Skip to content

FRM Part II · FRM Exam Part II · Cyber-resilience: Range of Practices

A bank's board asks the CISO to explain how cyber-resilience differs from traditional cyber-security. Which description best captures the distinguishing feature of cyber-resilience as described in the BIS/CPMI-IOSCO range-of-practices thinking?

Cyber-resilience is the ability to anticipate, withstand, contain and recover from cyber events so that critical operations continue. It goes beyond prevention, because it assumes some attacks will succeed and therefore stresses detection, response and recovery rather than perimeter defence alone.

  1. AIt focuses only on preventing every intrusion at the network perimeter
  2. BIt emphasizes the ability to anticipate, withstand, contain and recover from cyber events so critical operations continueCorrect
  3. CIt is limited to purchasing cyber insurance to transfer losses
  4. DIt concerns only the encryption of data stored in databases

Explanation

Cyber-resilience extends beyond prevention to include detecting, responding, containing and recovering so that critical services keep running despite a successful attack. Option A describes only a prevention mindset, which is narrower. Insurance and encryption are single controls, not the overall capability.

Did you get it right without looking?

One question tells you little. A timed set on Cyber-resilience: Range of Practices shows your real accuracy, how long you take and where you lose marks.

Practise Cyber-resilience: Range of PracticesFree diagnostic mock

More Cyber-resilience: Range of Practices questions