RM4620 L0688 Cyber Resilience Review

HM Treasury is the lead government department for operational resilience in the financial sector, and a particular focus recently has been to work with the Bank of England, Financial Conduct Authority (together, the Financial Authorities) and other parts of government to improve the resilience of core parts of the sector to disruptive or destructive cyber-attack.

This project will explore the roles and responsibilities of the different official sector bodies involved in assuring the cyber resilience of the sector, including identifying threats, assessing risks and risk appetite, and ensuring that appropriate action is taken by the sector. The project will focus on the Financial Authorities and other parts of government as appropriate, particularly where this is potential overlap, interlinked responsibilities, and dependent deliverables. The project will identify possible areas for improvement, and make recommendations that reflect a full assessment of different options.

The project will focus on the governance of cyber resilience in the financial sector, and in particular its critical national infrastructure. Conclusions and recommendations will need to take into account the broader context for this work, and in particular:

• The wider sector resilience to other significant operational risks and the related governance around risk review, rating and mitigation;

• The governance of broader cyber responsibilities such as cyber security in the sector more generally (including responsibilities for cyber crime).