Calculating Reserves for Cyber Risk: Vetting Cyber Risk Models

Financial Institutions (FIs) treat cyber risk as an enterprise-wide risk and calculate necessary economic and regulatory reserve requirements. Measuring cyber risk in economic terms similar to other financial risks such as credit and market risk enables those risks to be combined into a single integrated risk measure. This integration makes cyber risk fungible with other enterprise risks within the FI, further adding business value through an enhanced ability to avoid, transfer, mitigate, or accept that risk. This document, the second White Paper of the series, introduces core concepts that an FI’s risk management team can use to build confidence in Open FAIR™ cyber risk models.