Skip to content

FRM Part II · FRM Exam Part II · Cyber-resilience: Range of Practices

A bank wants its cyber-resilience strategy to be integrated with enterprise risk management. Which approach best achieves this?

Cyber strategy should be aligned with the enterprise risk framework, using common appetite, taxonomy and reporting, and linked to business objectives and critical services. A siloed IT document, a perimeter-only focus, or exclusive cyber-team ownership prevents consolidated oversight and business accountability.

  1. AMaintain the cyber strategy as a separate IT document with its own unrelated risk scales
  2. BAlign cyber risk appetite, taxonomy and reporting with the enterprise framework, and link the strategy to business objectives and critical servicesCorrect
  3. CLimit the strategy to perimeter controls and exclude business continuity planning
  4. DHave the cyber team own all risk decisions independently of business lines

Explanation

Integration means using a common taxonomy, appetite and reporting, and tying cyber objectives to business services. Separate scales, perimeter-only scope and cyber-team-only ownership prevent a consolidated view and weaken accountability by business lines.

Did you get it right without looking?

One question tells you little. A timed set on Cyber-resilience: Range of Practices shows your real accuracy, how long you take and where you lose marks.

Practise Cyber-resilience: Range of PracticesFree diagnostic mock

More Cyber-resilience: Range of Practices questions