Effective practices for cyber incident response and recovery

Cyber incidents pose a threat to the stability of the global financial system. In recent years, there have been a number of cyber incidents that have significantly impacted financial institutions and the ecosystems in which they operate. Efficient and effective response to and recovery from a cyber incident by organisations in the financial ecosystem are essential to limit any related financial stability risks.

The FSB has developed a toolkit of effective practices that aims to assist organisations in their cyber incident response and recovery activities. In this regard, organisations’ respond function executes the appropriate activities in reaction to a detected or reported cyber incident, while the recover function carries out the appropriate activities to restore any systems, capabilities or resume services or operations that were impaired due to a cyber incident.