Cybersecurity accreditation organization CREST has outlined a framework for strengthening financial sector cyber resilience, emphasizing coordination between financial institutions, regulators and cybersecurity service providers.
According to CREST’s Cyber Resilience in Financial Services: A Whole Ecosystem Approach, vulnerabilities can emerge from gaps between these groups, including differences in organizational responsibilities, oversight and international regulatory requirements.ㅤ
The framework identifies three interconnected areas of responsibility:
- Financial institutions must protect critical business services and maintain recovery capabilities;
- Regulators must establish supervisory expectations and assess sector-wide risks;
- Cybersecurity providers must deliver qualified security testing, threat intelligence and incident response services.
CREST also emphasizes threat-led penetration testing that combines current threat intelligence, realistic attack scenarios and remediation to identify weaknesses affecting important financial services.
Steven Swift, Managing Director, Suzu Labs:
“Its absolutely valid that connected organizations in our financial system share risks, as they’re all part of the larger whole. This is essentially just 3rd party risk management, tailored for our interconnected financial systems.
“The risk tiering makes sense, small local institutions will have a smaller worst case scenario than larger global institutions.
“However, choosing which subset of the NIST CSF and CRI Profile to apply to organizations based on their Tier makes zero sense. These are both foundational, it sets relatively basic, very high level requirements, and is largely focused on security governance, rather than specifics about which technical controls are appropriate to require.
“What’s missing, is that organizations should include tailoring a baseline based on the NIST 800-53 controls. This framework functions as a controls catalog, and it contains enough content that we could tailor additional requirements for larger, more mature, more impactful institutions, and pulling back a portion of those controls for smaller institutions.
“As always, compliance is not security. Organizations can meaningfully meet all of the requirements set forth at the Tier 1 level, and still have plenty of basic security gaps that remain wide open.
“Effective posture is the intersection of security governance, and technical security controls. Frameworks aiming to improve industry wide security posture need to address both directly if we hope to make meaningful improvements in security posture for the industry.”
ㅤ
Ryan McCurdy, Vice President of Marketing, Liquibase:
“CREST is right to call for a broader approach to cyber resilience. Financial institutions operate across an increasingly interconnected ecosystem but there’s another risk that deserves more attention: the changes organizations make to their own critical systems.
“Not every disruption starts with an attacker. A poorly governed database change can interrupt financial services just as effectively. And as AI accelerates software development, the volume of changes moving toward production will only increase.
“Financial institutions need to know what’s changing, who or what initiated it, and whether the right controls were enforced before deployment. That requires consistent policies, clear accountability, and evidence that can stand up to scrutiny.
“You can’t build resilience across an ecosystem if you don’t have control over the changes happening inside it.”
ㅤ
Seemant Sehgal, Founder & CEO, BreachLock:
“Having run global red teaming inside a bank for years, I know first-hand that the real exposure in financial services sits in the gaps between institutions, regulators, and providers. CREST is naming that reality in the framework, and shared responsibility across all three is a step in the right direction toward building real resilience.
“The threat-led penetration testing component of the framework is a practical approach to testing against current threat intelligence and realistic attack scenarios. It separates a compliance exercise from one that focuses more on proving resilience. A lot of institutions already run this discipline, and with this framework in place, the rest finally have something they can point at when they build the case internally.”
I hope that financial institutions read this and take action. Otherwise I and everyone else should reconsider their life choices.
CREST calls for ‘Whole Ecosystem Approach’ to financial organizations cyber resilience
Posted in Commentary with tags CREST on October 29, 2026 by itnerdCybersecurity accreditation organization CREST has outlined a framework for strengthening financial sector cyber resilience, emphasizing coordination between financial institutions, regulators and cybersecurity service providers.
According to CREST’s Cyber Resilience in Financial Services: A Whole Ecosystem Approach, vulnerabilities can emerge from gaps between these groups, including differences in organizational responsibilities, oversight and international regulatory requirements.ㅤ
The framework identifies three interconnected areas of responsibility:
CREST also emphasizes threat-led penetration testing that combines current threat intelligence, realistic attack scenarios and remediation to identify weaknesses affecting important financial services.
Steven Swift, Managing Director, Suzu Labs:
“Its absolutely valid that connected organizations in our financial system share risks, as they’re all part of the larger whole. This is essentially just 3rd party risk management, tailored for our interconnected financial systems.
“The risk tiering makes sense, small local institutions will have a smaller worst case scenario than larger global institutions.
“However, choosing which subset of the NIST CSF and CRI Profile to apply to organizations based on their Tier makes zero sense. These are both foundational, it sets relatively basic, very high level requirements, and is largely focused on security governance, rather than specifics about which technical controls are appropriate to require.
“What’s missing, is that organizations should include tailoring a baseline based on the NIST 800-53 controls. This framework functions as a controls catalog, and it contains enough content that we could tailor additional requirements for larger, more mature, more impactful institutions, and pulling back a portion of those controls for smaller institutions.
“As always, compliance is not security. Organizations can meaningfully meet all of the requirements set forth at the Tier 1 level, and still have plenty of basic security gaps that remain wide open.
“Effective posture is the intersection of security governance, and technical security controls. Frameworks aiming to improve industry wide security posture need to address both directly if we hope to make meaningful improvements in security posture for the industry.”
ㅤ
Ryan McCurdy, Vice President of Marketing, Liquibase:
“CREST is right to call for a broader approach to cyber resilience. Financial institutions operate across an increasingly interconnected ecosystem but there’s another risk that deserves more attention: the changes organizations make to their own critical systems.
“Not every disruption starts with an attacker. A poorly governed database change can interrupt financial services just as effectively. And as AI accelerates software development, the volume of changes moving toward production will only increase.
“Financial institutions need to know what’s changing, who or what initiated it, and whether the right controls were enforced before deployment. That requires consistent policies, clear accountability, and evidence that can stand up to scrutiny.
“You can’t build resilience across an ecosystem if you don’t have control over the changes happening inside it.”
ㅤ
Seemant Sehgal, Founder & CEO, BreachLock:
“Having run global red teaming inside a bank for years, I know first-hand that the real exposure in financial services sits in the gaps between institutions, regulators, and providers. CREST is naming that reality in the framework, and shared responsibility across all three is a step in the right direction toward building real resilience.
“The threat-led penetration testing component of the framework is a practical approach to testing against current threat intelligence and realistic attack scenarios. It separates a compliance exercise from one that focuses more on proving resilience. A lot of institutions already run this discipline, and with this framework in place, the rest finally have something they can point at when they build the case internally.”
I hope that financial institutions read this and take action. Otherwise I and everyone else should reconsider their life choices.
Leave a comment »