OFR_2016_Financial-Stability-Report

The industry is working with the public sector to build resilience — in
this case, the ability to quickly respond to cybersecurity threats and recover
from cyber incidents (see Figure 45). One program is developing a platform
that companies can use to share threat intelligence (see DTCC, 2015). That
program is called Soltra. It is run by a partnership of the Depository Trust
& Clearing Corp., which, through its subsidiaries, provides clearing and
settlement services to the financial markets, and the Financial Services –
Information Sharing and Analysis Center. Industry, government, and academia
also held exercises to improve the readiness of the financial services
industry to respond to systemwide incidents, known as the Quantum Dawn
series (see Deloitte and SIFMA, 2015). Other government-run simulations
for enhancing communication, collaboration, and response are the Hamilton
series of exercises and international work with the U.K. through Operation
Resilient Shield (see Treasury and HM Treasury, 2015; Waterman, 2016).
Stances of U.S. Financial Regulators Vary
U.S. regulators clearly recognize the threat of cyber incidents to financial
firms. Regulators have placed more emphasis on cybersecurity threats in
their public statements and in guidance to the financial institutions they
supervise. Regulators have progressed in developing specific assessment
standards and in setting enforceable regulatory expectations on cybersecurity.
They have begun incorporating those standards into their work by
Figure 45. Major Public and Private Groups Addressing Cyber Risks
Organization
Financial Services Sector
Coordinating Council
for Critical Infrastructure
Protection and Homeland
Security (FSSCC)
Financial and Banking
Information Infrastructure
Committee (FBIIC)
Financial Services –
Information Sharing and
Analysis Center (FS-ISAC)
Description
Group of trade associations, financial
utilities, and financial companies that works
with the public sector on policy issues related
to resilience and response to cybersecurity
issues, natural disasters, and terrorism.
Group of federal and state financial regulators
created after the 9/11 attacks to
improve coordination and communication
among regulators, enhance resilience of the
financial sector, and promote public-private
partnerships.
Nonprofit center that provides member
financial services firms with anonymous,
global information sharing about cyber and
physical threat intelligence.
Source: OFR analysis
44 2016 | OFR Financial Stability Report