A cybersecurity framework is essential for banks to manage these overlapping risks — it isn’t just a function of IT nor is it limited to certain categories of staff. Institutions need to have a board-level understanding of cybersecurity risk and install senior management that will implement cybersecurity best practices, create clear roles and responsibilities related to cyber risk, and make a detailed cybersecurity framework an integral part of their vendor risk management.

After creating a cybersecurity framework, institutions’ next step is to have proactive, ongoing cybersecurity risk assessment and mitigation. This may include active board involvement in cyber policies, ongoing threat assessments and internal reviews, recurring investment in secure infrastructure and cybersecurity solutions, and regular cyber stress testing to evaluate defenses against evolving threats. A proactive approach ensures that cybersecurity remains a core component of overall risk management.