Basel Committee Cyber Resilience Principles

International standards for banks operational resilience including cyber risk governance and incident response.

Category	Financial Services
Status	Active
Latest development	2025-12-19

Analysis

Key Requirements

Governance: Banks must establish a robust governance framework for cyber resilience, with clear roles and responsibilities for the board and senior management. This includes oversight of cyber risk management and ensuring cyber resilience is integrated into the overall risk management framework. See BIS: Guidance on cyber resilience for financial market infrastructures and BIS: Cyber-resilience range of practices.

Identification: Institutions are required to identify critical assets, business functions, and interconnections that could be affected by cyber threats. This includes maintaining an up-to-date inventory of information assets and understanding dependencies. See BIS: Guidance on cyber resilience for financial market infrastructures and AnalystPrep: Cyber-resilience Range of Practices.

Protection: Organizations must implement controls to protect critical assets from cyber threats, including technical, physical, and administrative safeguards. This covers access controls, encryption, and employee training. See BIS: Guidance on cyber resilience for financial market infrastructures and Dataprise: Basel Banking Cybersecurity Regulations.

Detection: Banks must have capabilities to detect cyber incidents promptly, including monitoring systems, anomaly detection, and regular vulnerability assessments. See BIS: Guidance on cyber resilience for financial market infrastructures and BIS: Cyber-resilience range of practices.

Response and Recovery: Institutions must develop and maintain incident response and recovery plans to ensure continuity of critical operations and rapid restoration after a cyber event. See BIS: Guidance on cyber resilience for financial market infrastructures and BIS: Cyber-resilience range of practices.

Testing: Regular testing of cyber resilience frameworks, including scenario-based exercises and penetration testing, is required to validate effectiveness and readiness. See BIS: Guidance on cyber resilience for financial market infrastructures.

Situational Awareness and Learning: Banks must maintain situational awareness of evolving cyber threats and continuously improve their cyber resilience posture through lessons learned and industry collaboration. See BIS: Guidance on cyber resilience for financial market infrastructures.

Compliance Challenges

Fragmented Regulatory Landscape: Differences in national regulations and supervisory practices create complexity for multinational banks, making harmonized compliance difficult. See BIS: Cyber-resilience range of practices.

Skills Shortage: There is a global shortage of qualified cybersecurity professionals, making it challenging to recruit and retain talent. See BIS: Cyber-resilience range of practices.

Third-Party Risk Management: Managing cyber risks associated with third-party vendors and service providers is a persistent challenge, especially as outsourcing increases. See BIS: Cyber-resilience range of practices.

Real Example: The 2016 Bangladesh Bank cyber heist exposed weaknesses in incident response and third-party risk management, leading to significant financial and reputational losses. See IMF: Cyber Risk, Market Failures, and Financial Stability and Federal Reserve: Cybersecurity and Financial System Resilience Report.

Implementation Best Practices

Establish a Cyber Resilience Framework: Align with international standards such as the CPMI-IOSCO Guidance and integrate with existing risk management processes.

Conduct Regular Risk Assessments: Identify and prioritize critical assets and business functions, and assess vulnerabilities using tools like NIST Cybersecurity Framework and ISO/IEC 27001.

Implement Layered Security Controls: Use a defense-in-depth approach, including firewalls, intrusion detection systems, and endpoint protection. Reference Basel Committee: Cyber-resilience range of practices.

Develop and Test Incident Response Plans: Regularly conduct tabletop and live exercises to ensure readiness. See CPMI-IOSCO Guidance.

Leverage Industry Resources: Participate in information-sharing forums such as FS-ISAC and use implementation guides from OCC: Cybersecurity and Financial System Resilience Report.

Recent Updates

2024 Revised Basel Core Principles: The Basel Committee updated its core principles for effective banking supervision, emphasizing operational and cyber resilience. See IMF: 2024 Revised Basel Core Principles and BIS: Basel Core Principles.

