CPMI-IOSCO Cyber Guidance for FMIs Explained

Financial market infrastructures are expected to resume critical operations safely within two hours of a cyber attack and still settle by the end of the day, and few cyber programmes are designed around that test. The expectation comes from the CPMI-IOSCO Guidance on cyber resilience for financial market infrastructures, published in June 2016, which sits behind how central banks and securities regulators oversee payment systems, central securities depositories, central counterparties and trade repositories. National rules such as the Eurosystem's Cyber Resilience Oversight Expectations and the Bank of Canada's Expectations for Cyber Resilience are built on it. This guide explains what the Cyber Guidance asks for, how overseers assess it, where FMIs fall short, and how a security team can turn the eight chapters into evidence. It is for CISOs, risk and compliance leads, and architects at FMIs and at the participants and service providers connected to them.

Source note: dates, structure and findings below are taken from the CPMI, IOSCO, ECB, Bank of Canada and FSB publications listed in Standards and references, checked in November 2026. Confirm against the official text before relying on it.

Key takeaways

It supplements the PFMI, it does not replace it. The Cyber Guidance sets no new standards beyond the Principles for Financial Market Infrastructures; it explains how Principles 2, 3, 8, 17 and 20 apply to cyber risk.
The two-hour resumption objective is the hardest test. PFMI 17.6 expects critical IT systems to resume within two hours of a disruption, and the CPMI-IOSCO 2022 assessment named shortfalls against it as its one serious issue of concern.
Eight chapters, one framework. Five risk management categories (governance, identification, protection, detection, response and recovery) plus three overarching components (testing, situational awareness, learning and evolving).
National overseers add detail and maturity levels. The Eurosystem's CROE grades expectations as evolving, advancing and innovating, and expects systemically important payment systems to reach advancing.
Data integrity and the ecosystem matter as much as uptime. Resuming on corrupted data, or through a compromised participant, defeats the purpose; plans must cover both.

What the Cyber Guidance is and who it applies to

The Guidance on cyber resilience for financial market infrastructures was published by the Committee on Payments and Market Infrastructures (CPMI) and the Board of the International Organization of Securities Commissions (IOSCO) on 29 June 2016 as CPMI Papers No. 146, after a three-month public consultation. Its stated aim is to add momentum to FMIs' efforts to prevent cyber attacks, respond to them and recover faster and more safely when they succeed, and to give authorities internationally agreed guidelines for oversight.

It applies to the same entities as the PFMI, which the CPMI and IOSCO published on 16 April 2012: systemically important payment systems, central securities depositories, securities settlement systems, central counterparties and trade repositories. The press release states the guidance is supplemental to the PFMI and applies "primarily in the context of governance (Principle 2), the framework for the comprehensive management of risks (Principle 3), settlement finality (Principle 8), operational risk (Principle 17) and FMI links (Principle 20)."

PFMI principle	Why it matters for cyber	What overseers look for
Principle 2: Governance	Board accountability for cyber resilience	Board-approved cyber resilience strategy and framework, named senior executive, cyber expertise at board level
Principle 3: Comprehensive risk management	Cyber risk from participants, links and service providers	Ecosystem risk assessment, interdependency mapping
Principle 8: Settlement finality	A cyber event must not make final settlement uncertain	Plans to complete settlement by end of day and reconcile data after an attack
Principle 17: Operational risk	Business continuity, the two-hour resumption objective	Cyber scenarios in BCP, tested recovery, integrity checks before resumption
Principle 20: FMI links	Contagion between linked FMIs	Controls and monitoring on link connections, joint testing

In practice the guidance reaches far beyond the FMI itself. Participants, critical service providers and linked FMIs are part of the attack surface, and overseers increasingly ask FMIs to show how they influence that ecosystem. For the wider regulatory picture by country, see the Financial Services Cyber Regulation Map; this guide goes deeper into the FMI-specific layer only.

The eight chapters and what each one expects

The guidance is organised into five primary risk management categories and three overarching components. The Eurosystem CROE and the Bank of Canada ECR both follow the same eight-part structure, which makes it a practical skeleton for an FMI's own control framework.

