Cybersecurity In The Tunisian Banking Sector Comprehensive assessment of cyber risk management, governance, resilience and digital transformation

Introduction

With the proliferation of information technology, the banking system has undergone significant changes in terms of processes, transactions and operations. Tunisian banks are developing digital services, remote banking channels and interconnected infrastructures that enhance the customer experience but also increase dependence on technology, service providers and data exchanges.

This evolution is accompanied by a shift in risk: attacks no longer target just a single IT infrastructure, but can simultaneously affect digital identities, mobile applications, payment systems, suppliers, workstations, customer data and business continuity mechanisms. International literature shows that phishing, identity theft, malware and attacks targeting digital services constitute major risks to the adoption of digital banking (Wang, Nnaji & Jung, 2020; Cele & Kwenda, 2025).

In Tunisia, the institutional framework has been strengthened by Decree-Law No. 2023-17 of 11 March 2023 on cybersecurity, which, amongst other things, defines the concepts of cybersecurity, cyber-attack, vulnerability and cyber crisis, and reinforces the role of the competent national authority. The financial sector also has cooperation mechanisms in place, including the Tunisian Financial CERT, which is coordinated by the Banking and Financial Council.

Literature review

A great deal of theoretical and empirical research has focused on banking cybersecurity. Wang, Nnaji and Jung (2020), in the Nigerian context, demonstrated the evolution of banking cybercrime towards more sophisticated attacks and highlighted the combined importance of technology, training and the legal framework. This study is particularly useful for developing a sector-specific framework, as it links observed breaches to protective capabilities.

Recent literature also emphasises the interdependence between digital transformation, artificial intelligence and cybersecurity. Rodrigues et al. (2022) show that the introduction of new technologies in banking must be accompanied by governance capable of simultaneously balancing innovation, security, compliance and stakeholder trust.

Research on data protection, for its part, emphasises that the cloud, analytics, AI and new digital architectures create new opportunities but also additional risks in terms of privacy and security. A study published in

*Computers & Security* in 2024 highlights these tensions in the context of digital transformation in banking.

The Tunisian context is also beginning to be the subject of specific academic research. Redissi (2025) examines cybersecurity governance and ISO/IEC 27001 certification in a sample of twelve Tunisian banks over the period 2016–2023. This research suggests that certification can be operationally significant without immediately producing a visible effect on profitability, which reinforces the idea that cybersecurity should be viewed as a resilience capability rather than merely a productive investment.

Reference frameworks

• NIST Cybersecurity Framework 2.0: a flexible framework for identifying, prioritising, communicating and managing cybersecurity outcomes.

• ISO/IEC 27001:2022: an information security management system based on risk management and continuous improvement.

• Tunisian Decree-Law No. 2023-17: national cybersecurity framework and institutional mechanisms.

• International principles of operational resilience: continuity of critical services, management of dependencies and response capability.

I. Background to the issue

The sector-based approach adopted recognises that the cybersecurity of Tunisian banks cannot be assessed solely on an institution-by-institution basis. Banks share infrastructure, payment systems, technology suppliers, service providers and a common regulatory environment. A weakness in one entity can therefore have knock-on effects across the ecosystem.

Objectives of the study

• To assess the key dimensions of cyber maturity in the Tunisian banking sector.

• To identify the priority risks associated with the digitalisation of banking services.

• To compare sector practices with the NIST CSF 2.0 and ISO/IEC 27001 standards.

• Highlight organisational, technological and human gaps.

• Propose a common improvement plan applicable to Tunisian banks, adapted to their size and level of maturity.

Research hypotheses

• H1: Cyber governance integrated into risk governance improves prevention and response capabilities.

• H2: The maturity of identity, detection and resilience controls has a significant impact on the security of digital services.

• H3: Risk associated with suppliers and technology chains is becoming a major determinant of collective resilience.

• H4: Ongoing awareness-raising amongst staff and customers constitutes an essential complementary control to technical measures.

Scope

The study covers the Tunisian banking sector on a consolidated basis. It focuses on commercial banks and other banking institutions subject to the Tunisian prudential framework, without assigning individual scores to institutions due to the lack of standardised and publicly available audit data.

II. Selection of the Tunisian banking sector

Unlike the benchmark study, which focused on a specific bank, this study considers the entire Tunisian banking sector as its unit of analysis. This approach prevents a practice observed at a single institution from being unduly generalised to the whole market.

