FRM Part II · FRM Exam Part II · Cyber-resilience: Range of Practices
A bank is deciding how to govern cyber risk. Which arrangement is most consistent with sound cyber-resilience practice?
The board should approve the cyber risk appetite and strategy, senior management should implement them, and independent functions such as risk and audit should provide assurance. Delegating cyber risk solely to IT, reacting after incidents, or relying only on insurance does not provide adequate governance.
- AThe board approves cyber risk appetite and strategy, management implements it, and independent functions assure effectivenessCorrect
- BCyber risk is delegated entirely to the IT department with no board involvement
- CCyber risk appetite is set only after an incident occurs, based on the loss experienced
- DCyber risk is managed solely by purchasing insurance
Explanation
Good practice places accountability for cyber strategy and risk appetite with the board and senior management, with clear lines of responsibility and independent assurance. Treating it purely as an IT matter, reactive appetite setting or insurance alone omits governance.
Did you get it right without looking?
One question tells you little. A timed set on Cyber-resilience: Range of Practices shows your real accuracy, how long you take and where you lose marks.
More Cyber-resilience: Range of Practices questions
- A bank's last year of vulnerability scanning shows 400 critical vulnerabilities found; 300 were remediated within the 30-day policy window, …
- A bank has three critical services. Annualised expected losses from cyber events are: Service A USD 2.0m with inherent risk 10m, Service B U…
- A bank's cyber-resilience framework groups its controls into identification, protection, detection, response and recovery, and sustained lea…
- A bank's business continuity plan was last tested by a tabletop walkthrough that assumed the failure of a single data center. The risk commi…
- A bank's cyber-resilience framework sets a recovery time objective (RTO) of 2 hours for its payments platform. After a simulated ransomware …
- A bank's cyber strategy is assessed by a supervisor. Which finding most clearly indicates that the strategy is not aligned with sound practi…