##ystem also developed the european framework for threat intelligencebased ethical red teaming ( tiber - eu ) 3. red teaming helps entities assess, by means of controlled “ ethical hacking ”, if and how they are capable of withstanding a cyberattack. and because tiber - eu involves high - end testing on live production systems, we are currently reflecting on how to foster an accreditation and certification capability in the eu. this would allow cybersecurity service providers to raise standards around threat intelligence and red team testing and to have their capabilities in this field validated. i am pleased to say that, since its publication, tiber - eu has been implemented – or is currently being implemented – in belgium, denmark, germany, ireland, the netherlands, romania and sweden, and by the ecb in its oversight capacity. the ecb is also in close dialogue with other eu and non - eu jurisdictions that are considering tiber - eu as a tool for their respective financial sectors. the gradual roll - out of tiber - eu will ensure that threat - led penetration testing is conducted in a harmonised way across the eu, avoiding duplication of work for financial entities and authorities alike. already in march 2018, at the first ecrb meeting, we presented the results of a cyber resilience survey that had been developed under the eurosystem oversight cyber resilience strategy. the survey had been conducted across more than 75 payment systems, central securities 1 / 2 bis central bankers'speeches depositories and central counterparties throughout europe. you will recall that the survey highlighted a number of weaknesses prevailing at the time, such as cyber governance, training and awareness, and cyber incident response. today we will update you on the second round of the cyber resilience survey, which we conducted again across mostly the same population of fmis throughout europe. the results have given us an insight into how the sector has progressed, and indeed, while we see improvement in some areas, there is still much to be done. when we established the ecrb, the aim was essentially to create a forum for strategic discussions at board level, to raise awareness of the topic of cyber resilience, to catalyse joint initiatives to develop effective solutions for the market and to share best practices and foster trust and collaboration. in this context, i am very pleased that the spirit of the ecrb is living up to expectations. as you will recall from the unitas crisis communication exercise last year 4, we identified

sabine lautenschlager : euro cyber resilience board for paneuropean financial infrastructures introductory remarks by ms sabine lautenschlager, member of the executive board of the european central bank, at the third meeting of the euro cyber resilience board for paneuropean financial infrastructures, frankfurt am main, 28 june 2019. * * * it is a pleasure to welcome you back to frankfurt. as you may know, i recently became responsible for market infrastructures and payments at the ecb. as this includes the ecb ’ s work on the cyber resilience of financial market infrastructures ( fmis ), i have taken over benoit cœure ’ s chairmanship of the euro cyber resilience board for pan - european financial infrastructures ( ecrb ). i would first like to thank benoit for his contribution in establishing the ecrb and for this opportunity to continue the excellent work on cyber resilience at european level which he has personally driven forward. six months have passed since our last meeting in december, during which time, all of us – whether on behalf of a public or private financial infrastructure, a supervisor or an overseer – have been busy enhancing the cyber resilience of our respective financial infrastructures and of the financial sector as a whole. but cybercriminals have been making progress too, and they remain persistent and relentless in their pursuits. as widely reported in the press, a major cyber incident occurred at a significant bank earlier this year, seriously affecting the real economy in a specific european country. this publicly known incident reminds us of the debilitating impact a cyberattack can have on our financial system. so the need for continued vigilance, work and collaboration in this field is imperative. you will recall that – in december 2018 – the ecb published its cyber resilience oversight expectations1, a tool meant for both fmis and overseers. these expectations contain detailed best practices for implementing the cpmi - iosco cyber guidance2 and are now being followed by fmi operators at national and european level. overseers are working with their respective fmis to ensure that they do what is necessary to enhance their cyber resilience. i am also pleased that the world bank has recently embraced our cyber resilience oversight expectations with a view to boosting the cyber resilience of fmis in developing and emerging countries under its mandate, and consequently promoting global harmonisation. last year, the euros