FRM Part II · FRM Exam Part II · Cyber-resilience: Range of Practices
A bank's business continuity plan was last tested by a tabletop walkthrough that assumed the failure of a single data center. The risk committee asks how to improve the credibility of its cyber recovery capability. Which action is most appropriate?
Run broader scenario-based exercises that include data corruption, third-party failure and degraded communications, involving business lines as well as technology, then update the plan with the lessons. Repeating a narrow tabletop or only reviewing documents does not demonstrate real recovery capability.
- ARun scenario-based exercises that include data corruption, loss of a third-party provider and degraded communications, and feed lessons learned into the planCorrect
- BRepeat the same tabletop annually to ensure staff remain familiar with it
- CReplace testing with a documented review of the plan by internal audit
- DLimit testing to technology teams so business lines are not disrupted
Explanation
Cyber-resilience practice stresses testing severe but plausible scenarios, involving business, technology and third parties, and updating plans from the lessons learned. Repeating the same narrow tabletop or relying on document review does not validate recovery. Excluding business lines leaves dependencies untested.
Did you get it right without looking?
One question tells you little. A timed set on Cyber-resilience: Range of Practices shows your real accuracy, how long you take and where you lose marks.
More Cyber-resilience: Range of Practices questions
- A bank wants its cyber risk assessment to reflect the threat landscape. Which approach is most consistent with good practice for incorporati…
- A bank scores four cyber scenarios by annual likelihood and loss per event. Expected annual loss = likelihood x loss. Scenario A: 0.50 x $1.…
- A bank's board asks the CISO to explain how cyber-resilience differs from traditional cyber-security. Which description best captures the di…
- After a ransomware attack encrypts a payment processor's production systems, the firm restores from backups that were stored on the same net…
- A bank runs a cyber risk assessment and finds that a customer-facing payment application has a high-severity vulnerability. Threat intellige…
- A bank backs up its core ledger to an offsite site every 4 hours. A ransomware attack corrupts the primary system 3 hours after the last bac…