Skip to content

FRM Exam Part II · Case Study: Cyberthreats and Information Security Risks

Cyber Risk Management and Control Frameworks Explained

Updated 11 October 2026 · Fact-checked

Cyber risk management uses layered controls (defense in depth), clear ownership (three lines of defense) and a framework such as NIST, which groups activities into identify, protect, detect, respond and recover. To solve a question, classify the control by function, layer and line, then check for gaps.

Understand Cyber Risk Management and Control Frameworks

Cyber risk is the risk of loss from attacks or failures that harm the confidentiality, integrity or availability of information and systems. You cannot remove it. You manage it with controls, ownership and tested response plans.

Defense in depth means using several independent layers of control, so one failure does not lead to a breach. Layers include people (training), process (access approval, change control), technology (firewalls, encryption, multi-factor authentication, network segmentation) and physical security. The idea is that each layer catches what the previous one missed.

Three lines of defense assigns responsibility. The first line is the business and technology teams that own the risk and run day-to-day controls. The second line is independent risk and compliance, which sets policy, challenges the first line and monitors. The third line is internal audit, which gives independent assurance to the board on whether the framework works.

Frameworks give a common structure. The NIST Cybersecurity Framework organises activities into functions: Identify (know assets, risks, dependencies), Protect (safeguards such as access control, training, encryption), Detect (monitoring, anomaly alerts), Respond (incident plans, containment, communication) and Recover (restore services, learn lessons). Newer NIST versions add a Govern function for strategy, roles and oversight. Similar standards include ISO/IEC 27001 and sector guidance from regulators.

On the exam, think of controls by type too: preventive (stop events), detective (find them) and corrective (limit damage and restore). Protect is mostly preventive, Detect is detective, Respond and Recover are corrective.

Key formulas to remember

NIST Cybersecurity Framework functions
Identify → Protect → Detect → Respond → Recover
Core functions. Newer versions add Govern. The functions run continuously, not as a strict one-time sequence.
CIA triad
Confidentiality, Integrity, Availability
The three properties of information security that controls aim to protect.
Three lines of defense
1st line: owns and manages risk | 2nd line: oversees and challenges | 3rd line: independent assurance
Internal audit is the third line. Risk management is the second line, not the first.
Control types
Preventive (Protect) | Detective (Detect) | Corrective (Respond, Recover)
A useful mapping to NIST functions, not a strict rule.
Residual risk
Residual risk = Inherent risk − Effect of controls
Conceptual relationship used in risk assessment; controls reduce but rarely eliminate risk.

How to solve Cyber Risk Management and Control Frameworks questions

Use this method for any case or scenario question on cyber frameworks and controls.

  1. 1Read the scenario and find what failed or is being asked: a control, a role or a framework function.
  2. 2Identify the asset and the CIA property at stake (confidentiality, integrity or availability).
  3. 3Map the activity to a NIST function: asset inventory and risk assessment is Identify; safeguards is Protect; monitoring is Detect; containment and communication is Respond; restoration is Recover.
  4. 4Decide who acts: business or IT owns it (first line), risk or compliance oversees it (second), audit assures it (third).
  5. 5Check layering: is there a single point of failure, or are several independent controls in place?
  6. 6Eliminate options that confuse roles, for example audit designing controls or risk teams running them day to day.
  7. 7Choose the answer that is most specific to the scenario and keeps independence between lines.

Quickest way: Function, line, layer check

When to use it: When you have under two minutes and the options look similar.

  1. Ask: before, during or after the incident? Before is Identify or Protect, during is Detect or Respond, after is Recover.
  2. Ask: who owns it? Doing equals first line, challenging equals second, assuring equals third.
  3. Ask: does the answer add an independent layer or rely on one control? Prefer layered.
  4. Drop options with absolutes such as eliminates all risk.

Common mistakes in Cyber Risk Management and Control Frameworks

  • Placing internal audit in the second line or giving it control ownership.

    Audit and risk both feel like oversight.

    Fix: Audit is the third line and gives independent assurance. It must not own or run controls.

  • Treating NIST functions as a strict one-time sequence.

    The list order looks like a process flow.

    Fix: The functions run concurrently and continuously. Lessons from Recover feed back into Identify and Protect.

  • Classifying incident monitoring as Protect.

    Both seem to defend the system.

    Fix: Protect prevents. Detect finds events that got through. Monitoring and alerting is Detect.

  • Assuming defense in depth means buying more of the same tool.

    Depth sounds like quantity.

    Fix: Depth needs different, independent layers across people, process and technology so one failure does not defeat all.

  • Saying controls eliminate cyber risk.

    Confusing mitigation with removal.

    Fix: Controls reduce risk to a residual level that must fit risk appetite.

  • Placing the first line in the risk function.

    Risk is in the name of the second line.

    Fix: The first line is the business and technology owners who take and manage the risk.

Worked examples

Example 1

A bank's security team notices unusual outbound data transfers at night, isolates the affected server, informs senior management and regulators, and later restores the service from clean backups. Map each action to a NIST function.

Show the solution
  1. Noticing unusual transfers is monitoring for anomalies, which is Detect.
  2. Isolating the server contains the incident, which is Respond.
  3. Informing management and regulators is incident communication, also Respond.
  4. Restoring from clean backups returns service to normal, which is Recover.

Answer: Detect (spotting transfers); Respond (isolation and notification); Recover (restoration from backups).

Example 2

A bank's IT department runs access controls. The risk function sets the cyber policy and challenges IT's control testing. Internal audit reviews whether both work and reports to the audit committee. Which statement is correct? A) IT is the second line. B) Risk is the first line. C) Internal audit is the third line. D) Audit owns the controls.

Show the solution
  1. IT runs and owns the controls, so it is the first line. A is wrong.
  2. The risk function sets policy and challenges, so it is the second line. B is wrong.
  3. Internal audit gives independent assurance to the audit committee, so it is the third line. C is right.
  4. Audit does not own controls, since that would remove its independence. D is wrong.

Answer: C) Internal audit is the third line of defense.

Exam tips

  • Practise mapping short actions to Identify, Protect, Detect, Respond or Recover. Scenario questions often hinge on this.
  • Know the three lines cold, including who must stay independent.
  • Look for single points of failure in a case: that signals a weak defense in depth.
  • Remember newer NIST versions add Govern, but the five core functions are the usual basis for questions.
  • Watch for absolute wording in options; the best answer usually reduces risk, not eliminates it.

Practice questions from Case Study: Cyberthreats and Information Security Risks

Cyber Risk Management and Control Frameworks in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Cyber Risk Management and Control Frameworks: frequently asked questions

What are the five NIST Cybersecurity Framework functions?

Identify, Protect, Detect, Respond and Recover. Newer versions add Govern. They operate continuously, and each feeds the others.

What is defense in depth in cybersecurity?

It is a layered approach using several independent controls across people, process and technology. If one layer fails, others still limit the damage.

How do the three lines of defense apply to cyber risk?

Business and IT teams own and run controls. Risk and compliance set policy and challenge. Internal audit independently assures the board that the framework works.

Is NIST mandatory for banks?

NIST is a voluntary framework, though many firms and supervisors use it as a reference. Banks follow the rules set by their own regulators, which often align with similar principles.