regulators and supervisors. the same principle has already been emphasised in the european general data protection regulation which entered into force some months ago. it gives us one more reason to enforce this principle. page 2 sur 3 3 ) the third consideration regards speed : the capacities to resume critical activities within two hours after a cyber - attack, the two - hour recovery time objective mentioned by benoit. in this regard, in today ’ s environment it would be both unrealistic and unwise to resume activities without ensuring first that it data have not been corrupted or that recovery of the activity affected does not trigger a higher risk exposure on its own, and for the whole financial ecosystem. ii. three short - term concrete measures now, i would like to share three initiatives that the banque de france is striving to encourage : 1 ) promoting a homogeneous approach to conducting penetration tests among various players in the financial sector. from this perspective, the tiber - eu framework that the ecb provided earlier this year is a tool that would be helpful to implement in order to test the resilience of the financial system and especially the capacity of cross - border companies. in this respect, tiber - eu will have to be rolled out at the national level, especially for testing market infrastructures, while taking into account specific local aspects and respecting core requirements in terms of responsibilities, risk management and the conduct of the tests. through “ coordinated frameworks ” it will therefore be possible to achieve the much - needed harmonisation of practices and a mutual recognition of tests across the european union. 2 ) carrying out simulation exercises in the particular context of extreme but plausible cyber - attack scenarios, possibly including cross - border exercises. against the backdrop of the rising number of cyber - attacks in the financial sector, there is a need to supplement on - site and off - site supervision, beyond merely conducting response exercises at domestic level, and possibly even across many countries at the same time. the g - 7 has given priority to the enhancement of cross - border coordination in the event of a significant cyber incident : the banque de france chairs the sub - group in charge of preparing and performing this exercise in 2019. such an initiative could usefully be extended to include similar simulation exercises at the domestic level, and even across many countries at the same time. this would help to meet the following objectives : ( i ) assess the degree of preparation of all stakeholders, namely financial institutions as well as public authorities ; ( ii ) be sure of their

capacity to implement common and consistent measures in order to restart operations after a cyber - attack ; page 3 sur 3 ( iii ) test dedicated crisis communication tools. 3 ) monitoring the degree of cyber security and the progress of cyber resilience programmes. irrespective of the nature of our organisation ( a central bank, a commercial bank, an insurance company, a fmi ), we have to not only deal with a large number of cyber security issues, but also to coordinate a large number of stakeholders ( boards, senior executives, chief information officers, chief risk officers, chief information security officers, etc., ). therefore it is of utmost importance, but at the same time difficult to obtain an overview of cyber security. all levels of management ( technical, operational and executive ) need to have appropriate information to monitor cyber resilience and cyber risks. above all, monitoring cyber security at the executive level ( “ tone at the top ” ) may prove to be challenging. of course, there is a broad range of different metrics and it is necessary to select a limited number of them. for instance, if i had to mention three of them, i would choose : ( i ) overseeing the development of awareness and training within the organisation ; ( ii ) monitoring patch management in order to make sure that identified flaws are corrected in due time ; ( iii ) and, last but not least, capturing the effectiveness of the identification and authentication processes. in a nutshell, key indicators help to improve the governance of the it security system. * * to conclude, i believe that it is necessary to better structure the international governance of cyber security in the financial sector : it is clear that the different regulatory and supervisory authorities are aware of “ cyber risks ”. this is becoming apparent through the numerous initiatives at various levels ( domestic, european, and international ). while this is welcome, it is both delicate but necessary to strengthen international cooperation in order to ensure that there are neither loopholes nor overlaps and that there is convergence towards proposals and solutions that can easily be shared with others.