Chapter	Core expectation	Evidence an overseer will ask for
Governance	A cyber resilience framework and strategy approved by the board, with clear roles and a culture of cyber risk awareness	Board minutes, strategy, risk tolerance statements, framework review cycle, training records for board and staff
Identification	Know critical operations, information assets, processes and interconnections, and their dependencies	Asset inventory including identities and access rights, data flow maps, list of external connections and third parties
Protection	Controls proportionate to the risk, designed in from the start, including people and insider threat	Access control and privileged access standards, network segmentation, secure development, supplier contract clauses
Detection	Ability to recognise signs of a potential incident or actual breach early, including anomalous activity	Monitoring coverage of critical systems, use cases, alert triage metrics, multi-layered detection
Response and recovery	Resume critical operations safely within two hours and complete settlement by end of day, preserving data integrity	Cyber-specific response and recovery plans, tested runbooks, data reconstruction approach, communication plans
Testing	Test all elements of the framework with a range of methods, scenarios and independent testers	Vulnerability assessments, scenario-based tests, penetration tests, red team results, remediation tracking
Situational awareness	Understand the threat landscape and share information	Threat intelligence process, information sharing membership, threat reports to the board
Learning and evolving	Adapt the framework from incidents, tests and industry developments	Lessons learned register, metrics, framework updates and their drivers

The two-hour resumption objective in practice

The two-hour expectation is older than the Cyber Guidance. PFMI key consideration 17.6 says the business continuity plan "should ensure that critical information technology (IT) systems can resume operations within two hours following disruptive events", and the cyber resilience expectations add the completion of settlement by the end of the day of the disruption, even in extreme but plausible scenarios. The Cyber Guidance applies that to cyber attacks, where the hard part is not failing over but knowing that what you fail over to is clean.

The Bank of Canada ECR makes the point directly: it treats the "two-hour RTO" as resumption of critical operations rather than full recovery, because restoring the whole system within two hours after a cyber attack may not be safe. Several design choices follow:

Separate resumption from recovery: define the minimum set of services that must come back within two hours (for example, payment acceptance and settlement for critical participants) and accept that full recovery and forensic work continue afterwards.
Plan for a compromised secondary site: active-active replication copies malware and corrupted data in near real time. Overseers expect plans that do not assume the backup environment is clean, which usually means isolated, immutable copies and a known-good restore point. See the Cyber Recovery Vault Guide.
Data integrity before resumption: plans need a way to identify the last good state, reconstruct transactions since then (from participants, message logs or links) and reconcile. See the Data Integrity Protection Against Destructive Attacks Guide.
Identity recovery is on the critical path: if the directory, privileged access platform or secrets store is compromised, nothing else can be restored safely. Rebuilding administrative identities and service credentials needs its own tested runbook. See the Backup Identity Isolation Guide.
Decide in advance who can declare resumption: the guidance expects decision-making under uncertainty, so name the role, the criteria and the evidence required before reopening to participants.

The 2022 Level 3 assessment found that a small number of FMIs had not fully met expectations for response and recovery plans that meet the 2hRTO, and that some plans fell short under extreme cyber attack scenarios. That is the area to resource first.

How national overseers implement it

Most central banks and securities regulators that oversee FMIs apply the Cyber Guidance through their own expectations. Two published examples show the pattern.

Document	Issuer and date	Scope	What it adds
Cyber Resilience Oversight Expectations for FMIs (CROE)	European Central Bank, December 2018	Eurosystem oversight of payment systems (SIPS, PIRPS, ORPS) and T2S; national authorities may apply it to CSDs, SSSs and CCPs	Three maturity levels: evolving, advancing, innovating. SIPS and T2S must reach advancing; retail systems at least evolving. Explicitly not a checklist; FMIs explain how they meet any expectation they do not follow literally
Expectations for Cyber Resilience of FMIs (ECR)	Bank of Canada, October 2021	FMIs designated by the Bank of Canada	Numbered expectations per chapter, interpretation of the two-hour objective as resumption, detail on third-party assurance and data sharing to obtain uncorrupted data

Other jurisdictions build threat-led testing on top. In the EU, DORA now sets testing and ICT risk rules for many financial entities, and threat-led penetration testing frameworks such as TIBER-EU are used to deliver the red teaming the guidance describes. See the Threat-Led Penetration Testing Guide and the DORA Resilience Testing Guide. In the UK, operational resilience rules for firms run alongside FMI oversight; see the UK Financial Operational Resilience Guide.

