The FMA is reminding licensed financial service providers about the importance of cyber-resilience as part of Cyber Smart Week 2023, CERT NZ’s annual awareness campaign which runs until November 5.
The authority says that as part of its role in promoting fair, efficient, and transparent markets “…we encourage all financial service providers to protect themselves online, particularly with the growing threat from online scams and data attacks. Effective management of cyber risk by financial service providers directly contributes to the operational resilience capability of the entity.”
It also notes that one of the requirements for some FMA-licensed entities is that they must notify the FMA “…of any event that materially impacts the information security of their critical technology systems, which can be caused by cyber-related incidents.”
A 2019 thematic review of cyber resilience in FMA-regulated entities found most participants were aware of the increasing cyber security risk and assessed themselves as being highly capable of protecting against, and recovering from, such threats, the FMA says.
…participating entities did not rate themselves highly in terms of detecting and responding to cyber threats…
“However, participating entities did not rate themselves highly in terms of detecting and responding to cyber threats. Participants also predicted that their cyber resilience was generally expected to improve over the following two years.”
FMA Executive Director of Response and Enforcement Paul Gregory says that in cyber risk, prevention is better than cure.
“The FMA encourages all financial service providers to understand cyber threats and to ensure their systems are resilient to best protect themselves and their customers.”
He adds that it’s important that entities “…encourage their staff to better understand the cyber risk and to be aware of the materials provided by CERT NZ and the FMA to best protect their businesses and their customers.”
FMA-related documents on cyber-resilience
- Cyber resilience of FMA-regulated entities thematic review 2019
- Cyber resilience information sheet for FAPs 2021
- Cyber security and operational systems resilience information sheet 2022
Also see CERT NZ’s resources.