michael s barr : measuring cyber risk in the financial services sector opening remarks by mr michael s barr, vice chair for supervision of the board of governors of the federal reserve system, at the conference on measuring cyber risk in the financial services sector, boston, massachusetts, 17 january 2024. * * * thank you for the opportunity to welcome you to day two of the second annual conference on measuring cyber risk in the financial services sector. 1 i'd like to thank the staff who organized this gathering from the massachusetts institute of technology, the federal reserve bank of richmond, and the federal reserve board. cyber threats are constantly evolving, and we can expect them to become increasingly disruptive as technology advances and our financial system becomes more interconnected. in the past few months, ransomware attacks have disrupted the ability of some financial institutions to offer a variety of banking and market services, including treasury clearance and settlement and access to online banking and atm operations. these incidents were resolved without significant disruption to the broader market, but they are stark reminders of the potential for cyber incidents to generate broader, even systemic risks, and the importance of addressing these risks. cybersecurity preparedness has become increasingly important for banks. banks must take action to uncover vulnerabilities in their systems and remedy those vulnerabilities before attacks occur. but focusing on cyber defense is not sufficient. it is important that banks also focus on resilience to successful cyber - attacks, including by developing and regularly testing business continuity plans. the federal reserve and other banking agencies work to make sure that banks and service providers are appropriately focused on cybersecurity and operational resilience. supervisors will continue to reinforce the need for appropriate risk management. reliance by banks on third - party service providers has grown considerably in recent years, and with that reliance comes the potential for greater cyber risk. 2 it is ultimately the responsibility of banks to manage their third - party risk, and we have historically seen gaps in this regard. last year, together with the other bank regulatory agencies, the federal reserve adopted guidance on effective management of third - party risk, based on the size and complexity of the bank and nature of the third - party relationship. the guidance provides some specific examples throughout the lifecycle of a third - party relationship, which should be helpful for banks as they strengthen their management of these risks. forums like today's conference are critical to improve how we think about and measure the presence of cyber risk in financial markets. the ability to

wrong ” exchange rate. from a formal point of view a currency board is hardly compatible with the framework of erm ii. euro - based currency board arrangements cannot be regarded as an acceptable substitute for participation in erm ii, neither can be any form of “ euroization ”. however, currency boards can be seen as a unilateral formal ex ante commitment augmenting the commitment to exchange rate stability deriving from participation in erm ii. the appropriateness of euro - based currency board arrangements therefore will have to be assessed on a case - by - case basis, avoiding any general encouragement to introduce such arrangements. v. the international role of the eurosystem allow me to discuss some institutional aspects of the role of the euro, in particular the eurosystem ’ s responsibility for the global monetary system. in this respect the question of the international representation of the eurosystem is relevant for the international role of the euro. the eurosystem as a new regime of global importance in the field of monetary and foreign exchange policy has to be represented externally in an appropriate manner and have commensurate representation in international bodies. at its meeting in december 1998 in vienna, the european council agreed on the principles for the external representation of the community in stage 3 of emu in international fora such as the g7 and the imf by endorsing the report of the ecofin council on this issue. since the external representation in stage 3 implied changes in the organisation of international fora, it was clear to the council that third countries and institutions would need to be persuaded to accept the solutions proposed by the eu. the council called for a pragmatic approach that should minimise the adoption of rules and practices, provided that it resulted in an outcome which gave proper recognition to the role of the euro. for representation concerning issues of particular relevance to emu ( article 109 section ( 4 ) ), the council suggested using early pragmatic solutions that should be developed over time and adhere to the following principles : • the community must speak with one voice ; • the community shall be represented at the council / ministerial level and at the central banking level ; and • the commission “ will be involved in the community ’ s external representation to the extent required to enable it to perform the role assigned to it by the treaty ”. at their meeting on 12 june 1999 in frankfurt, the g7 finance ministers agreed on changes to the format of meetings of g7 finance ministers and central bank