CREST, a non-profit accreditation body for the cybersecurity industry, has published a whitepaper calling on the financial services sector to strengthen cyber resilience across its entire ecosystem. The paper, Cyber Resilience in Financial Services: A whole ecosystem approach, examines the roles of financial institutions, financial supervisors, and cyber service providers, and sets out a maturity pathway for building resilience across the industry.
Three groups, shared dependencies
The paper argues that cyber resilience depends on more than the strength of individual institutions. Banks and other financial firms rely on shared infrastructure, technology and data providers, specialist cyber firms, and public authorities, and a weakness in one critical part of that system can affect the whole. As the use of AI in cybersecurity grows, the paper adds, a coordinated approach to its responsible use and testing becomes more important.
CREST assigns a distinct responsibility to each group. Financial institutions should build resilience across critical business services, supervisors should set proportionate expectations and understand risk across the wider system, and cyber service providers should supply specialist expertise, independent assurance, testing, and response capability. Nick Benson, CEO of CREST, said the strength of the system depends on all three developing their capabilities together.
Maturity pathways for different markets
The whitepaper proposes maturity pathways for each group, moving from baseline mapping, cyber hygiene, and initial standards to independent assurance, advanced testing, and intelligence-led testing. To help markets with limited local capacity, it recommends mentoring, partnerships between international and local providers, knowledge transfer, and access to recognised training and accreditation. CREST cites its Cyber Accelerated Maturity Programme (CREST CAMP) as one example of this approach.
The paper sets three priorities: measuring maturity across the ecosystem and its shared dependencies, adopting a common language across institutions, supervisors, and providers, and offering targeted support where capability needs to develop faster. Josh Magri, CEO of the Cyber Risk Institute, said financial sector cyber resilience depends on how well institutions, supervisors, and specialist providers align on a common view of risk and maturity, and that the paper offers a model for sequencing improvement.
