Resilience

Financial market infrastructure forms the foundation of the financial system, and it plays a key role in payments, settlement, and transfer of funds. Their resilience lies in their ability to withstand disruptions, respond promptly to operational disruptions, and ensure continued functioning of critical financial services.

One of the Central Bank of Iceland’s legally mandated roles is to promote a secure and effective financial system, including domestic and cross-border payments. Performing this role requires taking account of an evolving risk landscape and strengthen resilience and protection of the financial market infrastructure.

The Central Bank places emphasis on strengthening the resilience of the financial system as a whole by promoting minimisation of risk, coordination of responses, and continuity in the operation of infrastructure that is fundamental to critical financial services.

The financial infrastructure incident management centre is a forum operated by the Central Bank of Iceland. Through the centre, participants in the financial system coordination plan can communicate about actual, suspected, or potential operational incidents and, as applicable, coordinate their responses to such incidents.

The incident management centre’s role is to ensure that participants respond promptly, effectively, and in a coordinated manner to operational and cybersecurity incidents affecting financial infrastructure, thereby minimising the impact such incidents will have on financial stability.

The centre’s objective is to mitigate the impact of severe incidents on the country’s financial market infrastructure.

Incident management centre participants are the Central Bank of Iceland, systemically important financial market infrastructure operators, systemically important supervised entities, other entities designated by the Bank as falling under the financial system coordination plan, and CERT-IS.

The Central Bank is responsible for operating the incident management centre and oversees its activities. Rules on the incident centre were approved by the Financial Stability Committee and took effect on 3 December 2025.

Iceland’s collaborative forum on the operational security of financial market infrastructure (SURF) aims to create a common approach for measures to enhance the resilience of financial market infrastructure against operational disruptions and to implement such measures. SURF is also intended to strengthen the resilience of Icelandic financial market infrastructure against all types of operational disruptions and serves as a platform for exchange of information and knowledge about operational resilience. SURF shall carry out tasks that are necessary to prepare the financial system to face shocks, including the following:

• Prepare regular risk analyses focusing on operational risk in financial market infrastructure, assess the potential impact that disruptions would have on financial system infrastructure, and make recommendations to the Central Bank on possible measures that could be taken in the financial system so as to reduce risk and enhance resilience.
• Communicate and analyse threat intelligence pertaining to the financial system and promote regular exchange of information on cybersecurity testing.
• Through the incident management centre for financial market infrastructure, coordinate responses to operational disruptions that could affect the security and efficiency of the financial system, organise exercises, present proposals for response plans to the Central Bank, and analyse incidents that have occurred.
• Prepare regular analyses of interdependencies in the financial system and formulate proposals to the Central Bank on possible measures to minimise the impact of concentration risk.

SURF operates under the leadership of the Central Bank. Participants are systemically important infrastructure operators, systemically important entities, other entities falling under the financial system coordination plan, and CERT-IS.

SURF has been in operation since 2022 and was reappointed in 2025, concurrent with the establishment of the Incident management centre.

The Central Bank of Iceland’s Cybersecurity Strategy for the Financial System lays down guidelines for cybersecurity in the system. It is intended to support policy-making, goal-setting, and prioritisation of improvements in cybersecurity at the Central Bank and other financial system entities.

It places key emphasis on preventative measures in cybersecurity, resilience in financial market infrastructure operations, and cooperation on cybersecurity and responses. With these priorities, attempts are made to reduce the likelihood of severe cyber incidents, limit their impact if they should occur, and support coordination within the financial system.

TIBER-IS is a framework for intelligence-led red team testing of institutions and companies that are important for the Icelandic financial system. It was implemented by the Central Bank of Iceland in February 2023. The framework aims to enhance test participants’ understanding of their ability to defend against cyberattacks, thereby bolstering the resilience of individual participants and the financial system as a whole. TIBER-IS is based on the European Central Bank’s (ECB) TIBER-EU framework, which it implements in full.

The TIBER-EU framework for threat intelligence-based ethical red teaming developed by the ECB. It enables standardised approach to conducting realistic, intelligence-led red team tests and is designed to improve the resilience of entities against sophisticated cyberattack A TIBER test is a controlled and bespoke test that mimics the tactics, techniques and procedures of real-life threat actors and targets an entity’s critical or important functions and the people, processes and technologies that support them. The objectives are to assess and improve the entity’s protection, detection and response capabilities.

The key priorities of TIBER-EU (and therefore TIBER-IS) are as follows:

• To enhance the financial market’s resilience against cyberthreats.
• To standardise and harmonise the way intelligence-led red tea tests are conducted in the EEA.
• To support testing of institutions operating in more than one jurisdiction.

TIBER-IS promotes harmonised approach to intelligence-lead red team testing, facilitates learning from testing, and increased resilience of individual participants and the financial system as a whole.

The Act on Digital Operational Resilience for the Financial Sector, no. 78/2025, entered into force at the beginning of 2026, thereby implementing Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA).

Further information on implementation of DORA at the Central Bank of Iceland can be found here. DORA establishes comprehensive requirements relating to ICT risk management and information security. It also requires certain financial entities identified by the competent authority to carry out advanced testing by the means of threat-led penetration testing (TLPT). The Central Bank determines which entities meet the applicable criteria and informs them by means of a formal designation letter.

The TLPT requirements in DORA have been implemented in full in TIBER-EU and therefore in TIBER-IS as well. In addition, TIBER-IS provides guidance and clarification of TLPT execution, based on experience gained in Iceland and in Nordic cooperation.

Implementation of requirements is structured as follows: DORA defines what must be done in connection with TLPT, while TIBER-EU and TIBER-IS descrive how it shall be done.

Further information on threat-led penetration testing and TIBER-IS can be obtained from the Central Bank of Iceland’s TIBER team, at TIBER-IS@sedlabanki.is.

• Description of TIBER-EU
• TIBER-IS Implementation Guide