On 8 September 2026, the Bank of International Settlements (BIS)’ Committee on Payments and Market Infrastructures (CPMI) and the International Organization of Securities Commissions (IOSCO) published the Cyber Resilience Toolkit: Practical Considerations for FMIs (toolkit) and FMIs’ Reliance on Third-Party Service Providers: Challenges and Risks (discussion paper).
Toolkit
The toolkit has been jointly developed by CPMI and IOSCO to support financial market infrastructures (FMIs) as they seek to strengthen their cyber resilience frameworks and implement operational resilience-related components of the Principles for financial market infrastructures (PFMI), as informed by the Guidance on cyber resilience for financial market infrastructures (Cyber Guidance). The intended audience for the toolkit includes authorities, FMI board members, senior management and personnel with operational and cyber risk- and resilience-related responsibilities.
The toolkit is not intended to alter or replace any part of the PFMI or Cyber Guidance. Instead, it provides supplemental detail related to the preparations and measures that FMIs may undertake to enhance their cyber resilience capabilities, with the objective of limiting the escalating risks that cyber threats pose to financial stability.
The toolkit comprises a set of voluntary, non-binding tools which contain practical considerations across four topics relevant to enhancing the cyber resilience of FMIs, consistent with the PFMI as informed by the Cyber Guidance:
- Governance of cyber risk and resilience. The toolkit is intended to assist in strengthening the governance of an FMI’s cyber resilience framework and provides practical considerations for the training and assessment of board members and senior management with responsibilities for cyber risk and cyber resilience. It also provides considerations for managing risks arising from an FMI’s ecosystem as well as insight into the use of risk management metrics and maturity models to appraise and report on the adequacy and effectiveness of an FMI’s cyber resilience framework (CRF).
- Scenario identification and design. The toolkit provides practical considerations for developing cyber scenarios, beginning with identifying the objectives and scope, and then understanding the landscape and situation specific to the FMI. It also provides factors to consider in designing scenarios and adding complexity.
- Response, resumption and recovery plans. The toolkit is designed to support FMIs in developing response, resumption and recovery plans by providing practical considerations for FMIs in three key areas: (i) identification and prioritisation of critical operations and assets; (ii) capabilities to support response, resumption and recovery plans; and (iii) criteria for identifying conditions for safe resumption of operations, including when to disconnect from and reconnect to ecosystem entities.
- Testing and exercising. The toolkit describes the various categories of testing and exercising used in CRF testing programmes. It also provides references and practical considerations for the development of a cyber resilience testing programme and for the preparation and execution of the testing and exercising in each of these categories.
The toolkit also contains a number of practical considerations for adapting to the risks from and leveraging the benefits of ongoing developments in artificial intelligence.
Discussion Paper
The discussion paper discusses the risk management challenges associated with the increased reliance of FMIs on third-party service providers and FMIs’ resulting increased operational risk exposure, particularly for the delivery of their critical services. It explores where it may be particularly important to address these challenges due to FMIs’ critical role and interconnectedness within the financial system. It also examines relevant work that other standard-setting and international bodies have undertaken with respect to third-party risk management in other parts of the financial sector.
Next steps
The deadline for comments on the toolkit and discussion paper is 1 December 2026.
Recent Comments