Cyber Resilience for Bank Boards

From the guide

Cyber resilience for bank boards: the questions that matter

If a critical banking service were disrupted tomorrow, what evidence gives the board confidence that the bank could respond and recover? The full guide works through this in detail; here are the essentials.

The questions a board should ask

Start with the banking service, not the technology. Choose a service that matters to customers — accessing deposits, making payments, completing time-sensitive lending — and ask management to explain what happens if it becomes unavailable, unreliable or unsafe to use. From there, the guide sets out nine questions. The core of them:

• Which banking services matter most, and what would their disruption mean for customers?
• What cyber risks could prevent those services from operating safely?
• Which safeguards matter most, and what shows that they work?
• Which group or external services could interrupt delivery — and what can the bank do if a parent company or provider cannot restore service?
• Who can make urgent decisions, including when key leaders are unavailable?
• Have we tested safe recovery under realistic disruption?

For each, ask for a clear answer, supporting evidence and a named owner. Where the evidence is incomplete, agree the next step and when the board will return to it.

The evidence to request

Assurance is only as good as what sits behind it. The guide pairs each question with the evidence that supports a real answer:

• Service priorities and an assessment of customer harm.
• Service-specific scenarios and significant unresolved weaknesses.
• Recent control tests, exceptions and the scope of assurance.
• Dependency records, accountable owners and shared points of failure.
• Delegated authority, tested outside normal hours.
• Exercise results, data checks and evidence of corrective action.

A system being restored does not by itself demonstrate that customer transactions are accurate or that the bank can safely resume the service. Look for recent tests, unresolved weaknesses and realistic recovery assumptions.

A practical scenario

Buck's interpretation

A useful test is whether the board can explain its judgement and show the evidence behind it. Board papers and minutes should make it possible to trace the issue, the evidence considered, the questions raised and the resulting decision — and significant actions should be tracked through to an evidenced outcome, including repeated audit or supervisory findings.

Attendance at training alone gives a limited picture of board capability. Test whether directors can use their understanding to challenge a real issue, and keep judgement connected to evidence: for a material concern, assemble the assessment, the management recommendation, independent assurance where appropriate, and evidence of remediation — then explain the remaining uncertainty and who has authority to accept it.

The recommendation is deliberately simple: at your next meeting, select one essential service and one credible disruption. Ask management to explain the consequences, demonstrate its response options and identify the decision or support it needs. Agree the most important gap, the person responsible and what the board expects to see next — and return to the issue until there is a supported conclusion.