FINMA's Cyber Risk Supervision: What You Need To Know And Do

FINMA'S EMPIRICAL FINDINGS FROM ITS CYBER RISK SUPERVISION

FINMA employs a variety of tools in its supervision of cyber risks. These include regular risk assessments, on-site and in-depth reviews and scenario-based cyber exercises. Through these tools, FINMA obtains a detailed picture of the cyber risk management and resilience of institutions under its supervision and identifies best practices and areas for improvement.

The newly published Cyber Risk-Guidance summarises key findings from FINMA's supervisory activity in the past years, highlighting recurrent shortcomings.

OUTSOURCING

FINMA has observed an increase in successful attacks on the supply chains of supervised institutions, which accounted for over 50% of all attacks in recent years. FINMA found that these attacks succeeded due to unclear cyber security requirements for service providers and a failure by supervised institutions to audit or at least regularly assess these requirements.