20 December 2024

GFIA responds to FSB Consultation on the Format for Incident Reporting Exchange (FIRE)

In its response, GFIA emphasises the importance of coordination and consistency among member jurisdictions to ensure the successful implementation of FIRE. The association recognises the potential benefits of a common framework for incident reporting...

The Global Federation of Insurance Associations (GFIA) has submitted its response to the Financial Stability Board (FSB) consultation on the Format for Incident Reporting Exchange (FIRE). GFIA commends the FSB’s efforts to promote harmonisation in cybersecurity incident reporting across financial institutions globally.

 

In its response, GFIA emphasises the importance of coordination and consistency among member jurisdictions to ensure the successful implementation of FIRE. The association recognises the potential benefits of a common framework for incident reporting, which could simplify compliance for organisations operating under multiple regulatory regimes.

However, GFIA also highlights challenges, including:

 

• Divergent Standards: existing reporting frameworks in jurisdictions vary significantly, creating complexities for global adoption.
• Proportionality and confidentiality: GFIA urges respect for local laws that may restrict information sharing and calls for proportional reporting requirements to avoid unnecessary burdens.
• Minimum Necessary Standards: The association recommends that FIRE focus on defining the essential information needed by regulatory bodies to reduce compliance strain.

 

Testing and Stakeholder Engagement

GFIA supports the FSB’s proposed testing phase to validate FIRE’s design and robustness, as well as the planned 2027 workshop to review experiences and assess the need for revisions. Ongoing consultation with stakeholders is encouraged to ensure practical and effective implementation.

 

Technical Concerns

GFIA raises concerns about the practicality of the FIRE design for reporting phases, including:

 

• Incident Details: Some required fields may be impossible to complete within 24 hours during an active investigation.
• Impact Assessment: The lack of harmonised international severity levels could create inconsistencies.

 

GFIA

© GFIA - Global Federation of Insurance Associations