CREST calls for coordinated cyber resilience across finance

CREST has urged a whole-ecosystem approach to financial cyber resilience, arguing that weaknesses in shared infrastructure, technology providers, cyber firms or public authorities can undermine resilience across the wider financial system.

The organisation’s whitepaper, Cyber Resilience in Financial Services: A Whole Ecosystem Approach, sets out a maturity pathway for jurisdictions to assess capabilities and coordinate improvements across three domains: financial institutions, supervisors and cyber service providers. The paper stresses that resilience should be built collectively rather than treated as a solely individual institution’s responsibility, and that the pathways are illustrative rather than a new compliance standard.

Under the framework, each domain follows five stages of cyber maturity, with the three pathways progressing together. Financial institutions would advance from basic hygiene to threat-led assurance and continuous improvement; supervisors would move from sector mapping and mandates to adaptive, cross-sector oversight; providers would grow from unvalidated services to specialist, financially focused capabilities.

CREST emphasises three priorities: ecosystem-wide maturity measurement, a common language across domains, and faster development where lag occurs. The whitepaper also calls for multi-year programmes to develop the three domains in parallel and cautions against mandating the highest international accreditations too quickly if local providers cannot access them. It suggests measures such as mentoring, partnerships, training and CREST’s Cyber Accelerated Maturity Programme (CREST CAMP). CREST chief executive Nick Benson says the strength of the system depends on the collective development of institutions, supervisors and providers.