Cyber resilience in the financial services sector requires a collaborative framework involving institutions, supervisors, and specialist providers to address systemic risks effectively, as first reported by Infosecurity Magazine.
The Council of Registered Ethical Security Testers, or CREST, released a white paper on October 29 outlining a maturity pathway designed to strengthen the financial ecosystem. The framework identifies three core domains: financial institutions, which must protect critical services; supervisors, who oversee systemic risk; and cyber service providers, who offer specialized testing and intelligence. Rather than treating security as an individual institutional responsibility, the model encourages parallel development across these sectors.
The roadmap spans 10 years, beginning with basic hygiene and mapping in the first two years, followed by risk-based testing and independent assessments in years three through five. By years five to 10, the strategy shifts toward threat-led penetration testing and system-wide exercises. CREST emphasizes that this framework is an illustrative guide rather than a compliance mandate. It warns that if regulatory requirements outpace industry readiness, the resulting assurance may be limited. The initiative also highlights the importance of mentoring and training to ensure local providers are not excluded from the market as standards evolve toward higher maturity levels.
Source: Infosecurity Magazine
