CREST Says Financial Cyber Resilience Depends on the Whole Ecosystem, Not Just Individual Firms

CREST, the global non-profit accreditation body for the cybersecurity industry, has released a whitepaper titled Cyber Resilience in Financial Services: A Whole Ecosystem Approach. Published on October 29, it argues that resilience should not be treated as each institution's problem alone. Weaknesses in shared infrastructure, technology providers, cyber firms or public authorities can undermine resilience across the wider financial system.

The framework covers three domains. Financial institutions are responsible for protecting critical business services and showing their controls work under pressure. Supervisors set proportionate expectations, oversee individual firms and track systemic risk. Cyber service providers deliver specialist advice, assessment, threat intelligence, testing and response. Each domain is mapped through five stages of maturity. Institutions move from incomplete basic hygiene to advanced, threat-led assurance and continuous improvement. Supervisors progress from mapping their sectors to adaptive, cross-sector oversight, and providers move from unvalidated services to specialist financial-sector capabilities.

CREST stresses that the pathways are illustrative and not a new compliance standard. Its priorities are measuring maturity across the whole ecosystem, using a common language across the three domains, and speeding up progress wherever one part lags. It suggests multi-year programs so all three domains develop together, warning that requirements outpacing readiness can produce limited assurance. In years one and two, institutions would map critical services and close urgent hygiene gaps, while supervisors publish a baseline and strategy.