Skip to content

FRM Part II · FRM Exam Part II · Case Study: Cyberthreats and Information Security Risks

A bank's board wants key risk indicators (KRIs) to give early warning of deteriorating cyber control health. Which of the following is the best example of a leading KRI?

The percentage of critical systems with overdue security patches is the best leading KRI because it signals rising exposure before any incident happens. Annual losses, fines and complaints are lagging indicators that only measure damage after events have already occurred.

  1. ATotal financial loss from cyber incidents last year
  2. BNumber of regulatory fines received in the prior quarter
  3. CPercentage of critical systems with security patches overdue beyond the policy deadlineCorrect
  4. DNumber of customer complaints following a data breach

Explanation

Overdue critical patches signal increased vulnerability before an incident occurs, so they are leading. Losses, fines and complaints are lagging measures reflecting events that have already happened.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Cyberthreats and Information Security Risks shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Cyberthreats and Information Security RisksFree diagnostic mock

More Case Study: Cyberthreats and Information Security Risks questions