The European Central Bank has completed its first Cyber Resilience Stress Test, an exercise that examined how 109 directly supervised banks across the euro area would respond to and recover from a severe cybersecurity incident. The results, published on 26 July 2024, found that banks had response and recovery frameworks in place but that areas for improvement remained. It was the ECB's first supervisory stress test dedicated to cyber resilience.

WHAT THE TEST ASSESSED

The Cyber Resilience Stress Test did not focus on banks' ability to prevent a cyberattack from occurring in the first place — that remains a separate area of supervisory attention. Instead, the exercise concentrated exclusively on response and recovery: how quickly and effectively an institution could contain the damage once a severe incident had already occurred, restore critical systems and data, and resume normal customer-facing operations.

Participating banks were assessed on the robustness of their crisis management frameworks, the clarity of internal escalation procedures, the adequacy of backup systems and data recovery arrangements, and the quality of their communication with external stakeholders such as customers, service providers and law enforcement agents during a live incident. The exercise used a fictitious scenario in which all preventive measures failed and a cyberattack severely affected the databases of each bank's core systems. All 109 banks answered a questionnaire and submitted documentation, while a sample of 28 banks underwent more extensive testing, performing an actual IT recovery test and receiving on-site visits from supervisors.

FINDINGS AND SUPERVISORY FOLLOW-UP

The ECB's findings pointed to areas for improvement in banks' ability to restore systems and services within their own planned recovery timelines.

The ECB said the results would feed into its 2024 Supervisory Review and Evaluation Process (SREP) but would not affect banks' Pillar 2 Guidance, and that supervisors had given each bank individual feedback and would follow up accordingly. The Digital Operational Resilience Act (DORA), which applies from early 2025, will introduce binding requirements on ICT risk management, incident reporting, and third-party technology oversight for the European Union financial sector.