How do banks quantify cyber risk within the operational risk framework?

Cyber risk is arguably the fastest-growing segment of operational risk, and banks are still evolving their approaches. Here's how the industry currently handles it:

Why Cyber Risk Is Different:

• Rapidly evolving threat landscape — Attack vectors change quarterly, making historical data less predictive
• Correlated losses — A single breach can trigger regulatory fines, litigation, remediation costs, and reputational damage simultaneously
• Asymmetric information — The attacker knows more about the vulnerability than the defender
• Systemic potential — A major attack on a clearing house or payment network could cascade across the financial system

Common Frameworks:

1. NIST Cybersecurity Framework — Organized around five functions: Identify, Protect, Detect, Respond, Recover. Banks map their controls to these functions and assess maturity levels.

1. FAIR (Factor Analysis of Information Risk) — A quantitative model that decomposes cyber risk into:

• Threat Event Frequency x Vulnerability = Loss Event Frequency
• Loss Event Frequency x Loss Magnitude = Annual Loss Exposure

1. Basel Committee guidance (2021) — Recommends integrating cyber risk into the overall operational risk framework rather than treating it as a standalone silo.

Quantification Example — Sentinel Banking Group:

Using FAIR methodology for a data breach scenario:

This $120M figure feeds into the bank's overall operational risk capital model alongside traditional loss categories.

Integration Challenges:

• Cyber losses often span multiple Basel event types (external fraud, business disruption, clients & products)
• Attribution is difficult — was the loss due to a technology failure (op risk) or a third-party compromise (supply chain risk)?
• Insurance recoveries for cyber policies must be modeled carefully since coverage terms are evolving rapidly

Exam tip: FRM Part II may test your understanding of how cyber scenarios are incorporated into loss distribution approaches and the limitations of using historical data for an evolving threat.

For cyber risk case studies, visit our FRM Part II community on AcadiFi.