by professionalising the role of directors, and showing the way in the best governance practices. on our part, the bank greatly welcomes this initiative which will facilitate new opportunities for greater engagement with directors in the financial sector as a collective body, on regulatory issues and developments. on that note, it is my great pleasure to officially launch the fide forum. i wish it every success. bis central bankers ’ speeches