Towards a framework for assessing systemic cyber risk

Digitalisation is transforming the global economy, including by raising productivity and broadening consumer access to information. While these forces are facilitating greater competition, supporting economic growth and lowering prices, the benefits are not without risks – the flip side of digitalisation can be greater vulnerability to cyberattacks. For these to be a source of risk to financial stability, substitutability, risk correlation and interconnectedness are all key dimensions. A cyberattack on a critical infrastructure or an attack on one service that unearths vulnerabilities in another could quickly lead to system-wide stresses. Negative externalities arising from the effectiveness of financial institutions’ management of cyber risk could provide grounds for a public policy response. While the existing macroprudential policy toolkit has limited capacity to address cyber risks, their growing relevance nevertheless calls for macroprudential overseers to anticipate them, assess the capacity of the financial system to absorb them, and to issue risk warnings when warranted. In this vein, econometric evidence suggests that cyberattacks are not random, but are driven by factors such as economic strength, the degree of financial globalisation as well as policy and political uncertainty. This underscores how important it is for authorities to foster the sharing of information and the closing of data gaps on cyberattacks. JEL Classification: D43, D62, D82, E6, G22, G28, H41