FRM Part II · FRM Exam Part II · Cyber-resilience: Range of Practices
A bank's board is reviewing its cyber-resilience framework based on the range of practices observed across large financial institutions. Which of the following best describes the board's primary responsibility regarding cyber risk?
The board should approve the cyber risk appetite and cyber strategy and oversee management's implementation. Technical tasks such as firewall configuration, forensic investigation and choosing encryption algorithms belong to management and specialist security teams, not the board, whose role is strategic direction and accountability.
- AApproving the cyber risk appetite and strategy and overseeing management's implementation of itCorrect
- BConfiguring and monitoring the firewall rules used to protect the bank's network
- CInvestigating each security incident and determining its technical root cause
- DSelecting the encryption algorithms used on customer databases
Explanation
Boards set direction: they approve the cyber risk appetite and strategy and hold management accountable for execution. Technical configuration, incident forensics and algorithm choices are operational tasks delegated to management and security teams. Option B is wrong because board-level involvement does not extend to technical administration.
Did you get it right without looking?
One question tells you little. A timed set on Cyber-resilience: Range of Practices shows your real accuracy, how long you take and where you lose marks.
More Cyber-resilience: Range of Practices questions
- A bank's board asks the CISO to explain how cyber-resilience differs from traditional cyber-security. Which description best captures the di…
- After a ransomware attack encrypts a payment processor's production systems, the firm restores from backups that were stored on the same net…
- A firm runs annual red-team exercises, and the last three produced the same finding: slow escalation of suspected incidents to senior manage…
- A bank runs a cyber risk assessment and finds that a customer-facing payment application has a high-severity vulnerability. Threat intellige…
- A bank backs up its core ledger to an offsite site every 4 hours. A ransomware attack corrupts the primary system 3 hours after the last bac…
- A bank performs a cyber risk assessment of its payments platform. Inherent risk is rated 'High'. Existing controls are assessed as reducing …