Outline the macroprudential tools and policy measures that could tackle cyber and ICT risks, and account for the obstacles to adopting each.
The idea
Macroprudential tools aim at the stability of the whole system rather than the safety of one firm. Typical measures are system-wide cyber stress tests and scenario exercises, capital and liquidity buffers or add-ons, mandatory incident reporting and information sharing, and threat-led penetration testing. Others are direct oversight of critical third-party providers with concentration limits and exit plans, coordinated crisis playbooks, recovery and resolution planning, and risk transfer or backstop arrangements. Each meets obstacles. Capital absorbs financial losses but does not restore a stopped service, and loss data are scarce so calibration is weak. Firms fear reputation and liability, which discourages sharing. Providers sit outside the regulatory perimeter and across borders. Insurance capacity is limited by correlated losses and moral hazard, and live testing can itself cause disruption. Exam point: pair every tool with its limit.
A practice question
What is the main objective of a macroprudential approach to cyber and ICT risk?
- Ensuring each firm meets minimum internal control standards so that its own failure risk is low.Why not: Describes the microprudential, firm-by-firm aim rather than the system-wide aim.
- Reimbursing customers after an attack so that the losses are borne by the public sector.Why not: Mistakes the objective for loss compensation; it is about preventing and containing system-wide disruption.
- Keeping the system stable by addressing common exposures, links and continuity of critical functions. - correct
- Eliminating all cyber attacks against financial institutions through mandatory technical standards.Why not: Sets an impossible aim; tools aim at resilience and limiting spread, not at preventing every attack.
Macroprudential policy looks at the system: shared dependencies, connections and the ability to keep critical functions running. Firm-level controls are the microprudential layer.
A harder one
Why is voluntary sharing of cyber incident information among financial firms often weak, even though it would help the system?
- Firms fear reputational damage, liability and exposing vulnerabilities, so incentives to share are weak. - correct
- Supervisors already hold complete incident data in real time, so sharing adds nothing further.Why not: Ignores that supervisory data are incomplete and not shared in real time with other firms.
- The technology to digitise threat indicators does not exist in a usable standard form.Why not: Wrong: indicators are routinely digitised; the obstacle is incentives and legal protection, not technology.
- Shared indicators always help attackers more than defenders, so the net effect is harmful.Why not: Overstates a risk; the usual conclusion is that well-designed sharing helps defenders.
The obstacles are incentives and law: reputation, liability and confidentiality. Tools such as legal safe harbours, anonymisation and trusted sharing hubs address them.
The hardest tier
A policymaker suggests cyber insurance as the way to absorb a system-wide cyber event. Which statement best explains the main obstacle?
- Losses are correlated and history is short, so accumulation risk limits insurance capacity. - correct
- Pooling many policies makes cyber losses diversifiable, so insurance capacity is effectively unlimited.Why not: Applies the law of large numbers to losses that are strongly correlated through common software and providers.
- Insurance fully removes the systemic risk because the losses are transferred out of the financial sector.Why not: Treats risk transfer as risk removal; if capacity is insufficient, the loss returns to the system.
- Moral hazard is absent because insurers continuously monitor each insured firm's controls closely.Why not: Assumes perfect monitoring; moral hazard and adverse selection remain real obstacles.
Cyber losses are correlated, history is short and tail accumulation is hard to price, so insurance capacity is limited. It can support, but cannot replace, resilience measures and public coordination.
In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.
Start free →More in Digital Resilience and Financial Stability: The Quest for Policy Tools in the Financial Sector
- Outline the nature of the cyber risks and the ICT (information and communication technology) risks to which financial institutions are exposed.
- Judge how cyber and ICT risks interact with financial risks, and show how cyber and ICT incidents at financial institutions can grow into systemic financial risk.