Effective Practices for Cyber Incident Response and Recovery: overview of public consultation

| PDF full text (147 KB)

On 20 April 2020, the FSB published a consultative document on Effective Practices for Cyber Incident Response and Recovery. The FSB received 58 responses to the public consultation from banks, insurers, industry associations and public authorities. In addition, the FSB held four virtual outreach meetings in early July, reaching out to over 300 private sector participants, to receive feedback on lessons learnt from the COVID-19 pandemic and on the consultative document.

This note summarises the main points from the responses, including to the specific questions set out in the consultation, and provides an overview of the response to those comments, including changes made to the recommendations.

Effective Practices for Cyber Incident Response and Recovery: Final report

| PDF full text (431 KB)

Cyber incidents pose a threat to the stability of the global financial system, and the remote working environments in light of the COVID-19 pandemic have heightened the need for attention. A significant cyber incident, if not properly contained, could seriously disrupt the financial system, including critical financial infrastructure, leading to broader financial stability implications. Efficient and effective response to and recovery from a cyber incident is essential to limiting any related financial stability risks. Such risks could arise, for example, from interconnected information technology systems between multiple financial institutions or between financial institutions and third-party service providers from loss of confidence in a major financial institution or group of financial institutions, or from impacts on capital arising from losses due to the incident. The cyber resilience of organisations is crucial for the smooth functioning of the financial system and in engendering financial stability.

Enhancing cyber incident response and recovery at organisations is an important focus for national authorities. National authorities are in a unique position to gain insights on effective cyber incident response and recovery activities in financial institutions from their supervisory work, and their observations across multiple organisations can help suggest areas for enhancement. Authorities also have an important role to play in responding to cyber incidents that present potential risks to financial stability. Authorities may also, as appropriate, support organisations in sharing information to protect against threats that could have a detrimental impact on financial stability.

The toolkit includes 49 practices for effective cyber incident response and recovery across seven components: (i) governance, (ii) planning and preparation, (iii) analysis, (iv) mitigation, (v) restoration and recovery, (vi) coordination and communication, and (vii) improvement. The final toolkit draws on the feedback from a public consultation process, including four virtual outreach meetings. The report was delivered to G20 Finance Ministers and Central Bank Governors for their October meeting.

This final version of the toolkit drew on feedback provided during a public consultation, including four virtual stakeholder workshops. The report was delivered to G20 Finance Ministers and Central Bank Governors for their October meeting.

FSB encourages use of cyber incident response and recovery toolkit

Press enquiries:
+41 61 280 8138
[email protected]
Ref no: 41/2020

The Financial Stability Board (FSB) today published a toolkit of effective practices for financial institutions’ cyber incident response and recovery. The FSB encourages authorities and organisations to use the toolkit to enhance their cyber incident response and recovery activities.

Cyber incidents pose a threat to the stability of the global financial system, and the remote working environments in light of the COVID-19 pandemic have heightened the need for attention. A significant cyber incident, if not properly contained, could seriously disrupt the financial system, including critical financial infrastructure, leading to broader financial stability implications. Efficient and effective response to and recovery from a cyber incident is essential to limiting any related financial stability risks. Such risks could arise, for example, from interconnected information technology systems between multiple financial institutions or between financial institutions and third-party service providers from loss of confidence in a major financial institution or group of financial institutions, or from impacts on capital arising from losses due to the incident. The cyber resilience of organisations is crucial for the smooth functioning of the financial system and in engendering financial stability.

Enhancing cyber incident response and recovery at organisations is an important focus for national authorities. National authorities are in a unique position to gain insights on effective cyber incident response and recovery activities in financial institutions from their supervisory work, and their observations across multiple organisations can help suggest areas for enhancement. Authorities also have an important role to play in responding to cyber incidents that present potential risks to financial stability. Authorities may also, as appropriate, support organisations in sharing information to protect against threats that could have a detrimental impact on financial stability.

The toolkit includes 49 practices for effective cyber incident response and recovery across seven components: (i) governance, (ii) planning and preparation, (iii) analysis, (iv) mitigation, (v) restoration and recovery, (vi) coordination and communication, and (vii) improvement. The final toolkit draws on the feedback from a public consultation process, including four virtual outreach meetings. The report was delivered to G20 Finance Ministers and Central Bank Governors for their October meeting.

The FSB also published today an overview of the main issues raised in its public consultation, and describes the changes made to the final toolkit to address them.

Notes to editors

In 2017, the FSB published a Summary Report on Financial Sector Cybersecurity Regulations, Guidance and Supervisory Practices, as an initial step to promote cross-border cooperation in this area.

