GRC

CREST maps five-stage maturity path for financial cyber resilience

CREST’s whole-ecosystem model for financial cyber resilience, and what it means for UK firms under CBEST, operational resilience rules and DORA.

Shield graphic with the headline Building cyber resilience across UK finance

CREST has published a maturity model that treats financial sector cyber resilience as a job shared by banks, their supervisors and the testing firms they hire. For UK firms already under CBEST, the operational resilience rules and, often, DORA, it is a useful way to check whether their assurance is real or only looks good on paper.

What happened

On 29 October 2026, CREST, the not-for-profit body that accredits penetration testing and threat intelligence companies, released a whitepaper called Cyber Resilience in Financial Services: A Whole Ecosystem Approach. Its central point is that no bank, insurer or payments firm is resilient on its own. All of them depend on shared infrastructure, common technology suppliers, specialist cyber firms and public authorities, so a gap in any one of those can weaken everyone.

The paper divides the system into three domains. Financial institutions own the risk to their critical business services. Supervisors set proportionate expectations and watch risk across the sector. Cyber service providers deliver assessment, threat intelligence, testing and incident response. CREST chief executive Nick Benson said the whole system “depends on their capability developing together”. CREST stresses that the pathways are illustrative and are not a new compliance standard.

The detail

Each domain gets its own five-stage pathway. For institutions, the stages run as follows:

  • Ad hoc: hygiene gaps remain and dependencies are poorly understood.
  • Foundational: basic hygiene is in place and gaps found by self-assessment are being funded for remediation.
  • Established: independent review begins, along with selected threat-led penetration testing (TLPT).
  • Reliable: purple teaming and regular, proportionate TLPT are routine.
  • Advanced: the firm has strong in-house testing and contributes to resilience across the sector.

The supervisor pathway runs from mapping the sector and settling the regulator’s mandate to adaptive oversight that reaches into critical supply chains. The provider pathway runs from services nobody has independently validated, through self-assessment, to independent accreditation. At the top sit specialist financial sector providers that can safely run TLPT on live systems.

The most useful part of the paper is about sequencing. CREST argues that a regulator should build its own supervisory capability no later than the rules it introduces. It also argues that the provider market should be judged ready before firms are told to buy from it, and that advanced testing should come only after firms meet the baseline. It warns that poor tests give buyers false confidence and that advanced testing by inexperienced teams can do more harm than no test at all.

Flow diagram of CREST's five maturity stages for financial institutions, from ad hoc to advanced

Why it matters for UK organisations

Much of the paper is aimed at countries that are still building their regimes. The UK is at the mature end of that scale, but the framework still lines up closely with what British firms already deal with.

CBEST. The Bank of England, the PRA and the FCA have used CBEST since 2014 to assess systemically important firms and financial market infrastructures. A CBEST has four phases: initiation, threat intelligence, penetration testing and closure. Both the threat intelligence provider and the penetration testing provider must be CBEST accredited, and CREST is the scheme’s accreditation body. CREST’s own 2026 TLPT guidance for financial services uses the same four stages, so CBEST-style testing maps naturally onto the upper stages of its ladder.

Operational resilience. The operational resilience rules from the FCA and PRA took effect in March 2022. By 31 March 2025, firms in scope had to be able to keep each important business service within its impact tolerance. CREST’s focus on mapping services first fits that regime. Its demand for independent evidence, rather than self-attestation, is where many mid-tier firms will feel the pressure.

Third parties. The FCA has said that 40% of the incidents reported to it in 2025 involved a third party. Its new incident and third-party reporting rules apply from 18 March 2027 and use a single portal shared with the PRA and the Bank. The three regulators have also started jointly overseeing critical third parties.

DORA. UK groups with EU subsidiaries have been subject to the EU’s Digital Operational Resilience Act since 17 January 2025. DORA includes resilience testing, ICT third-party risk and oversight of critical ICT providers. CREST lists DORA and TIBER-EU alongside CBEST, and it suggests that a recognised financial sector framework can map a single control programme to several regulations, reducing duplication. For a group regulated in both the UK and the EU, that is the main practical gain.

Expert view

CREST is not a neutral party here. It sells accreditation, and a paper arguing that providers should be accredited serves its interests. Even so, the core argument holds up. In my experience, the gap between a test report and actual resilience is usually set when the test is bought, not when it is carried out. Scopes get trimmed to fit a budget, the cheapest quote wins, and a clean report goes to the board as evidence.

Steven Swift of Suzu Labs argued that high-level governance frameworks say little about specific technical controls, and summed it up as “compliance is not security”. I agree. A maturity score is only as good as the evidence behind it. When we test firms that rate themselves highly, the findings are rarely exotic: stale privileged accounts, flat internal networks and third-party remote access that nobody has reviewed. That matches what the Bank’s CBEST guide says about the value of simulating privileged insiders and supply chain attacks.

What to do now

  1. Place yourself honestly on the five stages. Base it on evidence such as retest results and detection outcomes, not policy documents. Have the board approve a target stage for each important business service.
  2. Fix the basics first. Check the Cyber Essentials controls (firewalls, secure configuration, user access control, malware protection and security update management) against the systems behind each important business service. Close the gaps before you pay for red teaming.
  3. Buy assurance on quality. Check the provider’s accreditation for the specific service you are buying, and name the individuals who will do the work. Reject scopes that leave out third-party connections and privileged paths.
  4. Get ready for March 2027 reporting. Identify which suppliers support each important business service and test whether you could report an incident at one of them under the new rules.
  5. Map once, comply several times. If you are subject to DORA as well as UK rules, keep one control framework mapped to all of them so the same evidence serves each regime.

Bottom line

The CREST paper creates no new obligations, and CREST has a clear stake in its conclusions. Its value for UK firms is as a diagnostic tool that shows how CBEST, the operational resilience rules, third-party oversight and DORA fit into one maturity journey. Testing only helps if the firm, its regulator and its testers are all mature enough to act on what it finds.

Sources

Related Posts