Skip to content

FRM Exam Part II · Cyber-resilience: Range of Practices

Cyber Incident Response, Recovery and Business Continuity

Updated 11 October 2026 · Fact-checked

Cyber response and recovery is how a firm contains an attack, restores critical services and keeps operating. You solve questions by identifying the phase (detect, contain, eradicate, recover, learn), then matching the action to recovery objectives: RTO is the maximum acceptable downtime, RPO the maximum acceptable data loss.

Understand Response, Recovery and Business Continuity

A cyber incident is not only an IT problem. It can stop payments, trading and customer access. So banks plan in advance for how they will respond, recover and keep critical services running. The FRM Part II cyber-resilience material treats this as the final line after identify, protect and detect.

Incident response is the set of actions from the moment an incident is detected. A typical sequence is: triage and classify the incident, contain it to stop spread, eradicate the cause, recover systems and data, and then review lessons. Plans define roles, escalation paths and decision rights before any crisis starts. Pre-agreed authority matters because delays in decisions often cost more than technical problems.

Crisis management sits above the technical team. Senior management and the board decide on business trade-offs, such as whether to shut down a service, pay for outside help or notify regulators. Communication is part of this: clear, timely, accurate messages to staff, customers, regulators, counterparties and the public. Poor or inconsistent messages can add reputational and legal damage to the technical loss.

Recovery objectives turn tolerance into numbers. The recovery time objective (RTO) is the target time within which a service or system must be restored after disruption. The recovery point objective (RPO) is the maximum amount of data loss, measured in time, that is acceptable. A short RPO needs frequent backups or replication. A short RTO needs ready alternate capacity. Both cost money, so firms set tighter targets only for critical operations.

Business continuity keeps critical operations going or restores them within tolerance, using alternate sites, manual workarounds and tested backups. Cyber events add a twist: if malware corrupts data, replicated copies may also be corrupted. So firms keep isolated, immutable or offline backups and verify data integrity before returning systems to service. Regular testing and exercises, including with third parties, prove that the plans work.

Key formulas to remember

Recovery time objective (RTO)
RTO = maximum acceptable time from disruption to restored service
Measures downtime tolerance. Actual recovery time must be ≤ RTO.
Recovery point objective (RPO)
RPO = maximum acceptable data loss, measured as time between the last good copy and the incident
Backup or replication interval must be ≤ RPO. It is about data, not time to restore.
Response sequence
Detect → Triage → Contain → Eradicate → Recover → Learn
Containment comes before eradication and recovery. Do not restore into a still-compromised environment.
Recovery must fit tolerance
Time to restore critical service ≤ RTO ≤ impact tolerance
Recovery objectives should sit inside the firm's tolerance for disruption of the critical operation.

How to solve Response, Recovery and Business Continuity questions

Use the same sequence for any scenario or definition question on response, recovery and continuity.

  1. 1Identify the phase described: detection, containment, eradication, recovery or post-incident learning.
  2. 2Identify who should act: technical team, crisis management team, senior management or board.
  3. 3Spot the key constraint: time to restore (RTO), data loss (RPO), data integrity, or communication.
  4. 4Check the order of actions. Contain before recover. Verify clean backups before restoring.
  5. 5Match the option to the critical operation and its tolerance, not to the whole firm equally.
  6. 6Eliminate options that are purely preventive, or that ignore testing, communication or governance.
  7. 7Pick the answer that is timely, pre-planned and proportionate to impact.

Quickest way: Time versus data, then order

When to use it: Use when a question gives numbers or asks you to choose between RTO and RPO, or between actions.

  1. Ask: is the question about how long (RTO) or how much data (RPO)?
  2. Compare the given backup interval with the RPO, and the restore time with the RTO.
  3. If the order of actions is tested, choose contain first, then eradicate, then recover.
  4. If data corruption is mentioned, prefer isolated or verified clean backups.
  5. Pick the option that names a tested, pre-agreed plan.

