In an integrated approach, the implications of cyber resilience from an operational risk perspective
should be properly assessed as part of the decision-making process at board level (covering eg new
services, products, IT investments and an FMI’s organisational structure). Some FMIs have introduced
clear cyber resilience-related processes, including identification of responsibilities and accountabilities.
One such process is risk acceptance. As part of operational risk management, it includes input and
analysis on cyber resilience and business continuity from relevant staff at all levels, including business
units, internal audit, the chief information security officer and the board.