Good Practices in Cyber Risk Regulation and Supervision

What it contains

Departmental Paper 26/001 consolidates the practical experience and lessons of the IMF’s work program on cyber risk regulation and supervision in the financial sector, begun in 2017 and applied in advanced, emerging and developing economies. It is aimed at specialists, managers and senior leaders of financial regulation, supervision and oversight authorities. The authors are Tamas Gaidosch, Emran Islam, Tanai Khiaonarong, Rangachary Ravikumar and Christopher Wilson.

The executive summary argues that authorities should treat cyber risk as one of the sector’s main risks, since institutions and market infrastructures handle large volumes of personal and financial data and a systemic incident could affect financial stability. It proposes strengthening expectations and their enforcement without adding complexity, integrating technology risk regulation and cyber risk regulation into a single coherent framework and prioritizing three fronts: cybersecurity testing, crisis exercises coordinated by the supervisor and third-party risk management.

The content is organized into an introduction on concepts and the evolution of the threat, the IMF’s work (cyber risk assessments in the FSAP and technical assistance), good regulatory practices, which include the process of drafting rules and the comparison between principles-based and prescriptive approaches, and the key expectations on governance and internal controls, technology and cyber risk management, ICT service management, cybersecurity operations and response and recovery.

Summary prepared by the Dominican Republic Risk Management Club from a reading of the original document, with the source verified on 7 October 2026. It does not replace reading the official text and is not advice.

See all publications