Revisiting The ECB's Rules For Selecting Service Providers For Cyber-Resilience Testing

On 2 May 2018 the European Central Bank (ECB) published its framework for "Threat Intelligence-Based Ethical Red-Teaming" (TIBER-EU) Framework¹. This framework describes a controlled and tailored testing approach to increase the resilience of digital networks of financial services firms and the entire financial sector across the EU. Here, the ECB did not just act as a supervisory authority of the Banking Union but in its function as a central bank. Under the new rules, TIBER-EU tests are run using intelligence-based ethical hacking. Covered by the scope under this "voluntary" regime are public authorities, but also financial services companies and financial market infrastructure providers. Covered entities are expected to incorporate a "comply or explain" approach to the TIBER-EU Framework and when engaging service providers to conduct the relevant tests.