The European Central Bank (ECB) today concluded its cyber resilience stress test, which gauged how banks would respond to and recover from a severe but plausible cybersecurity incident. Overall, the stress test showed that banks have response and recovery frameworks in place, but areas for improvement remain. The results will feed into the 2024 Supervisory Review and Evaluation Process (SREP) and have helped increase banks’ awareness of the strengths and weaknesses of their cyber resilience frameworks.
The exercise was launched in January 2024 and featured a fictitious stress test scenario under which all preventive measures failed and a cyberattack severely affected the databases of each bank’s core systems. The stress test therefore focused on how banks would respond to and recover from a cyberattack, rather than on how they would prevent it.