FRM Part II · FRM Exam Part II · Cyber-resilience: Range of Practices
A bank's board is reviewing its cyber-resilience framework. Which of the following best describes the board's appropriate role under the range-of-practices guidance on cyber risk governance?
The board should approve the cyber risk strategy and risk appetite and oversee management's implementation, leaving day-to-day security operations to management. Directing technical tool choices, outsourcing decisions to auditors, or waiting for regulators would undermine proper governance and accountability.
- AApprove the cyber risk strategy and risk appetite and oversee management's implementation, while delegating day-to-day security operations to managementCorrect
- BSelect and configure the bank's firewall and intrusion detection tools directly
- CDelegate all cyber risk decisions to the external auditors to preserve independence
- DReview cyber incidents only after regulators have formally requested the information
Explanation
The board sets direction by approving strategy and risk appetite and overseeing management. Technical operations belong to management and specialist functions. Delegating decisions to auditors or waiting for regulators abdicates governance responsibility.
Did you get it right without looking?
One question tells you little. A timed set on Cyber-resilience: Range of Practices shows your real accuracy, how long you take and where you lose marks.
More Cyber-resilience: Range of Practices questions
- Which control is most effective at protecting sensitive customer data if an attacker gains access to a database server's storage?
- A regulator asks a bank how its cyber-resilience approach keeps pace with changing threats. Which practice would provide the strongest evide…
- A payments firm maps its cyber-resilience framework to the five functions commonly used in cyber guidance: identify, protect, detect, respon…
- A bank's cyber risk team is building its inventory for cyber risk identification. Which step best reflects the range of practices observed f…
- A bank uses three lines of defence for cyber risk. The CISO's team designs controls and monitors threats, business units run systems daily, …
- During a cyber risk self-assessment, a bank's business units rate their own control effectiveness as strong, yet internal audit finds repeat…