Integration with Operational Resilience: The Basel Committee has integrated cyber resilience into broader operational resilience frameworks, with new guidance released in 2021 and 2024. See BIS: Principles for Operational Resilience and OCC: Sound Practices to Strengthen Operational Resilience.

Effective Dates: The most recent updates were published in 2024, with implementation timelines varying by jurisdiction. See BIS: Cyber-resilience range of practices.

Related Regulations

CPMI-IOSCO Principles for Financial Market Infrastructures (PFMI): These principles set the foundation for operational and cyber resilience in financial market infrastructures. See CPMI-IOSCO PFMI.

NIST Cybersecurity Framework: Widely adopted for structuring cyber risk management in the financial sector. See NIST Cybersecurity Framework.

ISO/IEC 27001: International standard for information security management systems, often referenced in regulatory guidance. See ISO/IEC 27001.

Interaction: These frameworks are often referenced or required as part of Basel Committee compliance, and their controls and processes overlap significantly with Basel cyber resilience principles.

Industry Impact

Enhanced Operational Resilience: Financial institutions have strengthened their ability to withstand and recover from cyber incidents, reducing systemic risk. See Federal Reserve: Cybersecurity and Financial System Resilience Report.

Increased Compliance Costs: Banks face higher costs for technology, training, and compliance due to the need for continuous improvement and regular testing. See OCC: Cybersecurity and Financial System Resilience Report.

Greater Industry Collaboration: The principles have driven increased information sharing and collaboration across the financial sector, improving collective defense. See FS-ISAC and BIS: Cyber-resilience range of practices.

Sources

Recent developments

2025-12-19 — Basel Committee issues updated **principles for the sound management of third‑party risk**, explicitly aiming to strengthen banks’ operational and cyber resilience as outsourcing, cloud, and technology partnerships expand across the sector.[6] (source)
2025-11-13 — ECB Banking Supervision highlights evolving IT and cybersecurity risks and states it will intensify assessments of **operational and cyber resilience** from 2025, aligning its supervisory expectations with Basel Committee principles and the EU’s Digital Operational Resilience Act (DORA).[4] (source)
2025-11-07 — Basel Committee published its **2025/26 work programme**, prioritising digitalisation of finance, ICT risk management, and finalisation of supervisory principles for third‑party risk, signalling continued refinement of cyber/operational resilience expectations building on existing Basel principles.[2][9] (source)
2025-11-05 — Basel Committee publishes its **2025/26 work programme**, prioritising digitalisation of finance, ICT risk management and supervisory principles for third‑party risk, confirming ongoing development and refinement of Basel cyber/operational resilience principles rather than a wholesale rewrite.[2] (source)
2025-10-30 — Industry analysis of the Basel Committee 2025/26 work programme notes that digital operational resilience, ICT risk and third‑party risk supervision will be key themes, signalling **tighter supervisory use of Basel cyber resilience principles** across major jurisdictions.[9][2] (source)

Related regulations

PCI DSS v4.0.1 (Payment Card Industry Data Security Standard) — Global, Active, effective 2025-03-31
SEC Cybersecurity Disclosure Rules — United States, Active, effective 2023-12-18
SEC Regulation S-P Amendments (Customer Data Incident Response) — United States, Active, effective 2026-06-03
NCUA Cyber Incident Notification Requirements — United States, Active
Sarbanes-Oxley Act of 2002 (SOX) — United States, Active
GLBA (Gramm-Leach-Bliley Act) — United States, Active
Digital Operational Resilience Act (DORA) — European Union, Active, effective 2025-01-17
Open Banking Security Standards — European Union, Active

Put it into practice

Generate the policy: DORA policy generator (generatepolicy.com)
Buy the policy pack: Financial Services Bundle (cyberpolicy.shop)
Build it yourself: Vendor Risk Operations Kit (ciso.diy)

Browse all regulations · Compliance deadlines · Latest updates