In 2018, the FSB published a Cyber Lexicon, which comprises a set of approximately 50 core terms related to cyber security and cyber resilience in the financial sector. It is intended to support the work of the FSB, standard-setting bodies, authorities and private sector participants, e.g. financial institutions and international standards organisations, to address financial sector cyber resilience.

The FSB coordinates at the international level the work of national financial authorities and international standard-setting bodies and develops and promotes the implementation of effective regulatory, supervisory, and other financial sector policies in the interest of financial stability. It brings together national authorities responsible for financial stability in 24 countries and jurisdictions, international financial institutions, sector-specific international groupings of regulators and supervisors, and committees of central bank experts. The FSB also conducts outreach with approximately 70 other jurisdictions through its six Regional Consultative Groups.

The FSB is chaired by Randal K. Quarles, Vice Chairman, US Federal Reserve; its Vice Chair is Klaas Knot, President of De Nederlandsche Bank. The FSB Secretariat is located in Basel, Switzerland, and hosted by the Bank for International Settlements.

Effective Practices for Cyber Incident Response and Recovery

View the Standard

The FSB has developed a toolkit of effective practices that aims to assist organisations in their cyber incident response and recovery activities. In this regard, organisations’ respond function executes the appropriate activities in reaction to a detected or reported cyber incident, while the recover function carries out the appropriate activities to restore any systems, capabilities or resume services or operations that were impaired due to a cyber incident.

The toolkit includes 49 practices for effective cyber incident response and recovery across seven components: (i) governance, (ii) planning and preparation, (iii) analysis, (iv) mitigation, (v) restoration and recovery, (vi) coordination and communication, and (vii) improvement. The final toolkit draws on the feedback from a public consultation process, including four virtual outreach meetings. The report was delivered to G20 Finance Ministers and Central Bank Governors for their October meeting.

FSB publishes global transition roadmap for LIBOR

Press enquiries:
+41 61 280 8138
[email protected]
Ref no: 40/2020

The Financial Stability Board (FSB) today published a global transition roadmap for LIBOR. The roadmap sets out a timetable of actions for financial and non-financial sector firms to take in order to ensure a smooth LIBOR transition by end-2021.

In July the FSB reaffirmed that financial and non-financial sector firms across all jurisdictions should continue their efforts to make wider use of risk-free rates in order to reduce reliance on IBORs where appropriate and in particular to remove remaining dependencies on LIBOR by the end of 2021.

The LIBOR benchmarks are not guaranteed to continue to be available after end-2021 and therefore preparations should be underway to reduce reliance on these rates well ahead of that point. Use of LIBOR in the five LIBOR currencies (USD, GBP, EUR, JPY and CHF) is widespread internationally. Transition away from LIBOR by end-2021 requires significant commitment and sustained effort from both financial and non-financial institutions across many LIBOR and non-LIBOR jurisdictions.

This Global Transition Roadmap for LIBOR is intended to inform those with exposure to LIBOR benchmarks of some of the steps they should be taking now and over the remaining period to end-2021 to successfully mitigate these risks. These are considered prudent steps to take to ensure an orderly transition by end-2021 and are intended to supplement existing timelines/milestones from industry working groups and regulators. Among the steps in the Roadmap:

  • Firms should have already, identified and assessed all existing LIBOR exposures and agreed on a project plan to transition in advance of end-2021.
  • By the effective date of the ISDA Fallbacks Protocol, the FSB strongly encourages firms to have adhered to the Protocol.
  • By the end of 2020, firms should be in a position to offer non-LIBOR linked loans to their customers.
  • By mid-2021, firms should have established formalised plans to amend legacy contracts where this can be done and have implemented the necessary system and process changes to enable transition to robust alternative rates.
  • By end-2021, firms should be prepared for LIBOR to cease.

Notes to editors

The FSB set out in 2014 a series of recommendations for strengthening key interbank offered rates (IBORs) in the unsecured lending markets, and for promoting the development and adoption of alternative nearly risk-free reference rates, where appropriate. The FSB and member authorities, through the FSB Official Sector Steering Group (OSSG) chaired by Andrew Bailey (Governor, Bank of England) and John C. Williams (President and CEO, Federal Reserve Bank of New York), are working to implement and monitor these recommendations. The FSB published its most recent annual progress report in December 2019 on implementation of the recommendations.

In July 2020, the FSB and Basel Committee on Banking Supervision published a report on supervisory issues associated with benchmark transition, setting out recommendations for authorities to support financial institutions’ and their clients’ progress in transitioning away from LIBOR.

