1. European Cybersecurity Month 2017 kick-off event
The challenge of cybersecurity for the banking sector
Sébastien de Brouwer, Chief Policy Officer
European Banking Federation

2. Who is EBF? National banking associations from 32 countries
3,500 banks with approx. 2 million employees
From major cross-border financial institutions to small regional entities
Mission:
To be the voice of banks and position the European banking industry in the European and global regulatory frameworks
4 strategic themes:
Banking supervision & SSM
Financing the economy & the Single Market
Reputation
Digital transformation of banks

3. The digital transformation of banks:
EBF workstreams

4. The digital transformation of banks: EBF Workstreams
Banking and general regulations
Cybersecurity
Access / E-identification / e-signature /e-archiving
Data (data analytics and privacy)
Cloud
Online platform and infrastructure
Blockchain technologies
Payments and aggregation
Alternative lending and investment (assets and liabilities)
Digital skills 

5. EBF activities on Cybersecurity in brief

6. Main objectives:
Safeguard the integrity of banking networks and the trust of customers
Help shape a European regulatory environment that is more harmonized and conducive to the fight against cybercrime
Actively contribute to the enhancement of digital skills both for NIS professionals and for the general public

7. Main actions (1/2): Regulatory environment The EBF has contributed to:
EC consultation on the evaluation and review of ENISA (Apr 2017)
EC consultation on combatting fraud and counterfeiting on non-cash means of payment (May 2017)
WP29 guidelines on data breach notification under GDPR (Nov 2017)
EC call for feedback on the Proposal for a Cybersecurity Act (Dec 2017)
On-going advocacy for amendments to the body of the Proposal for a Cybersecurity Act (Q1&2 2018)
Intelligence sharing
Promoting industry initiatives to create intel sharing platforms and alleviate related legislative obstacles
Cooperating with Europol EC3 to facilitate communication between LEAs and the banking sector

8. Main actions (2/2): Incident reporting harmonization
Promoting industry initiatives to create a common taxonomy for reporting
Facilitating exchange of practices
Maintaining dialogue with EU supervisory and regulatory bodies (EC, ECB)
Awareness-raising and digital skills
Cooperating with Europol EC3 and ENISA for awareness-raising campaigns and events
EBF Annual Cybersecurity Conference in the framework of the ECSM
Member of the EC Digital Skills & Jobs Coalition
Digital skills included in EBF’s annual European Money Week
Introducing digitalization of banking in the Sectoral Social Dialogue in Banking
Ready to contribute in discussions on the recently announced European Cybersecurity Research and Competence Centre

9. EBF on the EC Proposal for a Cybersecurity Act

10. EBF key messages (1/2) ENISA’s cooperation with the private sector
We welcome an adequately resourced Agency to enhance cybersecurity cooperation between MSs and all relevant actors.
Especially important: a regular dialogue between ENISA and the banking sector and the sector’s participation in the PSG
Formalise industry participation in the creation of cybersecurity certification schemes
Need for smooth transition to the new EU framework:
take into account existing standards and schemes (national and international);
formalize cooperation with all relevant stakeholders (public and private sectors, certification and standard-setting bodies) in all phases of scheme creation;
include the industry in the European Cybersecurity Certification Group.

11. EBF key messages (2/2)
Maintain the voluntary nature of the new EU cybersecurity certification framework
Banking sector already complying with numerous supervisory obligations and standards stemming from int’l & EU & national
>need for flexibility and a bottom-up approach taking into account these
existing requirements
Create cost-effective and time-effective certification schemes and processes
European banks invest heavily on IT infrastructure and digital banking: 53 billion euro in Cost-effectiveness of new schemes is extremely important.
Rapid technological progress and evolution of cyber threats makes it necessary that the scheme-creating process is time-effective allowing at the same time for all necessary consultations.

12. EBF preparing more detailed proposals: (1/4)
For banking sector-specific certifications, need for ENISA to work closely with ECB, EBA and the Art. 29 Data Protection Working Party. (Rec. 30)
Clarification from the European Commission on ENISA’s counterpart at national level would be welcome. (Art. 6)
In education and awareness-raising for the workforce and for citizens, the banking sector can contribute its extensive experience in providing education for financial and digital literacy – already collaborating to that end with Europol-EC3 and ENISA.
> Include the industry as a potential source of valuable information for
ENISA’s dedicated portal (para. (d) of Art. 9).

13. EBF preparing more detailed proposals on: (2/4)
ENISA’s Permanent Stakeholders’ Group (PSG) needs to be more inclusive and relevant:
experts from European-level agencies would ensure a most necessary European-wide representation;
the above agencies should at least represent the essential services sectors. On that note, need to ensure proper representation of the banking sector. (Art. 20)
Need for further clarification on what ICT products and services would be subject to the certification schemes. (Art. 43)
EBF preparing more detailed proposals on: (2/4)

14. EBF preparing more detailed proposals: (3/4)
Cybersecurity is a global issue: EBF supports close international cooperation as a means to improve and/or align cybersecurity standards. (Art. 43)
To ensure cost- and time-effectiveness in preparing and adopting schemes, relevant certification and standard-setting bodies should be part of the process, and the same applies for the industry (EU-level representative sectoral organizations). By involving all relevant stakeholders, diverse expertise and knowledge will be ensured, leading to the appropriate design and implementation of a certification scheme and thereby restricting the cost of complying to new requirements. (Art. 44)
Assurance levels: Need to understand under what circumstances each level would apply as depending on how the product and service would be used, the level of risk and other factors, the criticality of the product or service (Art. 46)

15. EBF preparing more detailed proposals: (4/4)
Need for an impact assessment when elaborating the elements of a certification scheme, and especially the cybersecurity requirements and the evaluation criteria and methods. (Art. 47)
Scheme elements: Proposal to include as an additional element the maximum time period foreseen for reviewing all the other elements. (Art. 47)
The EBF would appreciate further clarification in terms of the transition from national certification schemes to the European ones. In particular, existing national certificate holders should be made aware of the process to be followed and the respective timeline allowed to adapt to a new scheme. For example, will a process of validation of existing certificates be foreseen? (Art. 49)

16. Thank you for your attention
Sebastien de Brouwer
Chief Policy Officer
European Banking Federation