Lessons Learned and Evolving Practices of the TIBER Framework for Resilience Testing in the Netherlands - Working Paper October 2019

Sep 4, 2026

Examines lessons learned and evolving practices in applying the TIBER framework to resilience testing for the financial system in the Netherlands. Frames the challenge of an evolving cyber threat landscape and increasing expectations from regulators and consumers. Summarizes how CPMI-IOSCO cyber resilience guidance highlighted the need not only to assess posture but also to test it in practice. Describes the Dutch drivers for initiating, adopting, and implementing TIBER since February 2016.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages21

Reading Time53 min

AccessFree to download

Introduction

The Initiation

Preparation—How to Get Organized?

The Launch and Beyond

The Testing

The Continuation and Extension

International Developments

Concluding Remarks

Notes

WORKING PAPER OCTOBER 2019 Cyber Policy Initiative Working Paper Series | “Cybersecurity and the Financial System” \#5 Lessons Learned and Evolving Practices of the TIBER Framework for Resilience Testing in the Netherlands Petra Hielkema and Raymond Kleijmeer C ARNE GIE ENDO W MENT F OR INTERNATIONAL PEA CE Lessons Learned and Evolving Practices of the TIBER Framework for Resilience Testing in the Netherlands Petra Hielkema and Raymond Kleijmeer For your convenience, this document contains hyperlinked source notes indicated by this teal colored text.© 2019 Carnegie Endowment for International Peace. All rights reserved. Carnegie does not take institutional positions on public policy issues; the views represented herein are the authors’ own and do not necessarily reflect the views of Carnegie, its staff, or its trustees. No part of this publication may be reproduced or transmitted in any form or by any means without permission in writing from the Carnegie Endowment for International Peace. Please direct inquiries to: Carnegie Endowment for International Peace Publications Department 1779 Massachusetts Avenue NW Washington, DC 20036 P: + 1 202 483 7600 F: + 1 202 483 1840 [CarnegieEndowment.org](CarnegieEndowment.org) [This publication can be downloaded at no cost at CarnegieEndowment.org](This publication can be downloaded at no cost at CarnegieEndowment.org). + CONTENTS Cybersecurity and the Financial System i About the Authors ii Introduction 1 The Initiation 2 Preparation—How to Get Organized? 3 The Launch and Beyond 5 The Testing 6 The Continuation and Extension 9 International Developments 10 Concluding Remarks 11 Notes 12 Cybersecurity and the Financial System Carnegie’s working paper series ‘Cybersecurity and the Financial System’ is designed to be a platform for thought-provoking studies and in-depth research focusing on this increasingly important nexus. Bridging the gap between the finance policy and cyber policy communities and tracks, contributors to this paper series include government officials, industry representatives, and other relevant experts in addition to work produced by Carnegie scholars. In light of the emerging and nascent nature of this field, these working papers are not expected to offer any silver bullets but to stimulate the debate, inject fresh (occasionally controversial) ideas, and offer interesting data. If you are interested in this topic, we also invite you to sign up for Carnegie’s FinCyber newsletter providing you with a curated regular update on latest developments regarding cybersecurity and the financial [system:](system: CarnegieEndowment.org/subscribe/fincyber)[ CarnegieEndowment.org/subscribe/fincyber](system: CarnegieEndowment.org/subscribe/fincyber). If you would like to learn more about this paper series and Carnegie’s work in this area, please contact Tim Maurer, Co-director of the Cyber Policy Initiative, at [tmaurer@ceip.org](tmaurer@ceip.org). Papers in this Series: • “Cyber Risk Scenarios, the Financial System, and Systemic Risk Assessment”Lincoln Kaffenberger, Emanuel Kopp, September 2019 • “Cyber Resilience and Financial Organizations: A Capacity-building Tool Box,”Tim Maurer and Kathryn Taylor, July 2019 • “The Cyber Threat Landscape: Confronting Challenges to the Financial System”Adrian Nish and Saher Naumaan, March 2019 • “Protecting Financial Institutions Against Cyber Threats: A National Security Issue”Erica D. Borghard, September 2018 • “Toward a Global Norm Against Manipulating the Integrity of Financial Data”Tim Maurer, Ariel (Eli) Levite, and George Perkovich, March 2017 CARNEGIE ENDOWMENT FOR INTERNATIONAL PEACE | i About the Authors Petra Hielkema is director of the Payments and Market Infrastructure Division in the central bank of the Netherlands (De Nederlandsche Bank) . Raymond Kleijmeer is senior policy officer at the Payments and Market Infrastructure Division in the centr

FAQs

What problem does the paper address regarding cybersecurity in financial institutions?

It addresses how financial institutions face an evolving threat landscape and whether they meet security standards, rules, and regulations in practice.

How does the CPMI-IOSCO guidance relate to resilience testing?

It emphasizes an integrated approach and highlights the need to test cyber resilience posture, not just assess it.

Why was the TIBER framework initiated and adopted in the Netherlands?

Strong willingness of financial institutions and authorities to test resilience in practice and share information drove initiation, adoption, and implementation since February 2016.

Sep 4, 2026

Uploaded by Lucas Vance