ECB CROE
ECB cyber resilience expectations for FMIs based on CPMI-IOSCO guidance.
Articles (92)
Governance and Accountability — ApplicabilityLevels of expectationRisk Management Measures — GovernanceApplicability of expectationsIncident Reporting and Escalation — Process RequirementsCyber resilience strategy and frameworkSupply Chain and Third Parties — Evidence and RecordsCyber Resilience Strategy DocumentationResilience Testing and Improvement — Testing and AssuranceStrategy AlignmentGovernance and Accountability — ReportingBoard Approval and Review of StrategyRisk Management Measures — RemediationBoard Cyber Risk OversightIncident Reporting and Escalation — Third-Party ControlsCyber Resilience FrameworkSupply Chain and Third Parties — TrainingFramework Content RequirementsResilience Testing and Improvement — Management ReviewUse of International StandardsGovernance and Accountability — ApplicabilityFramework Consistency with ERMRisk Management Measures — GovernanceBoard Endorsement of FrameworkIncident Reporting and Escalation — Process RequirementsFramework Roles and ResponsibilitiesSupply Chain and Third Parties — Evidence and RecordsMaturity Models and Metrics (Advancing)Resilience Testing and Improvement — Testing and AssuranceFormal Review and Update Process (Advancing)Governance and Accountability — ReportingEcosystem Cyber Risk Management (Advancing)Risk Management Measures — RemediationFuture State Strategy (Innovating)Incident Reporting and Escalation — Third-Party ControlsEcosystem Resilience Structures (Innovating)Supply Chain and Third Parties — TrainingBoard Responsibilities for Cyber ResilienceResilience Testing and Improvement — Management ReviewBoard Skills and KnowledgeGovernance and Accountability — ApplicabilitySenior Executive AccountabilityStaff Skills and EmpowermentCyber Risk on Board AgendaSenior Management Reporting to BoardBudgeting and Resource PlanningCyber Resilience CultureBehavioural and Cultural ChangeSituational Awareness MaterialsCyber Resilience Training ProgrammeTesting Cooperation ArrangementsSharing Test ConclusionsVulnerability AssessmentsScenario-Based Testing – Multi-Portion BreachesScenario-Based Stress Testing with EcosystemRed Team Testing – Internal CapabilityCyber Threat Intelligence – Threat IdentificationCyber Threat Intelligence – Information Gathering CapabilitiesCyber Threat Intelligence – ISAC MembershipCyber Threat Intelligence – Analysis CapabilitiesCyber Threat Intelligence – Continuous UseCyber Threat Intelligence – Regular ReviewCyber Threat Intelligence – Availability to StaffCyber Threat Intelligence – Training IntegrationCyber Threat Intelligence – Anticipating Attacker CapabilitiesCyber Threat Risk DashboardCyber Threat Risk Dashboard – Continuous ReviewExtreme but Plausible Threat AnalysisCyber Threat Intelligence – Ecosystem ScopeCyber Threat Intelligence – SOC IntegrationInformation Sharing – Goals and ObjectivesInformation Sharing – Scope DefinitionInformation Sharing – Rules and AgreementsInformation Sharing – Trusted Communication ChannelsInformation Sharing – External Stakeholder AccessInformation Sharing – Active Participation in GroupsInformation Sharing – Internal Protocols by RoleInformation Sharing – Ecosystem Situational AwarenessCyber Threat Intelligence Gathering CapabilitiesAnalysis of Threat IntelligenceLessons Learned Classification and IncorporationContinuing Cyber Resilience Training ProgrammeCybersecurity Awareness Materials for StaffIntegration of Lessons Learned into TrainingCyber Resilience Indicators and Management InformationValidation of Lessons Learned in TrainingMonitoring Technological Developments and New Cyber Risk Management ProcessesCorrelation of Findings to Enhance Cyber ResilienceIncorporation of Lessons from Real-Life Events and TestingContinuous Tracking of Cyber Resilience Capability DevelopmentMultiple Intelligence Sources for Evolving Threat LandscapeAppointment of Senior Executive (CISO)