Financial Cyber and Operational Resilience
The Global Risks Alliance (GRA)
Financial firms depend on chains of software libraries, hardware, vendors and service providers, most of them several steps away. A vulnerability or compromise anywhere in the chain can reach the firm. This page sets out how digital supply chain risk develops, how it is managed and measured, and who decides.
GRA · In development · service level R0
Digital supply chain risk is the risk that software, hardware and service supply chains bring vulnerabilities or compromise into financial firms. It arises from widely reused components, limited visibility and trusted update channels. Security leaders, procurement, supervisors and vendors hold the decisions.
How a failure at one financial centre can spread through settlement links. Design links, not real dependencies.
Vendor risks and software dependencies. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Widely used open-source components appear in many products. A flaw in one, such as a logging library, exposes thousands of systems at once.
Firms know direct suppliers but rarely their suppliers' suppliers. Software bills of materials aim to make components visible.
Trusted update channels can deliver malicious code if a vendor's build system is compromised, bypassing perimeter defences.
Once a flaw is public, attackers move quickly. Firms that cannot identify where a component is used cannot patch in time.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Software bill of materials | A list of the components and dependencies in a piece of software. |
| Open-source component | Software code published under a licence that allows reuse, often embedded in commercial products. |
| Build system compromise | An attack that alters software during its creation so malicious code ships in legitimate updates. |
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Software with a software bill of materials | share of critical applications | periodic | Firm records | DECLARED |
| Time to identify affected systems after a public vulnerability | hours or days | per event | Firm records | REPORTED |
| Critical suppliers assessed for security | share | annual | Vendor management records | DECLARED |
| Supply chain incidents | count | annual | Incident reports | REPORTED |
| End-of-life components in critical systems | count | periodic | Asset inventories | DECLARED |
| Fourth-party dependencies mapped | share of critical suppliers | periodic | Firm records | DECLARED |
The topic as a computational graph: named sources feed the methods, an evidence review gates the outputs, and the decisions stay with the authorities that hold them.
Fig. 02Nodes carry their type, two metric rows and a state; connectors show what feeds what; dashed frames name the owners; the timeline is the cadence. Design of the pipeline, not a record of a run.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| NTIA and CISA software bill of materials guidance | Minimum elements and practice for SBOMs | Public domain |
| ENISA threat landscape for supply chain attacks | Analysis of supply chain incidents | Free, ENISA terms |
| OpenSSF Scorecard | Security practice indicators for open-source projects | Open source, Apache 2.0 |
| NIST Secure Software Development Framework | Practices for secure software development | Public domain |
| EU Cyber Resilience Act | Security requirements for products with digital elements | Free, EU reuse terms |
Financial Cyber and Operational Resilience prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Chief information security officers | How to inventory and assure software components | SBOM practice and vulnerability evidence |
| Procurement and vendor management | What security evidence to require from suppliers | Standards and contract practice |
| Supervisors and legislators | What supply chain requirements apply | Incident evidence and comparative rules |
| Software vendors | How to secure build and update processes | Secure development frameworks |
A compromised software update delivered through a trusted channel can give attackers access to every customer that installs it. A vulnerability in a widely used open-source library can expose systems across the industry overnight. A faulty update from a security or infrastructure vendor, with no attack involved, can disable systems at many firms simultaneously.
Visibility is limited. Firms often know their direct suppliers but not the components and sub-suppliers beneath them. Software bills of materials, which list the components in a product, are one response, as are stronger requirements on how suppliers build, sign and distribute software.
Listing components in software. Limits: adoption is incomplete and lists must be kept current.
Practices for building and distributing software securely, grounded in software and safety-critical systems engineering. Limits: depend on supplier discipline.
Questionnaires, audits and certifications of suppliers. Limits: point-in-time and often superficial.
Mapping shared components across the sector, using network science. Limits: data is fragmented.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.