financial system. in june, the chancellor announced that the government would amend the bill to give the fpc a secondary objective so that, subject to being content on the first objective, it should support the economic policy of the government, including its objectives for growth and employment. currently, the fpc is acting in an interim capacity to undertake as far as possible the future statutory fpc ’ s macroprudential role. these two objectives contain the same “ subject to that ” language used in 1997 in the monetary policy committee ’ s objectives. it means that there is a hierarchy of objectives which the fpc must observe. but, two further points are relevant here. first, resilience and economic growth interact, so they are not fully independent. an economy that displays stable growth is more likely to have a stable financial system, and vice versa. second, policy is necessarily forward - looking, in that we are concerned with stability and growth in the future, since today ’ s outcomes are so to speak, “ baked in ”. this means that, in thinking about the hierarchy of objectives, in my view we have to take a forward - looking assessment of the probability of success, rather than saying we should complete one and then do the other. financial stability is more complicated than monetary policy in at least one respect, namely that it does not reduce to a single target expressed as a number. rather, it comes in the form of recommendations, in the plural, expressed as words. you would think that as central bankers and public officials we should love that, spending our time crafting language in a form that only we really understand. let ’ s not get carried away here – there is a danger that bis central bankers ’ speeches by doing so we create uncertainty about our intentions. this danger of creating uncertainty exists because we are finding our way in a new and difficult area of policy. i want to try to cast more light on the issues here. but, i would note that, in the history of monetary policy, regime changes have had to deal with the challenge of crafting communication that avoids creating more uncertainty. we have two, hierarchical, objectives : simply put, the resilience of the financial system, and the objective of encouraging growth ( the counter - cyclical objective ). these two can point in opposite directions, for instance in terms of banks ’ ratios of capital to assets. the fpc has recommended that banks should strengthen their buffers of capital. what is meant by this?

uk and foreign banks active in london and the key payment and settlement systems, clearing houses and exchanges that together are critical for delivery of the financial services that the wider economy depends on. the questionnaire provided for a detailed self - assessment by firms of how they organise their cyber defences. its purpose was to enable uk authorities to take stock of resilience across the sector and identify best practice across firms. part of this was to be able to play back to individual firms where they stood relative to best practice. but lying behind this is the objective of raising resilience in individual firms by ensuring that the network as a whole is resilient. and given the importance of these firms to the stability of the financial system, this implies a level of resilience that goes beyond basic cyber hygiene but aims instead to ensure that firms are in a position to manage advanced persistent threats ( apt ) that are the hallmark of some statesponsored attackers. we are currently discussing the results from these questionnaires directly with firms. you will appreciate that i cannot go into specifics. but overall the responses did not reveal any immediate critical shortcomings in the cyber resilience of the firms involved. but they did point to areas for improvement that we will be following up on with firms. let me list some common themes. 1. cyber has changed the rules : existing operational resilience arrangements are often geared to dealing with physical threats. these still matter. but cyber changes the game. cyber is a dynamic, intelligent and adaptive threat. in the cyber arms race, costs are stacked in favour of the attacker, not the defender. to meet the challenge, organisations need to have policies and processes that are dynamic, intelligent and adaptive too. this means investment in capability to identify threats and detect cyber attacks. without this situational awareness it is hard to determine and achieve appropriate maturity levels for cyber defence and to allocate resources effectively to meet the threat. 2. cyber is not a minority sport for technologists only : of course the first line of defence is critical and we still need it specialists who understand the technical challenges cyber presents. but good cyber resilience is about much more than technology. it is about culture too and this means people and processes. when morgan stanley reported recently its customer information had been breached, this wasn ’ t due to sophisticated hackers, rather an employee who stole data from over 350, 000 customer accounts. all parts of an organisation need to understand cyber risk and their responsibilities