Skip to content

FRM Part II · FRM Exam Part II · Cyber-resilience: Range of Practices

A bank runs a critical service whose business-impact analysis shows losses of USD 2 million per hour of outage after the first 2 hours (no loss in the first 2 hours). The current RTO is 8 hours. A proposed investment would cut the RTO to 5 hours and costs USD 5 million per year. Management estimates one such severe outage per year. Which conclusion is correct on a pure expected-cost basis?

The investment is justified. Expected loss falls from USD 12 million (6 chargeable hours at 2 million) to USD 6 million (3 chargeable hours), a saving of USD 6 million per year, which exceeds the USD 5 million annual cost.

  1. AInvestment is not justified because the saving is USD 4 million versus a cost of USD 5 million
  2. BInvestment is justified because the saving is USD 6 million versus a cost of USD 5 millionCorrect
  3. CInvestment is justified because the saving is USD 10 million
  4. DInvestment is not justified because no loss occurs in the first 2 hours

Explanation

Loss at 8h RTO = (8-2) x 2 = USD 12m. Loss at 5h = (5-2) x 2 = USD 6m. Saving = USD 6m, above the USD 5m cost, so net benefit is USD 1m. Ignoring the 2-hour grace period would give a USD 6m saving as well, but using 3 hours x 2m = 6 is the same; the USD 4m option wrongly misapplies the grace period.

Did you get it right without looking?

One question tells you little. A timed set on Cyber-resilience: Range of Practices shows your real accuracy, how long you take and where you lose marks.

Practise Cyber-resilience: Range of PracticesFree diagnostic mock

More Cyber-resilience: Range of Practices questions