Cyber-Resilience—A Repeated Regulatory Message

An expectation that regulated financial services firms be 'cyber-resilient' should not cause any surprise. Cyber-crime and data breaches represent major risks for business generally. Comparatively, that risk is not mitigated by the standards of British employees, who have been found to be particularly ineffective at protecting their data and devices.¹ Accordingly, cyber-crime has the potential to be profoundly destabilizing, as well as costly, to the UK financial services sector.

However, the framework against which the expectation of cyber-resilience translates into tangible and measurable obligations is not substantially developed. Two recent FCA public announcements provide some insight into the Regulator's approach to cyber security, and indicate the direction and shape of regulatory change. The FCA released its Business Plan for 2017/2018 on 18 April.² The document sets out the FCA's priorities. 'Technological change and resilience' is one of six cross-sector