g7 2019 conference – banque de france, 10 may 2019 cybersecurity : coordinating efforts to protect the financial sector in the global economy conclusion by francois villeroy de galhau governor, banque de france press contact : mark deen ( mark. deen @ banque - france. fr ). page 1 sur 6 ladies and gentlemen, first, i would like to thank the moderators and the panelists for their very rich comments and the very useful ideas. we are all convinced that cybersecurity of the financial sector will remain on our agenda for a long time. the challenge is no longer about gaining awareness anymore, but to find ways to intensify and rationalise our action. based on the discussions today, let me start with one pre - requisite – coordination - and then propose concrete steps and tangible actions to improve our coordination in three areas : i. regulation and supervision ; ii. information ; iii. preparation. a. global threats, coordinated action panel 1 questioned the importance of cyber threats for the financial sector. there is a consensus that the level of cyber threats has never been so high, but at the same time, we must acknowledge that the capacity to anticipate attacks needs to be reinforced. following an attack, we need to address the potential contagion issues to the entire financial system or the entire economy. this is why coordination is a pre - requisite, not an easy one but a necessary one. while remaining realistic, there will not be a “ world organization for cybersecurity ” for obvious reasons, including trust. hence, coordination should be cross - jurisdictional. contagion can be global as our countries'financial systems are interconnected. this follows president macron's call for an " internet of trust " at the unesco forum in november 2018, which includes helping low - income countries to keep pace with developed countries. the imf and the world bank are encouraged to further develop their assistance program. in addition, coordination should be cross - sectors. the financial sector is not the only one concerned with cyber - attacks. other critical sectors are also at risk, some of which are essential to the functioning of the financial sector. this reinforces the importance of a cross - sectoral approach. national security agencies use this approach, and financial sector authorities page 2 sur 6 could also do the same at their level, taking into consideration the forthcoming g7 ceg fundamental elements. finally coordination should be cross - authorities,

is the reason why we need homogeneity among international regulatory texts with the largest outreach. who could lead this coordination role on cybersecurity regulation? the g7 expert group has been extremely successful in producing “ fundamental elements ”, but this group has no standard - setting role and its texts can only guide regulators in their work. i believe the fsb is best placed to engage the dialogue with the various standard - setters to foster the alignment of their texts, as well as to conduct global outreach, and limit the proliferation of working groups. ii. information cyber threats are increasing, but adequate and consistent measurement is challenging. i would like therefore to make two proposals : about incident reporting. many reporting obligations on cyber incidents have emerged, requested by various authorities. but these incident reports give little page 4 sur 6 information to measure the intensity and sophistication of threats and their evolution. the indicators requested vary from one report to another and this limits the scope of diagnosis and comparisons. the institutions themselves can struggle to transmit information about their incidents in different formats and with different details to the various authorities in charge. fsb agreed on a “ cyber lexicon ”. 1 as we have done in the past for operational risk, i recommend that we work on a common categorization of cyber incidents to better measure the impacts of attacks, and better understand their evolution. about information sharing and threat intelligence. as evidenced by panel 4, little information on cybersecurity is actually shared, due to sensitivity issues and trust. a pragmatic approach is for financial authorities to engage bilaterally in memoranda of understanding ( mous ) with authorities with whom they share mutual trust. singapore and hong - kong already paved the way. this can be done between g7 countries and among other trusted countries as well. iii. preparation for cyber crisis management through large scale exercises the third panel showed how valuable crisis simulations are in the building of an operational preparatory capacity. the exercises organized so far, at domestic or regional levels, allowed us to acquire experience in coordinating a response and the recovery during a major incident. our ambition must be as high as the risks to which our evolving and interconnected financial systems are exposed to, due to the increasing sophistication of cyber - attacks. in other words, and this is something that clearly emerged from today ’ s discussions, a more global approach to cyber resilience exercises is needed. in this regard, let me briefly insist on the g7 joint