Take-Aways (AI)
  • FINMA publishes Super­vi­so­ry Com­mu­ni­ca­ti­on 03/2024 with fin­dings, cla­ri­fi­ca­ti­ons on the report­ing obli­ga­ti­on and infor­ma­ti­on on sce­na­rio-based cyber exercises.
  • Signi­fi­cant defi­ci­en­ci­es in ser­vice pro­vi­der manage­ment: miss­ing invent­ories, incom­ple­te con­trols and ina­de­qua­te inte­gra­ti­on into the inter­nal con­trol system.
  • Ina­de­qua­te gover­nan­ce, pro­tec­tion mea­su­res and reco­very plans; trai­ning and data loss pre­ven­ti­on often incomplete.
  • Report­ing obli­ga­ti­ons spe­ci­fi­ed: 24-hour initi­al noti­fi­ca­ti­on, 72-hour full noti­fi­ca­ti­on, dead­lines for out­sour­cing app­ly from the time the pro­vi­der beco­mes awa­re of the situa­ti­on; sce­na­rio-based exer­cis­es prescribed.

On June 7, 2024, FINMA published a super­vi­so­ry noti­ce 03/2024 on cyber risks. published (a.o. ger­man and eng­lish).

The FINMA super­vi­so­ry com­mu­ni­ca­ti­on “03/2024 – Fin­dings from cyber risk super­vi­so­ry acti­vi­ties, cla­ri­fi­ca­ti­on of FINMA super­vi­so­ry com­mu­ni­ca­ti­on 05/2020 and sce­na­rio-based cyber exer­cis­es” contains

  • Fin­dings from FINMA’s cyber risk super­vi­so­ry acti­vi­ties, inclu­ding deep dives at banks;
  • a spe­ci­fi­ca­ti­on of the FINMA super­vi­so­ry com­mu­ni­ca­ti­on 05/2020 on the obli­ga­ti­on to report cyber-attacks; and
  • Notes on the sce­na­rio-based cyber exer­cis­es in accordance with the Cir­cular Ope­ra­tio­nal Risks and Resilience.

Fin­dings from cyber risk super­vi­si­on activities

FINMA has attempt­ed to ans­wer the que­sti­on of which fac­tors are par­ti­cu­lar­ly important for the suc­cess of cyber attacks as part of on-site inspec­tions, inclu­ding at banks (“deep dives”).

At Ser­vice pro­vi­der level the pic­tu­re is obvious­ly sobering. Over­all, the­re is often a lack of a clear view of the ser­vice pro­vi­ders, the signi­fi­can­ce of the ser­vices they pro­vi­de in the con­text of the institution’s acti­vi­ties, the risks asso­cia­ted with out­sour­cing and the type and signi­fi­can­ce of the data pro­ce­s­sed. The­re also appears to be a lack of inte­gra­ti­on of risk con­trols into the ICS and a lack of com­mu­ni­ca­ti­on bet­ween the insti­tu­ti­on and the provider:

  • Only “very few” insti­tu­ti­ons exch­an­ge infor­ma­ti­on with the most important ser­vice pro­vi­ders after iden­ti­fy­ing secu­ri­ty gaps so that they can clo­se them.
  • Some ser­vice pro­vi­ders were appar­ent­ly negli­gent in clo­sing vulnerabilities.
  • Very often” the­re is no com­ple­te inven­to­ry of ser­vice pro­vi­ders, inclu­ding cri­ti­cal func­tions or cri­ti­cal data stored by the ser­vice pro­vi­der. The moni­to­ring of ser­vice pro­vi­ders was the­r­e­fo­re incomplete.
  • Some insti­tu­ti­ons appar­ent­ly do not record signi­fi­cant sub­con­trac­tors correctly.
  • The­re is also a pro­blem with the clas­si­fi­ca­ti­on of cri­ti­cal data – “for the most part, the insti­tu­ti­ons con­cer­ned had not cle­ar­ly defi­ned” what they con­sider to be cri­ti­cal data.

Also with the Gover­nan­ce FINMA has iden­ti­fi­ed deficiencies:

  • Medi­um-sized insti­tu­ti­ons often do not cor­rect­ly dif­fe­ren­tia­te bet­ween the ope­ra­tio­nal hand­ling of cyber risks and the inde­pen­dent con­trol body.
  • Cyber risk poten­ti­als are often not cor­rect­ly iden­ti­fi­ed and employees’ access rights are often unclear due to the lack of a cen­tral aut­ho­rizati­on tool.
  • Quite a few” insti­tu­ti­ons have not expli­ci­t­ly inte­gra­ted cyber risks into the manage­ment of ope­ra­tio­nal risks.
  • Some super­vi­sed insti­tu­ti­ons” defi­ned cyber risks and their risk appe­ti­te or risk tole­rance inadequately.

