The additional risk to keep in mind here is the growing number of unregulated firms operating in and competing in this arena. As the industry moves to overcome the risks associated with cybersecurity, you have to consider the additional vulnerabilities you are exposed to through non-regulated entities that will not be subject to the same guidance and standards. The big question lies in how you, as an industry, ensure that the ‘industry as a whole’ is safe, not just regulated entities. 4. One size does not fit all  Just as firms are diverse in size, complexity and product offerings, so too are technologies, processes and systems. While some firms house all technology work internally, others outsource the entire function or a significant part of it to third-party vendors. In addition to the variety of systems used and approaches to information security within firms, as I said earlier, we have an entire subsystem that supports the financial sector and ultimately connects every firm to some extent. In response to this, we are working under the  4  BIS central bankers’ speeches  assumption that there will not be a one-size-fits-all solution and the approach taken will need to be comprehensive and flexible enough to be adopted by all types of firms. 5. We are in this together  Cybersecurity is an area where I believe our interests are aligned and our shared goal is twofold.
Need to address communications  Finally, to successfully address this risk with a unified front, we must develop an approach to enhanced communications around cyber threats and events, and revisit supervisory guidance in this area. Silence and fear of sharing intelligence in this area could be detrimental to efforts to address the vulnerabilities systematically. We know that breaches have occurred and will continue to occur until the industry is better equipped to be ahead of the attackers, not playing catch up. Right now we are interested in learning from these breaches and using intelligence garnered to get ahead of game. There is a lot to think about here. With all this in mind, I will end this part of my remarks with a reminder of what we see as the key components of any solution designed to address cybersecurity. It must: •  Be comprehensive, risk-based and threat-informed;  •  Be a joint effort between public and private sectors;  •  Be flexible enough to evolve as technology advances; –  Automated  –  Scalable  •  Support information sharing;  •  Leverage best practices;  6  BIS central bankers’ speeches  •  Include all in the industry – regardless of size or processes (internal systems or external providers); and  •  Delve deeper than one step below the surface. Conclusion We live in an ever-changing environment where speed and agility are of the essence.