FRM Exam Part II · Risk Mitigation

Cyber Risk and Information Security Mitigation for FRM Part II

Updated 11 October 2026 · Fact-checked

Cyber risk mitigation reduces the likelihood and impact of attacks on a bank's systems and data. It uses layered defenses (defense in depth), strong access controls, monitoring, a tested incident response plan, and recovery capability. To solve questions, match each control to its purpose: prevent, detect, respond or recover.

Understand Cyber Risk and Information Security Mitigation

Cyber risk is the risk of loss from failure, misuse or attack on information systems. It is a type of operational risk. Information security protects three properties, called the CIA triad: confidentiality (only authorised people see data), integrity (data is accurate and unaltered) and availability (systems work when needed).

You cannot stop every attack, so mitigation works in layers. Defense in depth places several independent controls in series: network segmentation, firewalls, endpoint protection, encryption, authentication and monitoring. If one layer fails, another still stands. No single control is trusted alone.

Access controls limit who can reach what. The key ideas are least privilege (give only the access needed for the job), segregation of duties (no one person completes a sensitive process alone), multi-factor authentication (two or more independent proofs of identity) and privileged access management for administrators. Regular access reviews remove rights that are no longer needed.

Controls fall into four functions. Prevent (patching, access controls, encryption), detect (logging, intrusion detection, security monitoring), respond (incident response plan) and recover (backups, disaster recovery, business continuity). The NIST Cybersecurity Framework groups activities in a similar way: Identify, Protect, Detect, Respond and Recover (version 2.0 adds Govern). Know the idea of these functions rather than fine detail.

An incident response plan sets out roles, escalation paths, containment steps, communication with regulators, customers and law enforcement, and post-incident review. It must be tested through exercises. Resilience goes beyond prevention: the firm must keep critical services running within its impact tolerance, and learn from every incident.

Key formulas to remember

CIA triad: Confidentiality + Integrity + Availability; Identify which property an attack or control affects. Ransomware mainly hits availability; data theft hits confidentiality; tampering hits integrity.
Control functions: Prevent → Detect → Respond → Recover; Classify every control into one of these. Backups are recover, not prevent.
NIST CSF functions: Identify, Protect, Detect, Respond, Recover (Govern added in version 2.0); Use as a checklist for a complete programme.
Residual risk: Residual risk = Inherent risk − Risk reduced by controls; A conceptual relationship, not a precise calculation. Controls rarely remove risk fully.
Core access principles: Least privilege; segregation of duties; multi-factor authentication; Standard answers when a question asks how to limit insider or credential-based risk.

How to solve Cyber Risk and Information Security Mitigation questions

Use this method for scenario questions on cyber and information security mitigation.

1Read the scenario and identify what failed or was attacked: data, integrity of records, or system availability.
2Map it to the CIA property affected.
3Decide which control function is missing: prevent, detect, respond or recover.
4Check whether the weakness is a single point of failure, which points to defense in depth.
5For access issues, test against least privilege, segregation of duties and multi-factor authentication.
6For incidents, look for the plan elements: roles, escalation, containment, communication, recovery and review.
7Pick the option that addresses the root cause and works across layers, not a one-off fix.
8Check the answer against governance: board oversight, testing and continuous improvement.

Quickest way: Four-function triage

When to use it: When time is short and options all sound like good security practice.

Label the scenario's gap: prevent, detect, respond or recover.
Eliminate options that belong to a different function.
Prefer layered or systemic answers over single-tool answers.
Between two good options, choose the one that is tested, governed and addresses root cause.

Common mistakes in Cyber Risk and Information Security Mitigation

Treating one strong control, such as a firewall, as sufficient.
It feels like a complete barrier.
Fix: Remember defense in depth: independent layers so one failure does not cause a breach.
Classifying backups as preventive controls.
Backups protect data, so they seem protective.
Fix: Backups do not stop an attack. They support recovery.
Confusing least privilege with segregation of duties.
Both limit access.
Fix: Least privilege limits the scope of one person's access. Segregation of duties splits a process across people.
Assuming an incident response plan is enough once written.
Documentation looks like readiness.
Fix: A plan must be tested through exercises and updated after incidents and lessons learned.
Treating cyber risk as only an IT issue.
Technical language hides governance.
Fix: Cyber risk is operational risk with board oversight, risk appetite and three lines of defense.
Ignoring third-party and vendor exposure.
Focus stays on internal systems.
Fix: Include due diligence, contract security terms and monitoring of service providers.

Worked examples

Example 1

A bank's customer database is breached through a stolen administrator password. Logs show the intruder had broad access to all systems and went unnoticed for weeks. Which two improvements most directly address the weaknesses?
A. Larger insurance cover and more backups
B. Multi-factor authentication with privileged access management, and security monitoring to detect anomalies
C. Replacing the firewall and increasing staff bonuses
D. Publishing the incident to customers and deleting old logs

Show the solution

The attack used a stolen credential. The weakness is authentication and excessive privilege (prevent).
The intruder stayed unnoticed for weeks. The weakness is detection.
Option B adds multi-factor authentication, privileged access control and monitoring, which fit both gaps.
Option A transfers loss and aids recovery but fixes neither cause. Option C changes one tool and adds irrelevant incentives. Option D is a response step and deleting logs harms investigation.

Answer: B

Example 2

A bank suffers ransomware that encrypts its payment systems. Backups exist but have never been restored in a test, and no one knows who authorises shutting down systems. Identify the main gaps and the fix.

Show the solution

Ransomware primarily affects availability, within the CIA triad.
Backups never tested means recovery capability is unproven. Fix: regular restoration tests against recovery time targets for critical services.
No clear authority for shutdown means the response plan lacks roles and escalation. Fix: define decision rights, containment steps and communication paths.
Add exercises and scenario testing so the plan is rehearsed, then review lessons after each test or incident.
Link recovery targets to the firm's impact tolerance for critical services such as payments.

Answer: The gaps are untested recovery and an undefined response structure. Fix them with tested backups, a documented incident response plan with clear roles and escalation, and regular exercises tied to impact tolerance.

Exam tips

Always name the CIA property and the control function before choosing an answer.
Expect scenario questions where several options are valid in general. Pick the one that fixes the root cause shown in the case.
Recognise defense in depth wording: layered, independent, no single point of failure.
Know NIST CSF function names and where a given control sits.
Link cyber to operational resilience and third-party risk, as questions often blend them.

Practice questions from Risk Mitigation

Cyber Risk and Information Security Mitigation in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Cyber Risk and Information Security Mitigation: frequently asked questions

What is defense in depth in banking cyber security?

It is the use of several independent layers of control, such as segmentation, authentication, encryption and monitoring. If one layer fails, others still limit the damage. It avoids reliance on a single control.

Do I need to memorise the NIST Cybersecurity Framework for FRM Part II?

Know the core functions: Identify, Protect, Detect, Respond and Recover, with Govern added in version 2.0. You need to place controls within them, not recite detailed sub-categories.

What should an incident response plan contain?

It should set roles and responsibilities, escalation paths, containment and eradication steps, communication with regulators and customers, recovery procedures and a post-incident review. It must also be tested regularly.

How is cyber risk different from other operational risk?

It is a subset of operational risk, but threats are adaptive and deliberate, and an event can spread quickly across systems and firms. This is why detection, response and resilience matter alongside prevention.