Common mistakes in Response, Recovery and Business Continuity

  • Mixing up RTO and RPO

    Both are recovery targets measured in time units.

    Fix: RTO is about downtime. RPO is about lost data. Think T for time to restore, P for the point in time you go back to.

  • Restoring systems before containing the threat

    Pressure to get services back quickly.

    Fix: Contain and eradicate first, or the attacker may re-enter or destroy the restored data.

  • Treating backups as automatically safe

    Backups work well for hardware failure, so people assume the same for cyber attacks.

    Fix: Malware can corrupt replicated data. Use isolated or immutable copies and test integrity before restoring.

  • Seeing response as a purely IT task

    Incidents look technical.

    Fix: Crisis management involves senior management and the board, legal, communications and business owners.

  • Setting the same recovery targets for every system

    Simplicity seems fairer.

    Fix: Set tighter objectives for critical operations. Tight targets cost more, so prioritise by impact.

  • Ignoring testing and lessons learned

    Candidates focus on the live response.

    Fix: Plans are only credible if exercised. Post-incident review feeds back into controls and plans.

Worked examples

Example 1

A bank backs up its payments database every 4 hours. Its RPO for the payments system is 1 hour, and its RTO is 2 hours. After an incident, restoration takes 90 minutes from the last backup. Which statement is correct?

Show the solution
  1. Check RPO: the worst-case data loss equals the backup interval, 4 hours.
  2. 4 hours > 1 hour, so the RPO is not met.
  3. Check RTO: restoration takes 90 minutes = 1.5 hours.
  4. 1.5 hours ≤ 2 hours, so the RTO is met.
  5. Conclusion: speed of recovery is adequate but the backup frequency is too low.

Answer: The RTO is met but the RPO is breached; the bank needs backups or replication at least every hour.

Example 2

A ransomware attack encrypts servers at a bank. The firm has detected it. Which action should come first: (A) restore from the most recent backup, (B) isolate affected systems to stop spread, (C) publish a final root-cause report, (D) renegotiate vendor contracts?

Show the solution
  1. Identify the phase: the incident is detected, so triage and containment come next.
  2. Option A restores before containment, risking reinfection and use of possibly corrupted backups.
  3. Option C is a post-incident learning step, which comes last.
  4. Option D is not an urgent response action.
  5. Option B stops further damage and preserves evidence, so it comes first.

Answer: B: isolate the affected systems to contain the incident before eradication and recovery.

Exam tips

  • Read for the phase of the incident first. Many questions are really about order of actions.
  • If a question says time to restore, think RTO. If it says data loss or last good copy, think RPO.
  • Prefer answers that involve pre-agreed roles, senior management escalation and tested plans.
  • Watch for corrupted-backup scenarios. Integrity checks and isolated backups are usually the key.
  • Link recovery to critical operations and impact tolerance, not to every system equally.

Practice questions from Cyber-resilience: Range of Practices

Response, Recovery and Business Continuity in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Response, Recovery and Business Continuity: frequently asked questions

What are the main steps of a cyber incident response plan?

A common sequence is detect, triage and classify, contain, eradicate, recover and review lessons. Plans also define roles, escalation, communication and regulator notification. For the exam, remember that containment comes before recovery.

What is the difference between RTO and RPO?

RTO is the maximum acceptable time to restore a service after disruption. RPO is the maximum acceptable data loss, measured as time since the last good copy. A backup interval longer than the RPO breaches it.

How does cyber recovery differ from normal disaster recovery?

In a cyber attack, data and systems may be deliberately corrupted, and the attacker may still be inside. Replicated copies can also be affected. So firms need isolated backups, integrity checks and containment before restoration.

Why does communication matter in incident response?

Clear and timely messages to staff, customers, regulators and counterparties limit reputational, legal and market damage. Consistent messaging is managed by the crisis team, not left to individual technical staff.