FRM Part II · FRM Exam Part II · Case Study: Cyberthreats and Information Security Risks
A bank classifies its critical information assets and applies controls based on that classification. What is the primary risk management purpose of this step?
Classifying information assets lets the bank match control strength to each asset's value and sensitivity, focusing resources on the most critical ones. It does not mean identical controls for all, does not remove access management, and does not shift all residual risk to insurers.
- ATo match the strength of controls to the value and sensitivity of each asset so resources focus on the most criticalCorrect
- BTo ensure all assets receive identical controls regardless of value
- CTo transfer all residual cyber risk to insurers
- DTo eliminate the need for access management
Explanation
Asset classification supports a risk-based approach: critical or sensitive assets receive stronger controls and monitoring. Uniform controls waste resources, insurance does not replace controls, and access management remains necessary.
Did you get it right without looking?
One question tells you little. A timed set on Case Study: Cyberthreats and Information Security Risks shows your real accuracy, how long you take and where you lose marks.
More Case Study: Cyberthreats and Information Security Risks questions
- A bank's risk team is deciding which control best supports confidentiality of customer data held on laptops that may be lost while staff tra…
- A regional bank's security team observes that a group has gained access to its payment-messaging environment, remained undetected for severa…
- Which development is most consistent with the view that the cyber threat landscape for financial institutions is evolving?
- A bank's security operations center detects that ransomware is encrypting file servers in a regional office. Which action should the inciden…
- A bank's security team detects ransomware spreading across several file servers. Under a standard incident response lifecycle, which action …
- A firm estimates a cyber event that compromises customer data has an annual probability of 4%, and a loss of USD 25 million if it occurs. A …