III. Data collection method: sector-specific questionnaire

To retain the structure of the original study, a questionnaire comprising 38 questions is proposed. In this version, it is designed as a sector-specific grid that can be administered to CISO, CIO, risk managers, compliance officers, DPOs and internal auditors at several banks. The results below are an analytical and documentary summary; they do not replace an actual survey.

Key areas of the questionnaire (8 areas)

• 1. Cybersecurity governance & strategy

• 2. Data protection & regulatory compliance

• 3. Cyber risk management

• 4. Systems, networks & identity security (IAM)

• 5. Incident management & security operations (SecOps)

• 6. Resilience & Business Continuity (BCP/RMA)

• 7. Staff, Awareness & Human Security

IV. Methods used

The approach is based on a compliance and maturity analysis inspired by the study provided, supplemented by international standards and Tunisian institutional sources. The NIST CSF 2.0 enables risk management to be structured around six functions — Govern, Identify, Protect, Detect, Respond and Recover — whilst ISO/IEC 27001 provides a framework for information security risk management.

1. Maturity matrix

2. Compliance testing

The first test involves aligning expected practices with the functions of the NIST CSF 2.0. The second involves examining whether a management system is consistent with the principles of ISO/IEC 27001:2022: asset identification, risk assessment, selection of controls, monitoring, auditing and continuous improvement.

3. International benchmark

The benchmark compares the capabilities expected of the Tunisian sector with practices observed in highly mature banking ecosystems, notably in Canada, as well as with the recommendations of international organisations. The aim is not to rank Tunisian banks, but to identify transferable practices.

V. Presentation of the main sectoral findings

1. Governance and strategy

• Cybersecurity is increasingly becoming a matter of governance and overall risk management.

• The roles of CISO/CIO, risk, compliance and audit must be clearly separated and coordinated.

• Cyber indicators must be presented to governance bodies.

• The strategy must take into account the risk of dependence on technologies and suppliers. Indicative sector-specific assessment: Good — Level 3, with variations between institutions.

2. Data protection and compliance

• Customer and transactional data are critical assets.

• Encryption, classification and access control are fundamental measures.

• Data protection must be built in from the design stage of new services.

• Compliance must be documented and tested regularly.

Indicative sector assessment: Good / under consolidation — Level 3 to 4.

3. Cyber risk management

• Risk assessments must incorporate scenarios involving fraud, ransomware, service disruption and the compromise of service providers.

• Vulnerability and penetration tests must be supplemented by crisis exercises.

• The financial quantification of cyber risk remains a key area for improvement. Indicative sectoral assessment: Good — Level 3.

4. Security of systems, networks and identities (IAM)

• Strong authentication and centralised identity management are priorities.

• Network segmentation, EDR/XDR, PAM and patch management reduce the attack surface.

• Automation of processes relating to staff onboarding, mobility and offboarding must be strengthened. Indicative sector assessment: Good / advanced — Level 3 to 4.

VI  Sector results (continued)

5. Incident management and security operations (SecOps)

• Detection must be continuous and correlated with a response capability.

• SOCs and SIEMs must be supplemented by orchestration and response procedures.

• Simulation exercises must replicate realistic scenarios: ransomware, identity compromise, data breaches and service outages.

Indicative sectoral assessment: Advanced — Level 4 for the most structured capabilities, with sectoral variation.

6. Resilience and business continuity

• BCPs/DRPs must cover technological dependencies and critical suppliers.

• Backups must be protected against tampering and the spread of ransomware.

• Recovery tests must measure realistic RTO/RPO targets. Indicative sectoral assessment: Good — Level 3 to 4.

7. Human security and awareness

• Simulated phishing campaigns and regular training are essential.

• Security must also extend to senior management, service providers and business functions.

• Customer awareness of phishing, social engineering and fraud must be strengthened. Indicative sectoral assessment: Good — Level 3.

8. Suppliers and supply chain

• Cloud, software, maintenance and security service providers must be assessed according to their criticality.

• Contracts must include requirements relating to security, incident notification, auditing and reversibility.

• Continuous monitoring of supplier risk is a priority. Indicative sectoral assessment: Average to good — Level 2 to 3.

9. Threat Intelligence

• Banks benefit from sector-wide cooperation, but the structured sharing of indicators and scenarios could be further improved.

• A more automated threat intelligence platform would improve the ability to anticipate threats. Indicative sectoral assessment: Good — Level 3.

Updated statistics on the Tunisian cyberspace — 2025 and the first half of 2026

To update this article, the national figures below replace the undated general data. They are taken directly from statistics published by the National Cybersecurity Agency (ANCS). They relate to the Tunisian cyberspace as a whole and do not, on their own, constitute statistics specific to banks.