With the Pro­tec­ti­ve mea­su­res FINMA sees the fol­lo­wing short­co­mings, even if the over­all “trend” is positive:

  • The pro­tec­ti­ve mea­su­res for data loss pre­ven­ti­on (DLP) have too nar­row a focus on CID or cre­dit card num­bers. Other cri­ti­cal data such as “sen­si­ti­ve per­so­nal data”, busi­ness secrets, intellec­tu­al pro­per­ty, etc. are often not captured.
  • Some insti­tu­ti­ons do not test their data back­up pro­ce­s­ses and reco­very plans for resi­li­ence in the event of a ran­som­wa­re attack, for example.
  • A “lar­ge num­ber” of insti­tu­ti­ons lack trai­ning and awa­re­ness in the cyber area.

At the Detec­tion, respon­se and reco­very after cyber attacks FINMA sees the fol­lo­wing patterns:

  • Some insti­tu­ti­ons did not have suf­fi­ci­ent respon­se plans for cyber incidents.
  • Some insti­tu­ti­ons do not moni­tor their infor­ma­ti­on and com­mu­ni­ca­ti­on tech­no­lo­gy prompt­ly and systematically.
  • Often, no spe­ci­fic reco­very mea­su­res were defi­ned after cyber attacks.

The pic­tu­re that FINMA paints here is not sur­pri­sing and is of cour­se not limi­t­ed to regu­la­ted sec­tors. Risk pro­tec­tion can only be effec­ti­ve if it inclu­des all system com­pon­ents, i.e. if inter­faces to exter­nal ser­vices are also inclu­ded in the risk assess­ment, and if the pro­ce­s­ses for mana­ging risks are thought through to the end. Many com­pa­nies have a some­what insu­lar view of their own area wit­hout suf­fi­ci­ent­ly taking into account the shared respon­si­bi­li­ty for inter­faces and purcha­sed ser­vices. Howe­ver, a signi­fi­cant pro­por­ti­on of cyber attacks are car­ri­ed out via pro­vi­ders. Accor­ding to public sources, around 40% of cyber­at­tacks via the sup­p­ly chain, and more than 90% of all com­pa­nies are said to be affec­ted by such attacks.

Cla­ri­fi­ca­ti­on of the FINMA super­vi­so­ry com­mu­ni­ca­ti­on on the obli­ga­ti­on to report cyber attacks

On May 7, 2020, FINMA published its Super­vi­so­ry Com­mu­ni­ca­ti­on 05/2020 – Duty to report cyber attacks published. Sin­ce then, it has recei­ved “various inqui­ries regar­ding their inter­pre­ta­ti­on” – par­ti­cu­lar­ly recent­ly in the cour­se of the new cir­cular on ope­ra­tio­nal risks and resi­li­ence (RS 2023/1). It is taking this as an oppor­tu­ni­ty to make cla­ri­fi­ca­ti­ons to Super­vi­so­ry Com­mu­ni­ca­ti­on 05/2020, which should the­r­e­fo­re be read tog­e­ther with this Super­vi­so­ry Com­mu­ni­ca­ti­on 03/24 in future.

The cla­ri­fi­ca­ti­ons rela­te to the Duty to report in accordance with Art. 29 para. 2 FINMASAwhich FINMA has spe­ci­fi­ed for all super­vi­sed insti­tu­ti­ons in Super­vi­so­ry Noti­ce 05/2020 and for banks and secu­ri­ties firms in RS 2023/1. In for­mal terms, Super­vi­so­ry Noti­ce 03/24 only refers to the ear­lier Super­vi­so­ry Noti­ce 05/2020 (which was not repea­led by RS 2023/1), but in terms of con­tent, its state­ments natu­ral­ly also app­ly to the par­al­lel obli­ga­ti­ons in RS 2023/1.

FINMA spe­ci­fi­es its super­vi­so­ry expec­ta­ti­ons as follows:

Dead­line for notifications

Here FINMA con­firms what is alre­a­dy known: from the time a cyber attack is dis­co­ver­ed, the insti­tu­ti­on must 24 hours time for an initi­al report to FINMA. Within the­se 24 hours, the insti­tu­ti­ons must sub­mit a Initi­al assess­ment on cri­ti­cal­i­ty in order to assess whe­ther the cyber attack requi­res a report to FINMA.

The “actu­al” mes­sa­ge must then be sent within a total of 72 hours via the FINMA sur­vey and appli­ca­ti­on plat­form (EHP).

Expec­ta­ti­ons for the initi­al notification

FINMA cla­ri­fi­es that time­liness is the most important aspect of the initi­al noti­fi­ca­ti­on. No spe­cial expec­ta­ti­ons app­ly in terms of form or con­tent, and initi­al noti­fi­ca­ti­ons can also be revoked:

  • The Initi­al noti­fi­ca­ti­on can be made infor­mal­ly, a noti­fi­ca­ti­on by e‑mail, tele­pho­ne etc. is suf­fi­ci­ent. Based on the initi­al assess­ment, the aim is to deter­mi­ne the then known facts to be repro­du­ced. Not­hing more is requi­red at this stage. FINMA’s aim here is to react quick­ly; the con­tent of the initi­al noti­fi­ca­ti­on is secondary.
  • Of cour­se, it is pos­si­ble that fur­ther cla­ri­fi­ca­ti­on may reve­al that the initi­al noti­fi­ca­ti­on was not man­da­to­ry. Insti­tu­ti­ons can the­r­e­fo­re revo­ke initi­al noti­fi­ca­ti­ons at any time. with­draw.