The FSB coordinates at the international level the work of national financial authorities and international standard-setting bodies and develops and promotes the implementation of effective regulatory, supervisory, and other financial sector policies in the interest of financial stability. It brings together national authorities responsible for financial stability in 24 countries and jurisdictions, international financial institutions, sector-specific international groupings of regulators and supervisors, and committees of central bank experts. The FSB also conducts outreach with approximately 70 other jurisdictions through its six Regional Consultative Groups.

The FSB is chaired by Randal K. Quarles, Vice Chairman, US Federal Reserve; its Vice Chair is Klaas Knot, President of De Nederlandsche Bank. The FSB Secretariat is located in Basel, Switzerland, and hosted by the Bank for International Settlements.

Global Transition Roadmap for LIBOR

| PDF full text (174 KB)

This roadmap sets out clear actions for financial firms and their clients to take in order to ensure a smooth LIBOR transition.

Interest rate benchmarks play a key role in global financial markets. In 2014 the FSB made recommendations to reform interbank offered rates (IBORs) in response both to cases of attempted manipulation and to declining liquidity in key interbank unsecured funding markets.

In July the FSB reaffirmed that financial and non-financial sector firms across all jurisdictions should continue their efforts to make wider use of risk-free rates in order to reduce reliance on IBORs where appropriate and in particular to remove remaining dependencies on LIBOR by the end of 2021. Additionally, in July 2020, the FSB and Basel Committee on Banking Supervision published a report on supervisory issues associated with benchmark transition, setting out recommendations for authorities to support financial institutions’ and their clients’ progress in transitioning away from LIBOR. 

The LIBOR benchmarks are not guaranteed to continue to be available after end-2021 and therefore preparations should be underway to reduce reliance on these rates well ahead of that point. Use of LIBOR in the five LIBOR currencies (USD, GBP, EUR, JPY and CHF) is widespread internationally. Transition away from LIBOR by end-2021 requires significant commitment and sustained effort from both financial and non-financial institutions across many LIBOR and non-LIBOR jurisdictions.

This Global Transition Roadmap for LIBOR is intended to inform those with exposure to LIBOR benchmarks of some of the steps they should be taking now and over the remaining period to end-2021 to successfully mitigate these risks. These are considered prudent steps to take to ensure an orderly transition by end-2021 and are intended to supplement existing timelines/milestones from industry working groups and regulators. Among the steps in the Roadmap:

  • Firms should have already, identified and assessed all existing LIBOR exposures and agreed on a project plan to transition in advance of end-2021.
  • By the effective date of the ISDA Fallbacks Protocol, the FSB strongly encourages firms to have adhered to the Protocol.
  • By the end of 2020, firms should be in a position to offer non-LIBOR linked loans to their customers.
  • By mid-2021, firms should have established formalised plans to amend legacy contracts where this can be done and have implemented the necessary system and process changes to enable transition to robust alternative rates.
  • By end-2021, firms should be prepared for LIBOR to cease.

Market Fragmentation: updates on ongoing work

| PDF full text (219 KB)

This report provides an update on work by the FSB, in collaboration with the international standard setting- bodies, to address market fragmentation. The report was delivered to G20 Finance Ministers and Central Bank Governors ahead of their meeting in October.

In June 2019, the FSB identified four areas for further work to address market fragmentation: This latest progress report provides an update on work in these areas:

  • Deference. The International Organization of Securities Commissions published a Report on Good Practices on Processes for Deference in June 2020 that should help authorities to mitigate the risk of unintended, regulatory-driven, fragmentation in wholesale securities and derivatives markets.

  • Pre-positioning of capital and liquidity. FSB members are continuing work related to the distribution of resources within global systemically important banks (G-SIB) having regard to the need to achieve a balance between certainty for host jurisdictions and flexibility to deploy resources where needed within a group in times of stress. The FSB is also working on identifying ways to further promote effective cooperation and coordination in crisis times.

  • Regulatory and supervisory coordination and information sharing. Regulatory and supervisory coordination and information sharing have focused on policy measures taken in response to COVID-19. The FSB has established a repository of regulatory and supervisory policy measures taken in its member jurisdictions in response to the COVID-19 pandemic. The FSB is also exploring potential ways to facilitate convergence in reporting of data to authorities.

  • “Too-big-to-fail” (TBTF) evaluation. The FSB has publicly consulted on its evaluation on the effects of TBTF reforms for systemically important banks. The evaluation finds no evidence that the implementation of reforms has reduced cross-border lending.

Looking beyond these specific areas, the policy response to COVID-19 has underlined policymakers’ awareness of harmful effects of market fragmentation. The official sector community has provided a rapid and coordinated response to support the real economy, maintain financial stability and minimise the risk of market fragmentation. 

