The Treasury Department and Federal Reserve voiced support on Oct 11 for a new series of cybersecurity best practices for the financial sector.
The G-7 Fundamental Elements of Cybersecurity for the Financial Sector provides an eight-item, core guide to how financial institutions should guard against increasing cyber-attacks.
“Cyber threats present a set of pressing operational, reputational and financial stability risks facing the international financial system. Sovereign borders do not contain these threats, and accordingly, nations must work together to address them,” said Treasury Deputy Secretary Sarah Bloom Raskin, co-chair of the G-7 Cyber Expert Group, in a statement.
Finance ministers and central bank governors from the G-7, or Group of Seven countries—which include Britain, Canada, France, Germany, Italy, Japan and the U.S.—developed the cybersecurity elements to provide basic guides for building a cybersecurity strategy. This includes:
Cybersecurity Strategy and Framework
Developing a strategy that assesses the both specific cyber risks as well as international, national and industry standards and guidelines.
Governance
Establishing roles and responsibilities to execute the cybersecurity strategy, ensuring accountability and providing both resources and access to governing authority
Risk and Control Assessment
Identify the functions, dependencies and third parties, assessing their cyber risks. Manage the risks by establishing controls with systems, policies, procedures and training.
Monitoring
Initiate systematic processes to monitor controls and identify risks in the network.
Response
Assess the nature, scope and impact of a cyber incident; mitigate its impact; notify stakeholders, both internal and external; and coordinate joint response activities as needed.
Recovery
Resume operations by eliminating incident remnants, restoring data and systems, identify and mitigate vulnerabilities, prevent repeat events through vulnerability remediation and communicate appropriately.
Information Sharing
Provide reliable, actionable cybersecurity information on threats, vulnerabilities, incidents and responses to increase situational awareness.
Continuous Learning
Continually review cyber strategy and framework to ensure changes in cyber risks are addressed, gaps are remediated and identify lessons learned.
Established in 2015, the G-7 Cyber Expert Group identifies and recommends financial cybersecurity best practices G-7 finance ministers and central bank governors.
“The fundamental elements announced today are a significant achievement in our efforts to cooperate and improve cybersecurity within our countries,” Raskin said. “They are also a testament to the growing international resolve to counter cyberattacks and I encourage private and public sector leaders alike to use them to drive and fortify their institutions’ cybersecurity and resiliency.”
