This includes firms, systems that support the industry, third party vendors, consultants, regulators, and law enforcement. 6. We need to leverage best practices  Leveraging a common set of best practices across the industry will be an important first step in closing the gap on the current vulnerabilities. Unlike the approaches taken by other supervisors to address cybersecurity concerns, our initial focus in this area is on better understanding the vulnerabilities, how firms are addressing them, what progress has been made by firms and assessing where the industry stands as a whole. Yes, we want you to address the weaknesses, but this is a lot bigger than the weaknesses identified at one firm. We will be looking to firms to leverage guidance around best practices to identify their weaknesses, and we want firms to bring forward other issues, concerns or vulnerabilities they encounter in doing so. We need to identify, as an industry, where the risks truly lie and what we are doing about them. There has been a lot of work done in this area by experts, including the NIST, the FBIIC, FINRA, PRA, FFIEC, NCUA, etc. – the list goes on. And, there are a number of sets of best practices already published. We are aware that firms have been looking for guidance on which approach to take or framework to adopt.
While we have begun to address other areas of systemic risk, I feel the industry as a whole is just beginning to scratch the surface of the potential system-wide impact of a significant cyber-attack. This risk can be referred to as “single point of failure.” What is this? These are areas that, despite all of the work that has already been carried out, are significantly more vulnerable than others. We need to identify where they are and focus our combined efforts on understanding their systemic impact and addressing them. I want to be very clear here. I don’t think that this isn’t a regular topic of conversation among directors, executives and managers – in fact, based on discussions I’ve had with many of you, I know that it’s quite the opposite. There is a lot of discussion within firms about the topic – and there’s quite a bit of activity more broadly that suggests that many different people are talking about cyber. There are conferences on cybersecurity every week. Consultancy firms are working with the industry on how to protect against attacks. Law enforcement agencies are investigating and cracking down on attacks and those behind them. Everyone is talking about this! And, I think that’s appropriate and necessary – this is everyone’s issue. As we engage in discussions on the subject and flesh out our plans to address this risk, there are a number of topics that are key to keep in mind.