CREST Unveils Ecosystem-Wide Framework to Bolster Financial Sector Cyber Resilience

In an era defined by rapid digital transformation and increasingly sophisticated threat actors, the financial services sector faces a daunting reality: individual security efforts, no matter how robust, are no longer sufficient to safeguard the stability of the global economy. A new whitepaper released by CREST, the global non-profit accreditation body for the cybersecurity industry, argues that cyber resilience must be treated as a collective responsibility shared across an entire ecosystem of institutions, supervisors, and specialist providers, rather than remaining siloed within the walls of individual firms.

The report, titled Cyber Resilience in Financial Services: A Whole Ecosystem Approach, was published on October 29 and seeks to provide a structured maturity pathway for jurisdictions worldwide. By assessing capabilities across three core domains, the framework aims to help financial systems coordinate improvements and address systemic vulnerabilities. According to CREST, the fundamental weakness in the current landscape is the reliance on fragmented defense strategies. If shared infrastructure, technology providers, cybersecurity firms, or public regulatory bodies are not aligned in their resilience efforts, the resulting gaps can undermine the stability of the entire financial system.

Defining the Three Domains of Cyber Resilience

At the heart of the CREST framework is a clear delineation of responsibilities. For the system to function effectively, each participant must fulfill its specific role while remaining cognizant of its interdependence with others.

Financial institutions remain the primary actors responsible for the direct protection of critical business services. Under the new guidance, these institutions are expected to go beyond basic compliance; they must proactively demonstrate that their security controls are not merely functional on paper, but robust enough to withstand high-pressure, real-world cyber incidents. This involves a shift from static security models to dynamic, evidence-based assurance.

Simultaneously, financial supervisors—the public authorities tasked with maintaining market integrity—are called upon to act as the orchestrators of resilience. Their responsibility extends beyond the oversight of individual firms. Supervisors must set proportionate expectations that reflect the actual threat landscape, manage systemic risks that cross institutional boundaries, and ensure that the regulatory environment fosters, rather than hinders, a culture of continuous improvement.

The third pillar of the framework consists of cyber service providers. These entities are the specialized force that institutions rely on for critical expertise. From threat intelligence and penetration testing to incident response and high-level strategic advice, these providers are the eyes and ears of the financial sector’s defense. The framework posits that the quality and consistency of these services are vital to the ecosystem’s health, and as such, providers must be integrated into the broader resilience strategy to ensure their capabilities match the evolving needs of the financial institutions they serve.

Mapping the Path to Maturity

To assist jurisdictions in measuring progress, the CREST framework maps each of the three domains through five distinct stages of cyber maturity. These pathways are designed to be navigated in tandem, ensuring that no single part of the ecosystem becomes a bottleneck for the others.

For financial institutions, the journey begins at the level of basic cyber hygiene—the essential practices required to prevent common, opportunistic attacks. From there, institutions are encouraged to progress toward advanced, threat-led assurance models. The ultimate goal is a state of continuous improvement, where security measures are constantly refined based on the latest intelligence and performance data.

Supervisors, meanwhile, are encouraged to evolve from a foundational stage of mapping their respective sectors and establishing basic mandates toward a state of adaptive, cross-sector oversight. This involves a move away from rigid, one-size-fits-all regulations toward more nuanced, risk-based supervision that accounts for the interconnected nature of modern finance.

Cyber service providers are similarly tasked with a progression, moving from providing unvalidated or generalized services to delivering highly specialized, financial-sector-specific capabilities. This maturation is essential, as the nuances of financial systems—ranging from high-frequency trading platforms to complex payment rails—require a level of expertise that goes far beyond general IT security.

CREST has emphasized that these pathways are illustrative rather than a new compliance standard. The primary objective is to create a common language across the three domains and to facilitate a system-wide measurement of maturity. By doing so, the framework aims to identify where one part of the ecosystem might be lagging, allowing for faster development and more targeted interventions before a systemic failure can occur.

A Multi-Year Roadmap for Systemic Stability

Recognizing that meaningful change cannot happen overnight, CREST has proposed a multi-year strategy for implementing these improvements. The organization warns that when regulatory requirements outpace the readiness of the market, the result is often "check-box" compliance, which provides a false sense of security without delivering actual assurance.

The proposed roadmap begins with an initial one-to-two-year phase focused on foundational work. During this period, institutions are encouraged to focus on mapping their critical services and closing urgent hygiene gaps. Concurrently, supervisors should concentrate on publishing clear baselines and long-term strategies. This foundational phase is crucial for ensuring that all players have a shared understanding of the risks they face.

As the program progresses into years three through five, the focus shifts toward more rigorous assessment. This period introduces independent, risk-based testing for financial institutions, tiered regulatory requirements that scale with the size and systemic importance of the firm, and a formal system of independent accreditation for cyber service providers.

Looking further ahead to the five-to-10-year horizon, the framework envisions a mature, highly resilient ecosystem. At this stage, the focus shifts to threat-led penetration testing, where security is challenged against realistic, high-level attack scenarios. The roadmap also calls for system-wide exercises that involve multiple institutions and supervisors working together, supported by a diverse and robust community of accredited specialist providers.

Preventing Market Exclusion and Fostering Growth

A significant concern addressed by the whitepaper is the risk of "regulatory exclusion." CREST warns that if jurisdictions move too quickly to mandate the highest levels of international accreditation, they may inadvertently shut out local providers, particularly in markets where such accreditation pathways do not yet exist.

To mitigate this, the framework emphasizes the importance of inclusivity. It suggests that jurisdictions support the growth of their local cyber communities through initiatives such as mentoring, strategic partnerships, and structured training programs. The organization highlighted its own Cyber Accelerated Maturity Programme (CREST CAMP) as an example of how the industry can support providers in reaching the necessary standards without causing market disruption.

Nick Benson, CEO of CREST, underscored the necessity of this collaborative approach in his commentary on the framework. "Financial institutions, supervisors, and cyber service providers each have a distinct role," Benson stated. "The strength of the system depends on their capability developing together."

By positioning cyber resilience as a shared burden and a collective goal, CREST’s framework seeks to move the financial industry away from fragmented, inward-looking security strategies. As the digital and financial worlds continue to fuse, the ability of these institutions to synchronize their defense capabilities will likely determine the long-term stability of the global financial system. The whitepaper serves as a call to action, urging stakeholders to look beyond their own immediate perimeters and toward the health of the entire ecosystem they inhabit.