While we have begun to address other areas of systemic risk, I feel the industry as a whole is just beginning to scratch the surface of the potential system-wide impact of a significant cyber-attack. This risk can be referred to as “single point of failure.” What is this? These are areas that, despite all of the work that has already been carried out, are significantly more vulnerable than others. We need to identify where they are and focus our combined efforts on understanding their systemic impact and addressing them. I want to be very clear here. I don’t think that this isn’t a regular topic of conversation among directors, executives and managers – in fact, based on discussions I’ve had with many of you, I know that it’s quite the opposite. There is a lot of discussion within firms about the topic – and there’s quite a bit of activity more broadly that suggests that many different people are talking about cyber. There are conferences on cybersecurity every week. Consultancy firms are working with the industry on how to protect against attacks. Law enforcement agencies are investigating and cracking down on attacks and those behind them. Everyone is talking about this! And, I think that’s appropriate and necessary – this is everyone’s issue. As we engage in discussions on the subject and flesh out our plans to address this risk, there are a number of topics that are key to keep in mind.
Demands from customers change, expectations from shareholders fluctuate and the regulatory landscape you work within will continue to evolve to keep pace. Constant change – and commitment to evolution – is not a choice. It is the only way to survive, stay competitive and stay safe in a complex and vulnerable world. As it relates to cybersecurity, I believe we are at a pivotal moment: we know there is an issue; we will work with you on fully understanding the scope and breadth of the risk; we will be pragmatic and add value; we are looking at this holistically; and our goal is to come out with a set of next steps that will benefit all of us, including protecting the financial system and the U.S. economy as a whole. We need to address cybersecurity before we see a catastrophic event, not analyze it afterwards. Thank you. BIS central bankers’ speeches  7