Interpreting the data: the number of incidents reported nationally in the first half of 2026 already exceeds the total for the whole of 2025. However, this comparison should be interpreted with caution, as the 2026 period covers only six months and reporting methods and volumes may change.

For incidents handled in the first half of 2026, the ANCS notes in particular that intrusions and unauthorised access account for 38.95 per cent and phishing for 33.98 per cent of the reported categories. These figures reinforce the relevance of two priorities highlighted in the article: identity and access management (IAM/MFA) and awareness-raising against phishing.

Source: National Cybersecurity Agency (ANCS), ‘Statistics on the Tunisian cyberspace – 2025’ and ‘Statistics on the Tunisian cyberspace – first half of 2026’, published on 20 July 2026.

Overall maturity summary

* Indicative level of the most structured capabilities, not an audited average across all banks.

Key strengths

• Strengthening of the institutional and regulatory framework.

• Development of operational security capabilities.

• Gradual roll-out of strong authentication mechanisms.

• Existence of sector-wide cooperation and a banking CERT.

• Increasing consideration of cyber risk in governance.

Priority areas for improvement

• Ongoing monitoring of suppliers and subcontractors.

• Recovery following ransomware attacks and multi-system crisis scenarios.

• Automation of IAM and offboarding, and the principle of least privilege.

• Financial quantification of cyber risk.

• Privacy by Design and Security by Design.

• Threat intelligence and automated sharing of indicators.

• Ongoing awareness-raising for customers and staff.

VI  International Comparison (Benchmark)

The international benchmark shows that the most mature banking ecosystems do not merely accumulate security tools. They organise cybersecurity as a business resilience capability, driven by governance, measured by indicators and tested through regular exercises.

The NIST CSF 2.0 is particularly well-suited to this benchmark as it does not prescribe a single technology: it defines cybersecurity outcomes and enables organisations to establish profiles tailored to their specific context. ISO/IEC 27001 complements this approach with a structured management system.

Lessons for Tunisian banks

• Move from an ad hoc compliance approach to one based on measurable resilience.

• Treat suppliers as an extension of the security perimeter.

• Test recovery capabilities as rigorously as prevention capabilities.

• Develop common indicators at sector level.

• Invest in skills, simulation and behavioural analysis to complement the tools.

VII  Strategic action plan for the Tunisian banking sectorShort term: 0–12 months

• Update cyber-risk maps and crisis scenarios.

• Harmonise minimum security requirements for critical suppliers.

• Strengthen MFA, PAM, EDR/XDR and patch management.

• Conduct ransomware and identity compromise exercises.

• Roll out regular awareness campaigns and simulated phishing exercises.

Medium term: 12–24 months

• Establish sector-specific maturity and resilience indicators.

• Develop an advanced capability for threat intelligence and indicator sharing.

• Automate IAM cycles, particularly offboarding.

• Integrate Security by Design and Privacy by Design into digital projects.

• Develop test scenarios involving key critical service providers.

Long term: 24–36 months

• Advance maturity towards adaptive and predictive capabilities.

• Develop sector-specific mechanisms for systemic crisis exercises.

• Strengthen the controlled use of AI for fraud detection and prevention.

• Implement an economic quantification of cyber risk to inform investment decisions.

• Develop a shared culture of cyber resilience amongst banks, authorities, service providers and customers.

Proposed indicators (KPIs/KRIs)

Conclusion

Cybersecurity in the Tunisian banking sector is now a central component of stability, trust and digital transformation. The approach proposed in this article follows the structure of the benchmark study, but replaces the analysis of a single bank with a sector-wide assessment applicable to all Tunisian banks.

The analysis highlights already significant capabilities in the areas of governance, infrastructure protection, incident management and business continuity, whilst also identifying areas requiring collective improvement: supplier risk, resilience to ransomware, identity automation, economic quantification of risk, data protection by design and threat intelligence.

The key lesson is that a bank can no longer regard cybersecurity as merely an IT function. It must be integrated into governance, operational risk, compliance, procurement, product development, business continuity and customer relations. At sector-wide level, cooperation between banks, authorities and incident response teams is also crucial.

Limitations of the study

This version does not constitute a technical audit and does not include a questionnaire that has actually been administered to all banks. The maturity levels are therefore indicative. Further academic research should collect anonymised responses from CISOs/CIOs, construct a representative sample, calculate statistical scores and test the hypotheses put forward.