FSB updates on work to address market fragmentation

Press enquiries:
+41 61 280 8138
[email protected]
Ref no: 39/2020

The Financial Stability Board (FSB) today published an update on work by the FSB, in collaboration with the international standard setting-bodies, to address market fragmentation. The report was delivered to G20 Finance Ministers and Central Bank Governors ahead of their meeting today.

In June 2019, the FSB identified four areas for further work to address market fragmentation: This latest progress report provides an update on work in these areas:

  • Deference. The International Organization of Securities Commissions published a Report on Good Practices on Processes for Deference in June 2020 that should help authorities to mitigate the risk of unintended, regulatory-driven, fragmentation in wholesale securities and derivatives markets.

  • Pre-positioning of capital and liquidity. FSB members are continuing work related to the distribution of resources within global systemically important banks (G-SIBs) having regard to the need to achieve a balance between certainty for host jurisdictions and flexibility to deploy resources where needed within a group in times of stress. The FSB is also working on identifying ways to further promote effective cooperation and coordination in crisis times.

  • Regulatory and supervisory coordination and information sharing. Regulatory and supervisory coordination and information sharing have focused on policy measures taken in response to COVID-19. The FSB has established a repository of regulatory and supervisory policy measures taken in its member jurisdictions in response to the COVID-19 pandemic. The FSB is also exploring potential ways to facilitate convergence in reporting of data to authorities.

  • “Too-big-to-fail” (TBTF) evaluation. The FSB has publicly consulted on its evaluation on the effects of TBTF reforms for systemically important banks. The evaluation finds no evidence that the implementation of reforms has reduced cross-border lending.

Looking beyond these specific areas, the policy response to COVID-19 has underlined policymakers’ awareness of harmful effects of market fragmentation. The official sector community has provided a rapid and coordinated response to support the real economy, maintain financial stability and minimise the risk of market fragmentation. 

Notes to editors

The FSB coordinates at the international level the work of national financial authorities and international standard-setting bodies and develops and promotes the implementation of effective regulatory, supervisory, and other financial sector policies in the interest of financial stability. It brings together national authorities responsible for financial stability in 24 countries and jurisdictions, international financial institutions, sector-specific international groupings of regulators and supervisors, and committees of central bank experts. The FSB also conducts outreach with approximately 70 other jurisdictions through its six Regional Consultative Groups.

The FSB is chaired by Randal K. Quarles, Vice Chairman, US Federal Reserve; its Vice Chair is Klaas Knot, President of De Nederlandsche Bank. The FSB Secretariat is located in Basel, Switzerland, and hosted by the Bank for International Settlements.

FSB Chair’s letter to G20 Finance Ministers and Central Bank Governors: October 2020

| PDF full text (139 KB)

The letter notes the extraordinary challenges for the global financial system this year. The FSB will provide a comprehensive report on the financial stability implications of, and policy responses to, the COVID Event to the November G20 Summit, including a holistic review of the market turmoil in March. The holistic review will inform future steps of the FSB in 2021 under the Italian G20 Presidency to improve the resiliency of the NBFI sector while preserving its benefits.

Meanwhile, the FSB has not lost sight of important ongoing work in financial innovation, payments systems, cyber resilience, and market fragmentation. The FSB is submitting to the G20 work addressing issues at the frontier of financial innovation and technology, including:

  • a toolkit of effective practices that the FSBencourages regulators and financial institutions to use to respond to and recover from the negative impacts of a cyber incident; 

  • an examination ofthe impact that BigTech firms have on emerging market and developing economies; 

  • an assessment ofhow SupTech and RegTech technologies may improve authorities’ supervisory capabilities and institutions’ regulatory compliance; and

  • high-level recommendations for regulatory, supervisory, and oversight responsesto so-called “stablecoin” instruments, by applying the lens of ‘same activity – same risk – same rules’.

This work aims to provide the regulatory community with additional tools to quickly assess and mitigate the risks posed by such changes without tempering the benefits. It also reflects the fundamental role international coordination plays in creating a resilient financial system that seeks to avoid harmful market fragmentation.

The letter also describes the FSB’s high-level roadmap for developing cross-border payment systems and processes that are faster, more inclusive, less expensive, and more transparent. While the actions that form the overall roadmap are ambitious they are achievable with the continued support from the G20.

In addition, the FSB continues is working on a variety of fronts to promote a resilient and integrated global financial system. The financial stability implications of climate-related risks remain a topic of great interest for the FSB’s membership and the international community. In addition, the FSB continues with other global standard-setting bodies in efforts to address market fragmentation.