The State of Cyber Resiliency in Financial Services

Written by Troy Leach, Chief Strategy Officer and John Yeoh, Global VP of Research, CSA.

Global disruptions, changing regulatory oversight, and emerging AI threats are just some of the issues that cybersecurity professionals must prepare for today. In the upcoming report “Cloud Resiliency in Financial Services,” CSA analyzed industry-wide survey data to identify the key cyber resiliency areas that matter most to the financial industry. The report includes the perspectives of more than 860 security practitioners, CISOs, and financial services leaders on what are the most common resiliency challenges in cloud computing today.

The report covers preferred cybersecurity frameworks, cloud adoption strategies, regional regulatory challenges, and other key factors affecting organizations’ abilities to withstand or quickly recover from threats to their cloud environments. It also compares the differences in perspective from financial institutions (FIs) compared to those not within the regulated industry (non-FIs).

In anticipation of the upcoming report, read some of our most eye-opening findings below.

Relevant Operational Resiliency Frameworks

Frameworks and regulations play a crucial role in operational resiliency within the financial industry.

• FIs have widely adopted the NIST Framework (67%) compared to non-FIs (39%)
• PCI DSS is essential for payment processing businesses, heavily referenced by FIs (43%) compared to non-FIs (25%)
• ISO 27001, alongside NIST, is one of the most adopted frameworks because of its versatility across industries
• European regulation such as the Digital Operational Resiliency Act (DORA) and the EU Cybersecurity Act introduce new validation for third-party cloud services to be demonstratively protecting financial data and assets
• Privacy of data and complying with GDPR and other global legislation is of high importance to FIs, especially when evaluating Large Language Models

Adoption trends show that FIs prefer to focus on fewer frameworks, reflecting a more streamlined approach to regulatory compliance.

Workload Resiliency and Third-Party Risk

FIs exhibit distinct organizational strategies in cloud adoption and workload resiliency. 78% of FIs prefer to use a single cloud service provider for simplicity and ease of management.

Additionally, enhanced disaster recovery preparedness is higher in FIs (60%) compared to non-FIs (36%). Improved infrastructure scalability and availability are also higher in FIs (58%) compared to non-FIs (41%).

Risk reporting and third-party risk assessments remain an emphasis for FIs, reflecting their regulatory environments. The survey shows FIs focus more on risk assessment (45%) and integration with Enterprise Risk Management (24%), with special attention on due diligence, third-party audits, and SLA reviews. On the other hand, non-FIs emphasize risk analysis (24%), reporting mechanisms (11%), and compliance (10%). Both sectors could stand to enhance risk management frameworks and improve communication channels.

Threats, Challenges, and Generative AI

The financial services sector is keeping in mind several key concerns and threats:

• Insufficient talent, necessitating training and recruitment efforts (49%)
• Cloud security strategies not tailored to the financial sector (33%)
• Identity and Access Management (IAM) risks such as unauthorized access and data breaches (31%).
• Challenges with serverless and containerized environments (25%)

Top challenges with cloud service providers include:

• Misconfigurations in cloud settings (62%)
• Integration of various cloud and third-party services (52%)
• Effective identity and access management systems (35%)

Recommendations for FIs include prioritizing training and development programs, implementing robust IAM solutions, enhancing visibility in cloud environments, and conducting regular security assessments.

Regarding Generative AI, both FIs and non-FIs highlight concerns about data privacy and integrity. FIs are more worried about the misuse of AI for cyber attacks (20%), while non-FIs are more concerned about the costs and resource intensity of AI implementation (8%). Both sectors need to better address data accuracy, information biases, and regulatory compliance for AI models and integrations.

More Insights Coming Soon

The upcoming “Cloud Resiliency in Financial Services” report highlights many more aspects of cloud resiliency. You'll get deeper insights on financial services and AI, regulatory compliance, cloud adoption, regional considerations, and continuous improvement.