CREST Champions Whole-Ecosystem Approach to Bolster Financial Cyber Resilience

"Financial institutions, supervisors and cyber service providers each have a distinct role, and the strength of the system depends on their capability developing together," said CREST CEO Nick Benson.

Three domains: institutions, supervisors, and cyber service providers

CREST, the global non‑profit accreditation body for the cybersecurity industry, sets out a framework that treats financial cyber resilience as a shared responsibility across three clearly defined domains. Under the whitepaper titled Cyber Resilience in Financial Services: A Whole Ecosystem Approach, financial institutions are assigned responsibility for protecting critical business services and for demonstrating that their controls work under pressure. Supervisors are charged with setting proportionate expectations, overseeing individual firms and understanding systemic risk. Cyber service providers are expected to deliver specialist advice, assessment, threat intelligence, testing and response capabilities.

Five-stage maturity pathways and a multi‑year roadmap

The framework maps each domain through five stages of cyber maturity and presents the three pathways as planned together rather than in isolation. Institutions move from incomplete basic hygiene to advanced, threat‑led assurance and continuous improvement. Supervisors progress from mapping their sectors and establishing mandates to adaptive, cross‑sector oversight. Providers evolve from unvalidated services to specialist financial‑sector capabilities. CREST recommends multi‑year programs so the domains develop in parallel, warning that requirements outpacing readiness can produce limited assurance.

CREST’s roadmap lays out concrete phase markers: in years one and two, institutions should map critical services and close urgent hygiene gaps while supervisors publish a baseline and strategy. In years three to five, institutions would undergo independent assessment and risk‑based testing, supervisors would introduce tiered requirements, and providers would see independent accreditation. By years five to 10, CREST envisages threat‑led penetration testing where proportionate, system‑wide exercises and a diverse community of accredited specialist providers.

Weaknesses in shared infrastructure and services as systemic threats

The whitepaper argues that weaknesses in shared infrastructure, technology providers, cyber firms or public authorities can undermine resilience across the wider financial system. That argument reframes cyber resilience from a firm‑level operational problem into an ecosystem challenge: vulnerabilities in one part of the ecosystem may reduce assurance across others, and a single under‑prepared element can limit confidence in system‑wide testing or response.

Implementation priorities: measurement, common language, and paced development

CREST sets three priorities for jurisdictions adopting the framework: ecosystem‑wide measurement of maturity, a common language across the three domains, and faster development wherever one part of the ecosystem lags. The whitepaper is explicit that its pathways are illustrative and not a new compliance standard. It also warns against prematurely mandating the highest international accreditations where no local route to those credentials exists, arguing such a step could shut out local providers.

To mitigate that risk, CREST points to measures such as mentoring, partnerships, training and its Cyber Accelerated Maturity Programme (CREST CAMP) as means to build capability while preserving market depth and local supply.

What this means for technologists, supervisors, and financial institutions

• Technologists and security teams: Pressed to move from basic hygiene to demonstrable, threat‑led testing, teams should expect independent assessment and, over time, involvement in system‑wide and threat‑led penetration exercises where proportionate.
• Supervisors and policymakers: The whitepaper asks supervisors to publish baselines and strategies early, introduce tiered requirements in a later phase, and develop adaptive, cross‑sector oversight as maturity grows—explicitly tying supervisory pacing to the readiness of institutions and providers.
• Financial institutions and procurement leaders: Institutions are asked to map critical business services first, close urgent hygiene gaps and plan for independent assessment. Procurement practices will also need to account for provider accreditation pathways, mentoring arrangements and the potential limits on local supplier access if high‑level accreditations are mandated too quickly.

CREST’s whitepaper frames a pragmatic sequence: start with mapping and hygiene, build independent assurance, and only then scale to threat‑led testing and system exercises—while protecting local provider ecosystems through training and accreditation pathways such as CREST CAMP. The whitepaper leaves a clear policy choice for jurisdictions: adopt parallel, paced development across institutions, supervisors and providers, or risk creating requirements that certify little because the ecosystem has not advanced together.

https://www.infosecurity-magazine.com/news/crest-financial-cyber-resilience/