DP13324 Some Principles for Regulating Cyber Risk

Author(s):	Anil K Kashyap, Anne Wetherilt
Publication Date:	November 2018
Keyword(s):	cyber risk, macroprudential regulation, stress test
JEL(s):	G18, G28, L51, O33
Programme Areas:	Financial Economics
Link to this Page:	cepr.org/active/publications/discussion_papers/dp.php?dpno=13324

We explain why cyber risk differs from other operational risks in the financial sector. The form of cyber shocks differs because of their intent, probability of success, possibility of a hidden phase and evolving form of the risks. The impact differs because problems can spread quickly and because uncertainty over the possibility of a hidden phase can impact responses. We explain why private incentives to attend to these risks may differ from societies' preferences and develop six (micro- and macroprudential) regulatory principles to deal with cyber risk.