•  The third is the importance of regular vulnerability testing. We launched CBEST, a controlled, bespoke, voluntary cyber security testing framework which aims to bring to bear the best available intelligence on potential threats to test directly a firm’s ability to protect, detect and respond to cyber attacks. 2. Recovery capabilities  But even with improved ex ante resilience, no network is impenetrable. Hence why firms’ recovery capabilities are equally important. We still need firms to work to be able to resume vital services quickly and reliably in the event of operational disruption. We are keen to see firms adapt their approaches to business continuity planning to take account of cyber. One possibility raised in the FSR is seeking more segregation between primary and backup systems. 3. Effective governance  I mentioned earlier it is for firms in the first place to be responsible for their cyber resilience. I’ve also noted that cyber is about people as much as it is about technology. And let me be clear, the responsibility for understanding this risk extends beyond technology specialists; firms’ boards need to view cyber risk as a core strategic issue and be in a position to challenge senior management in all business areas on the adequacy of their arrangements to deliver cyber resilience. Going forward So this is where we’ve got to on cyber. But now it’s clear we need to place cyber on a more permanent footing.
But the operational risk regime in Basel III 1 is designed to address another potential cause of financial failure in firms and to ensure that banks are adequately capitalised against these risks. It does not target the continued availability of services and resilience directly. c)  The third observation is that at the level of the sector our risk appetite has targeted limited disruption in firms that are critical for system functioning. For example FMIs supervised by the Bank as systemically important, set their standard of availability above 99%. And where firms suffer outage we expect them to have business continuity arrangements that allow them to recover immediately or within hours. Firms as a result have established primary and secondary sites, at a suitable  1  This refers to the capital regime only. Additional guidance on operational resilience can be found in the Basel core principles (http://www.bis.org/publ/bcbs195.pdf). BIS central bankers’ speeches  1  distance from each other, with data mirrored between the two. At the sector level as authorities we have concentrated on ensuring that in the event of a significant disruption to one or more firms we can share information and coordinate actions across firms in the UK market to minimise the impact of system stability and to speed full recovery.