capital buffer ”, speech by the vice chair for supervision, randal k. quarles, at the program on international financial systems conference, frankfurt, germany, 5 september 2019. european central bank directorate general communications sonnemannstrasse 20, 60314 frankfurt am main, germany tel. : + 49 69 1344 7455, e - mail : media @ ecb. europa. eu website : www. ecb. europa. eu reproduction is permitted provided that the source is acknowledged. media contacts related topics macroprudential policy stress tests resilience banking supervision banking sector disclaimer please note that related topic tags are currently available for speeches and introductory statements to the press conferences ( with q & a ) from 2018 - 19 only. copyright 2019, european central bank policies

for fmis and overseers alike, the croe sets out three levels of increasingly demanding expectations, tailored to the size of the fmi. to complement the croe, the ecb has also developed another tool : the european threat intelligence based ethical red team testing framework ( tiber - eu ). by means of “ ethical hacking ”, red teaming helps to assess a financial institution ’ s ability to withstand a cyber - attack. tiber - eu serves to guide authorities and financial institutions in conducting threat - intelligence based red teaming, and to avoid duplication through the emergence of similar pan - european tests. but testing the resilience of individual fmis or banks may not be sufficient. the financial system is highly interconnected and any cyber - attack could thus trigger contagion. this is why the ecb hosted a market - wide crisis communication exercise, unitas, in june 2018. unitas facilitated a discussion among pan - european financial infrastructures on a scenario in which a cyberattack resulted in a loss of data integrity and a knock - on effect on other financial infrastructures. the exercise revealed that there were weaknesses at the european level, which are now being followed - up on by the euro cyber resilience board for pan - european financial infrastructures, or ecrb for short. this brings me to the third pillar of our strategy, which seeks to foster strategic engagement between regulators and industry. the ecrb was established in 2018 with the aim of facilitating trust and collaboration among fmis and authorities and encouraging joint initiatives. moving on to banking supervision, the ecb banking supervision has addressed it and cyber risk from various angles. first, we have been conducting thematic reviews since 2015 on the topic in the banks that we directly supervise. these gave us a more detailed understanding of the scope of the problem. moreover, the latest horizontal analysis of it risk conducted in 2018 has revealed deficiencies in it security risk management at several banks. for instance, banks ’ general risk management frameworks sometimes fail to specifically include it risk. a significant number of banks have 2 / 3 bis central bankers'speeches critical processes that depend on systems which are close to, or have already reached, their end of life. this, in turn, makes them more vulnerable to cyber threats. we also see a failure to rapidly address critical findings in the area of it security. in addition, it outsourcing is increasing, and many supervised institutions outsource their it to a single provider. a classic case