If not all regulations are aligned, some private actors could (re)locate their IT systems in less-demanding jurisdictions. This is the reason why we need homogeneity among international regulatory texts with the largest outreach. Who could lead this coordination role on cybersecurity regulation? The G7 expert group has been extremely successful in producing “Fundamental elements”, but this group has no standard-setting role and its texts can only guide regulators in their work. I believe the FSB is best placed to engage the dialogue with the various standard-setters to foster the alignment of their texts, as well as to conduct global outreach, and limit the proliferation of working groups. II. Information Cyber threats are increasing, but adequate and consistent measurement is challenging. I would like therefore to make two proposals: About incident reporting. Many reporting obligations on cyber incidents have emerged, requested by various authorities. But these incident reports give little  Page 4 sur 6 information to measure the intensity and sophistication of threats and their evolution. The indicators requested vary from one report to another and this limits the scope of diagnosis and comparisons. The institutions themselves can struggle to transmit information about their incidents in different formats and with different details to the various authorities in charge. FSB agreed on a “cyber lexicon”. 1 As we have done in the past for operational risk, I recommend that we work on a common categorization of cyber incidents to better measure the impacts of attacks, and better understand their evolution. About information sharing and threat intelligence.
A number of avenues need to be explored. • First, if this exercise is necessary per se, its full potential will be delivered only if all lessons are properly drawn. Some guiding key principles, or “Fundamental elements”, to be designed in the wake of the G7 exercise, will help achieve this objective. • Second, we must leverage on this G7 exercise: the regular practice of coordinated crisis management exercises should be encouraged in order to enhance the resilience of the financial system. • Third, an enlargement beyond the remit of G7 countries should be considered with some other jurisdictions and/or with BIS involvement, and possibly beyond the sole financial sector actors. In future exercises, the current format will require cooperation arrangements on a wider scale. ** Regulation and supervision, information, and preparation: these are the areas where we clearly need to improve our coordination. I would like to conclude with a last imperative: action. We all share the principles, but there was today in this conference a sense of urgency, of concrete urgency. This is where the French presidency of the G7 intends to be useful: • First, by giving greater visibility and support to the CEG work, which is going to deliver important papers on cross-sector coordination and on the assessment of vulnerabilities.