Skip to content

FRM Part II · FRM Exam Part II · Cyber-resilience: Range of Practices

A bank's board sets a cyber risk appetite statement. Which of the following is the most appropriate form of the statement for it to be effective and actionable?

An effective cyber risk appetite combines qualitative tolerance for disruption of critical services with measurable limits, such as maximum tolerable downtime and key risk indicator thresholds. This allows monitoring and escalation. Zero-incident goals are unrealistic, and vague or technology-list statements cannot be measured against.

  1. AA commitment that the bank will never suffer a cyber incident
  2. BA qualitative statement that cyber risk is important to the bank
  3. CA list of the security technologies the bank currently uses
  4. DQualitative tolerance for impact on critical services, supported by measurable limits such as maximum tolerable downtime and thresholds for key risk indicatorsCorrect

Explanation

An effective appetite statement links to the bank's critical services and is expressed through metrics that can be monitored and escalated when breached. A zero-incident goal is unrealistic, a vague statement cannot be measured, and a technology list describes controls rather than appetite.

Did you get it right without looking?

One question tells you little. A timed set on Cyber-resilience: Range of Practices shows your real accuracy, how long you take and where you lose marks.

Practise Cyber-resilience: Range of PracticesFree diagnostic mock

More Cyber-resilience: Range of Practices questions