Testing: where assessments find gaps

Three of the four issues of concern in the CPMI-IOSCO Level 3 assessment (published 29 November 2022, covering 37 FMIs in 29 jurisdictions as at February 2021) were about testing: no cyber resilience testing after significant system changes, a lack of comprehensive scenario-based testing, and not involving relevant stakeholders in testing responses. A testing programme that answers those findings looks like this:

Map tests to critical operations: list each critical service and the tests that cover its protection, detection and recovery. Gaps are visible immediately.
Trigger tests on change: add a cyber resilience test gate to the change process for significant changes (new platforms, new connectivity, major releases, new critical suppliers).
Run scenario-based exercises: include extreme but plausible scenarios: destructive malware in production and replicated sites, compromise of a privileged administrator, a compromised participant sending fraudulent instructions, loss of a critical service provider.
Bring stakeholders in: participants, linked FMIs, critical suppliers and the overseer should take part in some exercises, especially those that test end-of-day settlement and communication.
Use independent red teams: the ECR expects red teams to be independent of the function being tested; reporting results to the board is an NHI Mgmt Group recommendation.
Close the loop: track findings to remediation with owners and dates, and retest. This is the evidence for the learning and evolving chapter.

For planning and scoping, see the Red Team Rules of Engagement Template and the Backup and Recovery Testing Checklist.

Where identity fits

Many expectations in the protection and identification chapters are identity controls in practice. An FMI's highest-impact credentials are rarely end-user passwords: they are administrator accounts on settlement and messaging systems, operator credentials on payment gateways, and the service accounts, certificates and API keys that connect the FMI to participants, links and cloud services.

Inventory machine identities as information assets: include service accounts, certificates and API credentials that can submit, approve or alter instructions in the identification inventory, with an owner and a renewal date.
Privileged access on the critical path: separate administrative accounts for production settlement systems, phishing-resistant authentication, just-in-time elevation and session recording.
Participant endpoint security: the CPMI's May 2018 strategy on reducing the risk of wholesale payments fraud related to endpoint security notes that weaknesses at one endpoint can be exploited to commit payments fraud. FMIs set and check security requirements for participant connections, including how participant operator and machine credentials are protected.
Recovery of identity systems: test rebuilding directory services and privileged access tooling from clean sources within the resumption window.

See the Privileged Access Management Guide and the NHI Inventory Reconciliation guide.

Framework mapping

Many FMIs run a NIST CSF or ISO/IEC 27001 control set internally. The mapping below shows where the Cyber Guidance chapters land, so existing controls can be reused as evidence.

Cyber Guidance chapter	NIST CSF 2.0	NIST SP 800-53 Rev 5 examples
Governance	GV.OC Organizational Context; GV.SC Cybersecurity Supply Chain Risk Management	PM-16 Threat Awareness Program; SR-3 Supply Chain Controls and Processes
Identification	ID.AM Asset Management	CM-6 Configuration Settings
Protection	PR.AA Identity Management, Authentication, and Access Control	IA-5 Authenticator Management
Detection	DE.CM Continuous Monitoring	SI-7 Software, Firmware, and Information Integrity
Response and recovery	RS.MA Incident Management; RC.RP Incident Recovery Plan Execution	IR-4 Incident Handling; CP-2 Contingency Plan; CP-9 System Backup; CP-10 System Recovery and Reconstitution
Testing	Testing is spread across functions in CSF 2.0	CA-8 Penetration Testing

The mapping is indicative, not an equivalence: an overseer assesses against the guidance and its own expectations, not against NIST.

