ACRC 2023 Conference for Information and Best Practices Sharing: launch of the Senegal chapter

Objectives

The aims of the conference were to:

• Foster the ACRC financial-sector cybersecurity community at the continental level, connected to international intelligence, enabling trusted information exchange and cooperation (ISAC)
• Update participants on context, progress and perspectives
• Officially launch the Information and Best Practices Sharing chapter for Senegal, following the initial ACRC conference on the matter held in Dakar in November 2022

Venue and participants

The conference was held on site on 23 February 2023 in Dakar, Senegal, during the official visit of Luxembourg in Senegal. More than 50 invited participants represented the Senegalese financial sector and its key stakeholders:

• Banks and the bankers' professional association
• Microfinance institutions and their professional association
• The insurance professional association
• The fintech professional association
• The regional financial market infrastructure
• Academia
• CIO clubs from Senegal and Mali
• Ministry directorates in charge of the financial sector, microfinance, and the regulation and supervision of decentralised financial systems
• The national microfinance fund
• The national IT agency
• A development agency

Participants confirmed the urgent need to strengthen the financial sector against cyber threats with a new collaborative and capacity-building approach, moving beyond traditional technology and governance-based approaches.

Two flagship initiatives

• The African cybersecurity information and best-practice sharing community
• The Cybersecurity Programme for Microfinance & Fintech

Two partnership agreements were signed on 22 February 2023: with a Senegalese engineering school of a public university, to foster cybersecurity education, research and development; and with the Senegalese microfinance professional association, to increase cybersecurity awareness and capacity among its members and to build and roll out a practical sectoral roadmap.

The Cybersecurity Programme for Microfinance & Fintech

The programme was launched in partnership with national or regional professional associations of microfinance and fintech. Designed on the experience of financial-inclusion institutions, it supports their progressive growth in cybersecurity maturity in three steps (awareness, assessment, remediation) and can be adapted to local contexts and regulations. It spans essential services such as:

• Raising management, employees and customers awareness
• Training the technical team
• Cybersecurity online self-assessment or consultant-assisted assessment
• Vulnerability scanning
• Cyber hygiene: standard policies, webinars, open-source tools
• Information and best-practices sharing
• CISO “on demand” (Chief Information Security Officer)
• Security monitoring

Launch of the Senegal chapter

A group of CISOs from banks and microfinance institutions volunteered to launch the ISAC chapters for Senegal and Côte d'Ivoire. They shared their pain points and expectations:

• Develop collaboration and information sharing at the relevant international level: the whole sector is ready to move in that direction but needs guidance and a code of conduct
• Raise top-management awareness of threats, but also of crisis management, crisis communication and information sharing
• Manage information sharing between peers, and communication with the public, rather than suffer uncontrolled disclosure through social networks
• Facilitate the development of information sharing within international groups
• Build the capacity of technical teams on aspects that are not well represented, such as incident response and threats
• Raise employee awareness
• Attract, develop and retain scarce cybersecurity skills
• Develop higher education in cybersecurity and support the rise in maturity of CISOs
• Ensure solutions are well adapted to the local context and resources
• Have CISOs and CIOs together on board for information security

Participants agreed that regulators and supervisors play an important role as facilitators, and that regulation is to be completed where missing. ACRC will act as facilitator of the chapters: an essential task of the chapters is to ensure local requirements are brought to the attention of the African financial community through ACRC, so that appropriate mutualized solutions can be set up.