OFR_2016_Financial-Stability-Report

also are working with insurers that have experienced breaches. They have
drafted a model law for states that would set higher standards for data protection.
This model law is out for public comment until September 2016.
Similarly, the Commodity Futures Trading Commission (CFTC) issued
draft rules in December 2015 proposing five types of cybersecurity testing
requirements for derivatives clearing organizations, designated contract
markets, swap execution facilities, and swap data repositories. The CFTC
rules were finalized in September 2016.
In June 2016, the Committee on Payments and Market Infrastructures
and the board of the International Organization of Securities Commissions
(CPMI-IOSCO) proposed international guidelines on cyber resilience. The
guidelines stress the need for financial market infrastructures to preempt
cyber incidents, respond rapidly and effectively, and achieve faster and safer
target recovery objectives (see BIS and IOSCO, 2016a). As members of
CPMI-IOSCO, the Federal Reserve, the SEC, and the CFTC were involved
in developing the guidance. U.S. regulators have yet to adopt rules to apply
these standards.
Conclusion: Need to Continue to Enhance Security,
Improve Resilience, and Increase Capacity to Recover
To date, the emphasis across the U.S. government has been on sharing
information about cybersecurity threats. Recent innovations such as the
Cybersecurity Assessment Tool and Regulation SCI can help regulators
measure how well financial institutions can defend their IT systems. IT
defense can help ensure business continuity and recovery after cybersecurity
incidents. Progress has been made in these tasks, particularly in working to
ensure continuity of key systems at the institution level.
Regulators could build on their progress with a broader approach to
resilience that focuses on key links among financial institutions. As noted,
the OFR sees three financial stability risks that cyber incidents pose: lack of
substitutability, loss of confidence, and data integrity. Regulators may gain
from more collaboration to develop a common lexicon and a shared riskbased
approach, reflecting the universal nature of cybersecurity threats and
the connections among sectors, as well as collaborating to update standards
and guidance. There also may be lessons to learn from other industries such
as technology, energy, and communications. Finally, regulators should take
into account how regulatory boundaries may affect their view of parts of
financial networks, especially third-party vendors, overseas counterparties,
or service providers.
Regulators could build
on their progress with
a broader approach to
resilience that focuses
on key links among
financial institutions.
Key Threats to Financial Stability 47