of outstanding issues, these areas continue to present challenges in reaching the desired end state. • second, as i ’ m sure you would agree, we collectively still have quite a bit of work to do to fully implement all of the changes required under new rules and regulations. and, we must continue to devote sufficient attention and resources to complete the efforts. at the same time, though, it is important to take stock of the changes made over the past few years – for two important reasons : first, to assess the impact of those changes, both intended and unintended ; and, second, to understand the contours of the “ new ” financial system operating under the range of new rules and regulations, both national and global in nature. such a stocktaking is important to bis central bankers ’ speeches ensure that we collectively understand how the “ new ” financial system is operating. firms and supervisors will continue to face challenges and competing demands as we press, in the months and years ahead, on implementing necessary changes and assessing the “ new ” financial system. what the future holds one of the topics that i feel will compete for, and will deserve, a lot of attention in the foreseeable future is cybersecurity. i am often asked about my list of “ things that keep me awake at night, ” and i think it ’ s fair to say that cybersecurity is at the top of that list – as i ’ m sure it is for many of you in this room. in fact, i think cybersecurity is one of the topics that should be on everyone ’ s list – from the most senior managers and boards of directors, all the way down to line managers. cybersecurity is not a topic or an issue just for the information technology staff or the cio to address ; it is a risk that isn ’ t exclusive in who, what or where it targets. • it is a risk that is difficult to clearly define. • it is a risk that is constantly evolving. • it is a risk that is not limited to one source. • it is a risk that is faced by every single financial firm, regardless of size or complexity. • in fact, it is a risk that is faced by every business, organization, school, church or group that uses technology. in other words, no company is immune ( unless, of course, you operate an all cash business from a brick and mortar store and keep your earnings under your mattress – not

something we see a lot of in today ’ s world ). the financial sector, in particular, is under unprecedented attack from a broad spectrum of intent and attack methods that are complex, widely distributed, and increasingly interconnected. these highly dynamic systems give rise to the “ new normal ” – system design and architecture that needs to support rapid and compartmentalized change. so, where do we begin when we look at a risk of this magnitude? and, how do we get our arms around the many associated risks that surround it? let me begin with what it is not. cybersecurity is not an “ information technology ” issue. it is not a risk that can be addressed by simply having a strong it team in place. it is not a risk that just affects a firm ’ s technology – it affects the business itself, in every aspect – the bottom line, reputation, processes, and so much more. however, information technology and cybersecurity are intrinsically linked. i ’ d like to cover both of these issues in my remaining remarks and focus on several of the underlying issues that need to be addressed. information technology and legacy issues the first dimension is legacy : there is still a great deal of “ clean - up ” to do to fix longstanding technology and data issues that have built up over the years. the investments necessary are long - term and the fixes, in many cases, will take multiple years to execute. the range of issues include : systems or processes that are manual or not fully automated ; asset management tools that are drastically insufficient ; and business processes and models built without security requirements, to name but a few. as firms address these challenges, they must also be flexible and agile enough to keep up with the changing environment and incorporate new developments as they arise. while a number of firms have sound programs in place to address these longstanding issues, strong bis central bankers ’ speeches project management and tenacity will be crucial to see them through. in addition, continued prioritization and commitment of resources, as well as support from the firm ’ s senior management and board of directors, are critical. i see commitment to this basic “ blocking and tackling ” as essential to financial institutions ’ continuing to be competitive – and relevant – in the digital world. while the legacy issues need to be addressed in the near - term and quickly, we can ’ t hold off on addressing the vast number of issues around cyber – since cyber is upon us now. information technology