British financial institutions will face tougher ‘cyber stress tests’ to assess their resilience to cyberattacks under new Bank of England (BoE) plans.

In 2017 the bank’s Financial Policy Committee (FPC) first set out a framework of regulation to strengthen the resilience of the UK financial system to cyber risk, including regular resting by firms and supervisors to ensure resilience “kept pace with the evolving nature of the risk.”

Today the committee published its quarterly Financial Stability report, in which it referred to its latest cyber stress test plans.

The document stated that the 2022 cyber stress test should involve a scenario where data integrity had been compromised, building on the finance industry’s own work.

The committee agreed that next year’s test “should target the most systemic contributors in the end-to-end payments chain, as in the event of disruption, their ability to resume services in a timely manner was particularly important for UK financial stability.”

The FPC decided that the next cyber stress test will focus on retail payments, so that the results from the test could help shed light on the potential financial stability impact of disruption to retail payments.

The committee said that the 2022 test would build on lessons from a 2019 pilot, by expanding to include ‘secondround effects.’

“Participants would be asked to document how they would meet the FPC’s impact tolerance, or, if they were not able to do so, what the impact might be,” said the document. “Firms would also be asked to document any barriers to meeting the FPC’s impact tolerance, and to explore the extent to which their recovery options might depend on the actions of other participants.”

The committee said that because the cyber stress testing was a relatively new tool, and the voluntary pilot in 2019 had encouraged participants to revisit existing contingency work, that the next test would be “exploratory” rather than a “formal pass-fail assessment.”

But it said that banks and other financial institutions would be expected to share their findings and plans with their supervisors.

The committee plans to share more details on the cyber stress test soon.

Share Story: