CREST publishes whole-ecosystem framework for cyber resilience in financial services
CREST, the global non-profit cybersecurity accreditation body, published a whitepaper on 29 October titled Cyber Resilience in Financial Services: A Whole Ecosystem Approach. The paper argues resilience should be coordinated across financial institutions, financial supervisors and cyber service providers rather than treated as each institution's isolated responsibility. It sets out a five-stage maturity pathway for each of the three domains, intended as illustrative guidance rather than a new compliance standard. CREST warns that weaknesses in shared infrastructure, technology providers or public authorities can undermine the wider financial system, and that mandating the highest international accreditations too early could exclude local providers.
Detalhes técnicos
The framework proposes multi-year programs: years one to two for mapping critical services and closing hygiene gaps while supervisors publish a baseline strategy; years three to five for independent assessment, risk-based testing, tiered supervisory requirements and provider accreditation; years five to ten for threat-led penetration testing, system-wide exercises and a diverse accredited provider community. CREST cites mentoring, partnerships, training and its Cyber Accelerated Maturity Programme (CREST CAMP) as enablers. CEO Nick Benson stressed that capability must develop in parallel across all three roles.
Linha do tempo
-
CREST publishes whole-ecosystem framework for cyber resilience in financial services
ler a análise desta fonte ocultar
CREST, the global non-profit cybersecurity accreditation body, published a whitepaper on 29 October titled Cyber Resilience in Financial Services: A Whole Ecosystem Approach. The paper argues resilience should be coordinated across financial institutions, financial supervisors and cyber service providers rather than treated as each institution's isolated responsibility. It sets out a five-stage maturity pathway for each of the three domains, intended as illustrative guidance rather than a new compliance standard. CREST warns that weaknesses in shared infrastructure, technology providers or public authorities can undermine the wider financial system, and that mandating the highest international accreditations too early could exclude local providers.
Technical Details
The framework proposes multi-year programs: years one to two for mapping critical services and closing hygiene gaps while supervisors publish a baseline strategy; years three to five for independent assessment, risk-based testing, tiered supervisory requirements and provider accreditation; years five to ten for threat-led penetration testing, system-wide exercises and a diverse accredited provider community. CREST cites mentoring, partnerships, training and its Cyber Accelerated Maturity Programme (CREST CAMP) as enablers. CEO Nick Benson stressed that capability must develop in parallel across all three roles.