As with the other areas I have covered already, much more needs to be done to meet these expectations. Cyber-security needs to become part of the culture of an organisation and an integral part of the organisation’s risk management, crisis management, and business continuity planning.
Because that determines how much the measure can interfere with third parties’ rights – and that doesn’t only mean banks’ rights. However, not only the objectives of macroprudential supervision must be clear, but also what dangers or risks macroprudential supervisors should be monitoring.