If an insti­tu­ti­on is also sub­ject to the report­ing obli­ga­ti­on under the ISG, the initi­al report can also be sub­mit­ted using the BACS report­ing form if the opti­on to for­ward the report to FINMA is sel­ec­ted (based on Art. 73d E‑ISG). Howe­ver, the insti­tu­ti­on must ensu­re that the dead­line can be met. The time bet­ween report­ing to BACS and for­war­ding to FINMA is the­r­e­fo­re the respon­si­bi­li­ty of the insti­tu­ti­on. As far as is known, howe­ver, for­war­ding by the BACS is auto­ma­ted and wit­hout fil­ters, i.e. pre­su­ma­b­ly imme­dia­te­ly. The actu­al report must then still be sub­mit­ted via the EHP.

Expec­ta­ti­ons for the actu­al message

For reports of cyber attacks with a seve­ri­ty level of “medi­um” or more, the Super­vi­so­ry Com­mu­ni­ca­ti­on 05/2020 requi­res a final root cau­se report that inclu­des at least the inter­nal or exter­nal inve­sti­ga­ti­on or foren­sic report (fur­ther requi­re­ments can be found in the Super­vi­so­ry noti­ce 05/2020). As FINMA has now cla­ri­fi­ed, the root cau­se report should include the fol­lo­wing points for the seve­ri­ty level “high” or “serious”:

  • Rea­son for the suc­cess of the cyber attack;
  • Impact of the attack on com­pli­ance with regu­la­to­ry requi­re­ments, the institution’s ope­ra­ti­ons and customers;
  • initia­ted miti­ga­ti­on mea­su­res to address the effects of the attack.

For cyber attacks with the seve­ri­ty level “serious”, evi­dence and ana­ly­ses of the cri­sis organization’s abili­ty to func­tion must also be submitted.

Start and cal­cu­la­ti­on of deadlines

In par­ti­cu­lar, FINMA is con­fir­ming its long-estab­lished prac­ti­ce that the dead­lines for report­ing begin to run upon out­sour­cing, if the pro­vi­der beco­mes awa­re of the cyber attack. Out­sour­cing is the respon­si­bi­li­ty of the insti­tu­ti­ons. FINMA con­clu­des from this,

that the report­ing dead­line beg­ins to runas soon as the insti­tu­ti­on, or in the case of out­sour­ced func­tions the third-par­ty pro­vi­dera cyber inci­dent has dis­co­ver­ed. This also ensu­res the equal tre­at­ment under super­vi­so­ry law of insti­tu­ti­ons that have not out­sour­ced any functions.

This applies in any case to pro­vi­ders of essen­ti­al func­tions. If a ser­vice pro­vi­der is not an essen­ti­al out­sour­cing part­ner, the insti­tu­ti­on must ensu­re that it is infor­med of cyber incidents.

When cal­cu­la­ting the dead­lines for the initi­al noti­fi­ca­ti­on and the sub­se­quent noti­fi­ca­ti­on only offi­ci­al bank working days count. An excep­ti­on applies to attacks with the seve­ri­ty level “serious”. In this case, the dead­line for the initi­al report also runs out­side of bank working days. FINMA must be read as mea­ning that this does not app­ly to the dead­line for the fol­low-up report.

Sce­na­rio-based cyber exercises

FINMA cla­ri­fi­es a num­ber of points regar­ding sce­na­rio-based cyber exer­cis­es for banks and secu­ri­ties firms. The scope and con­tent of the­se exer­cis­es are based on the gene­ral­ly appli­ca­ble pro­por­tio­na­li­ty prin­ci­ple in RS 23/1. Syste­mical­ly important insti­tu­ti­ons must also car­ry out red team­ing exer­cis­es, and other insti­tu­ti­ons must car­ry out a table-top exer­cise at least once a year. The smal­ler insti­tu­ti­ons (super­vi­so­ry cate­go­ries 4 and 5) can also par­ti­ci­pa­te in the exer­cis­es of the Swiss Finan­cial Sec­tor Cyber Secu­ri­ty Cen­ter (Swiss FS-CSC) as long as the insti­tu­ti­on-spe­ci­fic thre­at poten­ti­al can be deter­mi­ned with the cor­re­spon­ding Swiss FS-CSC exercise.

FINMA also reser­ves the right to

to have such risk-based, sce­na­rio-rela­ted cyber exer­cis­es car­ri­ed out sel­ec­tively as part of the regu­la­to­ry audit or an addi­tio­nal audit and to moni­tor them closely.