I’m sure I don’t have to explain too much why this keeps me awake at night. Suffice it to say that as I think about the kinds of risks that might cause the next crisis, cybersecurity is the one that worries me the most. The worry is not focused solely on the financial sector. This is much bigger than just banks. It includes many other sectors, most notably, the retail sector. In particular, cyber threats pose a potentially systemic risk to financial stability through the disruption or corruption of critical payment, clearing and settlement systems and related data. A big question we need to think about is how firms, big and small, can protect themselves from these risks. As I have noted in the past, all of us face quite a bit of work ahead on the cybersecurity front. Importantly for us, as supervisors, we must determine the best areas of focus given our  BIS central bankers’ speeches  5  perspective and the range of skills that we can bring to the topic. For example, in the nearterm we are continuing supervisory plans related to cyber security work at the complex financial institutions. We are also identifying “core” expectations for smaller firms so that they, too, can take appropriate measures to harden their defenses. We are also undertaking concentrated work to: develop a better understanding of vulnerabilities and emerging practices: develop an approach to enhanced communications around cyber events, and revisit supervisory guidance in this area.
We have seen progress in this area over the past few years with some firms hiring outside experts, engaging in cultural diagnostic work and implementing programs that focus on improving ethics, behaviors and internal culture. We’ve also seen progress in our direct engagement with boards of directors – and we’ve seen this across institutions of all sizes. When we, as supervisors, first began requiring deeper engagement with directors and senior leaders, the reactions varied, with an initial wariness of the purpose. In fact, directors were often accompanied by a compliance or regulatory relations liaison during our early interactions with them. Over time, though, as senior leaders and board members recognized the advantages of this level of engagement, the process has been smoother and our exchanges are becoming more engaging and direct (and few if any “escorts” are present during our interactions now). While the level of  2  BIS central bankers’ speeches  engagement varies across firms, in general, we are seeing boards being more active in asking questions, providing oversight of management and engaging with supervisors. We, in turn, have deeper insight into decision making dynamics at the board and c-suite level, including the how and why of decision making on key strategic issues. Regular communications also encourage early and proactive surfacing of issues. In addition, we’ve seen good progress in recruiting additional directors to complement current skills on the board – better positioning the board to engage with the senior management team in a productive and appropriately challenging way.