In mid-2023, the European Central Bank launched an obligatory cyber resilience exercise to assess the ability of the establishments monitored, including Crédit Agricole group, to react and deal with this kind of event
An unprecedented exercise!
At the start of 2024, the European Central Bank (ECB) launched a cyber resilience stress test. A total of 109 European institutions were involved in this exercise, including 28 institutions in the European marketplace, such as BNP Paribas, La Banque Postale, La Société Générale and Crédit Agricole Group. This was the first exercise of its kind and the institutions had to carry it out in depth, applying both theory and practice. LCL, managed by Crédit Agricole S.A. (CASA) and accompanied by CA-GIP, was selected to represent the Group. The scenario on which the exercise was based consisted in simulating a cyber attack by compromising the integrity of a critical system database.
How did it take place? CASA, LCL and CA-GIP tell you!
At the end of 2023, based on initial indications provided by the ECB, the LCL and CA-GIP entities, in conjunction with the Group, were responsible for selecting the critical banking system to be used for the test. They also prepared all the systems and technical means needed to respond to the cyber attack scenario announced by the ECB at the start of January 2024.
On 11 January 2024, based on the scenario provided by the ECB, CASA, LCL and CA-GIP activated a cyber crisis management simulation to steer the reconstruction of the affected system, in conjunction with the business units, to ensure the continuity and resumption of their activities. This enabled CA-GIP, and more generally the Group, to test existing systems and enhance them.
In parallel, the ECB sent a questionnaire with around 400 questions to each establishment concerned so that they could present, with evidence, their response, remediation and economic impact assessment systems in the face of a cyber attack. Serving as the basis for the ECB's preparations for its week-long assessment visit to LCL in April, the Group had to respond by the end of February with the teams that had worked on the subject.
Finally, on 26 July 2024 the ECB published its official report, thus closing this stress test. Its recommendations will now be used for the roadmaps of the various Group entities.
A brilliant three-party collaboration
Each party did their utmost to experience this exercise as if it were a real crisis and did everything possible to ensure maximum responsiveness at the right level.