Attackers can carry out sophisticated and prolonged attacks that can be difficult to identify and defend against. According to a study by FireEye, the median time it takes to detect a cyber intrusion is 78 days. We need some common risk management standards in cyber defence. The risk management systems in financial institutions and regulatory and supervisory frameworks for cyber resilience are uneven and still evolving. There is no international equivalent of the Basel Capital Accord in cyber risk management. But given the clear and present danger that cyber risk poses, MAS has put in place a mix of mandatory requirements and best practice guidelines in this area. Given their role as repositories of public monies and conduits for payments, banks in particular must meet higher cyber security standards. MAS expects banks to: limit unscheduled system downtime of their critical IT systems to not more than 4 hours within a year; conduct due diligence on third-party service providers’ controls to safeguard customer information; and report all significant cyber incidents to MAS within one hour. But cyber risk management should go beyond banks. The connectedness among participants in the financial system means that a cyber-attack on one party can potentially escalate into a more systemic problem. We need to level up the cyber resilience of all financial institutions, not necessarily to the level of banks but at least to a basic level – what we call cyber hygiene.
Importantly, the roadmap incorporates a framework where individual actions are taken forward by the most suitable expert bodies, in accordance with their mandates, with the FSB providing coordination and reporting annually on progress to the G20 and the public. Many of the building blocks are owned by CPMI and the FSB, but the IMF, FATF, World Bank and BIS Innovation Hub are also among the owners/co-owners. 6 7  Source Euromoney (2019) - https://www.euromoney.com/article/b1h6r02s16dnf9/removing-frictions-in-cross-border-payments https://www.fsb.org/2020/10/enhancing-cross-border-payments-stage-3-roadmap/ 5  All speeches are available online at www.bankofengland.co.uk/news/speeches and @BoE_PressOffice  5  The Bank of England is already making progress in a number of these areas  To bring some of these building blocks to life and to show you that there is already significant innovation underway, I will outline work the Bank of England is undertaking to address some of these challenges. The Bank is involved through a number of roles – as a payment system operator, a supervisor of firms and of financial market infrastructures, and through our overriding mission to promote the good of the people of the UK by maintaining monetary and financial stability. My focus today will be on our role as an operator, and  in particular the Real Time Gross Settlement (RTGS) service Renewal Programme of which I am the Executive Sponsor.