Systems of Cyber Resilience: Secure and Trusted FinTech

The World Economic Forum's FinTech Cybersecurity Consortium identifies the need for a sector-wide baseline of cybersecurity controls to protect the global financial system from pervasive cyber risks. The report proposes a tiered approach to security, where a universal base layer of 'cyber hygiene' is established for all FinTechs, followed by specialized controls based on a firm's specific services and maturity. After evaluating candidate frameworks, the report recommends the Center for Internet Security (CIS) Top 20 Critical Security Controls as the preferred starting point for low-maturity FinTechs due to its simplicity and prioritization, while suggesting the Financial Services Cybersecurity Profile (FSC Profile) for firms seeking to align with complex global regulatory requirements.

• The modularization of financial services has increased systemic risk because it interlinks organizations with widely varying levels of cybersecurity maturity, making it difficult to track how attackers move laterally across the supply chain.
• FinTechs often struggle with cybersecurity due to fragmented cross-border regulations, limited resources, and a global shortage of skilled expertise.
• The report recommends a tiered 'chocolate bar' approach to cybersecurity controls: a base layer of security essentials applicable to all FinTechs, with additional specialized requirements (such as PCI DSS) added based on the specific business activity.
• The Center for Internet Security (CIS) Top 20 Critical Security Controls (version 7.1) is recommended for foundational work because it is prioritized, simple, and provides a clear roadmap for low-maturity firms.
• A primary limitation of the CIS CSC 20 is that it does not map directly to financial services regulations, meaning it is generally insufficient on its own for partnerships with regulated financial firms.
• The Financial Services Cybersecurity Profile (FSC Profile) is highly effective for regulatory compliance, synthesizing over 2,300 regulatory provisions into 277 diagnostic statements (reduced to 145 for the lowest-impact tier).
• The FSC Profile is considered more complex than the CIS CSC 20 and lacks the same level of prioritization and technical implementation tools for low-maturity companies.
• The report suggests that cybersecurity controls should be defined by financial services providers in consultation with experts and government agencies, rather than being driven solely by regulation, to ensure they keep pace with technological change.

APA

World Economic Forum (2020). Systems of Cyber Resilience: Secure and Trusted FinTech. http://www3.weforum.org/docs/WEF_Systems_Cyber_Resilience_2020.pdf

Chicago

World Economic Forum. Systems of Cyber Resilience: Secure and Trusted FinTech. 2020. http://www3.weforum.org/docs/WEF_Systems_Cyber_Resilience_2020.pdf.

Wikipedia

{{cite report |author=World Economic Forum |title=Systems of Cyber Resilience: Secure and Trusted FinTech |date=July 2020 |url=http://www3.weforum.org/docs/WEF_Systems_Cyber_Resilience_2020.pdf |access-date=23 October 2026 |via=Climate Insights Directory}}

BibTeX

@techreport{worldeconomicforum2020systems, author = {{World Economic Forum}}, title = {{Systems of Cyber Resilience: Secure and Trusted FinTech}}, institution = {World Economic Forum}, year = {2020}, month = jul, url = {http://www3.weforum.org/docs/WEF_Systems_Cyber_Resilience_2020.pdf}, urldate = {2026-10-23}, note = {Indexed by Climate Insights Directory} }