As the financial stability authority we are also responsible for monitoring stability at the level of the sector as a whole. While we have multiple policy hats the common denominator in this space is ensuring that the sector has adequate operational resilience – that is that firms can continue to provide critical services that are important for their own integrity and the functioning of the sector. If a firm’s operations are interrupted, we want to be sure that they can be recovered quickly and reliably especially where they are systemically important. Three observations at this point: a)  First to stress our accent on financial stability. Our efforts target first those firms where operational failures may result in disruption to the provision of vital financial services to the real economy or in dislocation to the rest of the sector. That does not mean the failures in customer facing applications do not matter. It is just that, where no immediate systemic dislocation results from such an outage, any consumer detriment will be a concern for our colleagues at the Financial Conduct Authority (FCA) more than it is for us. b)  Second, operational resilience is different from operational risk. In operational resilience we are describing a policy outcome we want to deliver in terms of the system functioning. This may be a by-product of effective operational risk management.
Compromise of networks or attacks themselves will not always be obvious. Diagnosis may take time. By contrast physical threats to operational resilience – bombs, fires, floods – are immediately apparent. And apparent too to the rest of the sector. Fourth capacity to recover may be threatened. Standard approaches to achieving continuity – operating with common systems environments between primary and secondary sites and mirroring data between the two, could, in the face of a successful cyber attack, be vulnerable to complete loss of applications or destruction of data, disrupting a firm’s capacity to operate and leaving the timeframe and route to recovery uncertain. Hence the FPC recommendation in 2013 that relevant authorities should undertake work to test and improve resilience to cyber attack of the firms at the heart of the financial system 2. You will have seen from the FSR published yesterday 3 that interest in and awareness of this risk continues to grow. This is why it is so vital that firms – and authorities – take the necessary action to address their cyber vulnerabilities. In response to the FPC’s 2013 recommendation our work has been mostly diagnostic, concentrating on assessing the vulnerability of the UK financial sector to cyber attack. Our focus has been twofold: a cross-sector review of current risk management processes via a detailed firm self-assessment questionnaire and bespoke voluntary vulnerability testing, known as CBEST 4. The conclusions we have drawn from this work can be broken down into three core areas: 1. Defensive capabilities  2  http://www.bankofengland.co.uk/publications/Documents/records/fpc/pdf/2013/record1307.pdf.