Building the evidence pack: a phased approach

The phases and timings below are an NHI Mgmt Group recommendation, not a CPMI-IOSCO requirement.

Gap assessment (months 0 to 3): score each of the eight chapters against the guidance and, where it applies, the national expectations (for example the CROE level your FMI must reach). Use the overseer's own self-assessment format if one exists.
Fix the serious gaps first (months 3 to 9): response and recovery plans that meet the two-hour resumption objective, data integrity and reconstruction, and identity system recovery. These are where assessments have found the most significant issues.
Testing programme (months 6 to 12): scenario-based tests, change-triggered tests, stakeholder exercises and an independent red team cycle.
Ecosystem (ongoing): participant security requirements and attestation, critical supplier assurance and contract clauses, link testing with other FMIs.
Report and refresh (annual): board reporting on cyber resilience against strategy, a lessons learned register and a framework review. Prepare incident data in a format that can map to the FSB's Format for Incident Reporting Exchange (FIRE), published on 15 April 2025, where your authorities adopt it.

Rollback and safety: recovery tests against production carry real risk. Start with tabletop and isolated environment tests, agree abort criteria with operations, and only then run live failover or restore tests in agreed windows.

Small versus large FMIs: the CROE ties the expected maturity to the FMI's role, so a retail payment system can aim for the evolving level while a systemically important system must reach advancing. Smaller FMIs often rely on a parent group or a critical service provider for detection and recovery; in that case the evidence pack must include the provider's test results and contract terms, not just the FMI's own.

Detection and measurement

Resumption time achieved in tests: measured time to resume critical operations in the latest extreme scenario test, against the two-hour objective.
Clean restore point age: how old the most recent verified, isolated, known-good copy of critical data and configuration is.
Change test coverage: percentage of significant changes in the period that had a cyber resilience test before go-live.
Stakeholder participation: number of exercises in the year that included participants, links or critical suppliers.
Finding closure: percentage of high-severity test findings closed within the agreed time.
Privileged and machine credential coverage: percentage of administrative and service credentials on critical systems that are inventoried, owned and rotated on schedule.

Common failure patterns

Treating the two hours as a disaster recovery failover metric: plans that meet two hours for a data centre outage but would replicate a destructive attack straight into the secondary site.
No reconstruction plan: backups exist, but nobody has worked out how to rebuild the transactions between the last clean point and the attack, or which participants hold that data.
Testing only in steady state: annual penetration tests with no testing after major changes and no scenario exercises, the exact gaps the 2022 assessment named.
Ecosystem left to contracts: participant security requirements written but never verified, so a compromised participant endpoint can still send valid-looking instructions.
Identity systems missing from recovery: runbooks assume the directory and privileged access platform are available, which is the first thing a capable attacker targets.
Board reporting without decisions: dashboards reach the board, but the risk tolerance and the resumption decision criteria are never approved there.

Practitioner checklist

Map your control framework to the eight chapters and to any national expectations your overseer applies.
Confirm the board has approved the cyber resilience strategy, framework and risk tolerance in the last year.
Define the minimum critical services that must resume within two hours and how settlement completes by end of day.
Keep isolated, immutable copies of critical data and configuration and test restoring them with integrity checks.
Write and test a data reconstruction and reconciliation procedure with participants.
Include directory, privileged access and secrets platforms in the recovery runbooks and tests.
Add a cyber resilience test gate for significant changes.
Run at least one extreme but plausible scenario exercise a year with external stakeholders.
Inventory and assign owners to machine identities that can submit or approve instructions.
Keep a lessons learned register that shows how tests and incidents changed the framework.

Standards and references

Related NHI Mgmt Group resources: Financial Services Cyber Regulation Map · Payments Sector Regulation Map · Operational Resilience Executive Briefing · DORA Guide. This guide summarises the CPMI-IOSCO Guidance on cyber resilience for FMIs and related oversight expectations and is not legal advice.

CPMI-IOSCO Cyber Guidance for FMIs: what payment and market infrastructures must show