CREST Urges Whole-Ecosystem Approach to Financial Cyber Resilience

Cyber resilience in financial services should be built across the wider ecosystem of institutions, supervisors and specialist providers rather than treated solely as each institution's own responsibility, a new framework has argued.

CREST, the global non-profit accreditation body for the cybersecurity industry, said its whitepaper, Cyber Resilience in Financial Services: A Whole Ecosystem Approach, provides a maturity pathway for jurisdictions to assess their capabilities and coordinate improvements across three domains.

The paper, published on October 29, argued that weaknesses in shared infrastructure, technology providers, cyber firms or public authorities can undermine resilience across the wider financial system.

CREST Sets Out Three Domains For Financial Cyber Resilience

Under the framework, financial institutions are responsible for protecting critical business services and demonstrating their controls work under pressure.

Financial supervisors are tasked with setting proportionate expectations, overseeing individual firms and understanding systemic risk, while cyber service providers are expected to deliver specialist advice, assessment, threat intelligence, testing and response capabilities.

The framework maps each domain through five stages of cyber maturity, with the three pathways planned together. Institutions progress from incomplete basic hygiene to advanced, threat-led assurance and continuous improvement. Supervisors move from mapping their sectors and establishing mandates to adaptive, cross-sector oversight, while providers progress from unvalidated services to specialist financial-sector capabilities.

CREST said the pathways are illustrative, not a new compliance standard. Its three priorities were ecosystem-wide measurement of maturity, a common language across the three domains and faster development wherever one part of the ecosystem lags.

Read more on financial-sector cyber regulation: FCA Updates Cyber Incident and Third-Party Reporting Rules

Framework Calls For Multi-Year Cyber Maturity Programs

CREST suggested supervisors or other market participants set out multi-year programs so the three domains develop in parallel, warning that requirements outpacing readiness can produce limited assurance. Its roadmap begins in years one and two with institutions mapping critical services and closing urgent hygiene gaps while supervisors publish a baseline and strategy.

Years three to five would bring independent assessment and risk-based testing for institutions, tiered requirements from supervisors and independent accreditation for providers. Years five to 10 would focus on threat-led penetration testing where proportionate, system-wide exercises and a diverse community of accredited specialist providers.

The whitepaper also warned that moving prematurely to mandate the highest international accreditations could shut out local providers where no route to accreditation exists. It pointed to measures including mentoring, partnerships, training and CREST's Cyber Accelerated Maturity Programme (CREST CAMP).

"Financial institutions, supervisors and cyber service providers each have a distinct role, and the strength of the system depends on their capability developing together," said CREST CEO Nick Benson.