Skip to content

FRM Part II · FRM Exam Part II · Cyber-resilience: Range of Practices

A bank's cyber-resilience framework sets a recovery time objective (RTO) of 2 hours for its payments platform. After a simulated ransomware scenario, the platform was restored in 5 hours, but the data restored was from a backup 30 minutes before the attack, while the recovery point objective (RPO) was 15 minutes. Which conclusion is correct?

Both objectives were breached. The recovery time objective of 2 hours was exceeded by a 5-hour restoration, and the recovery point objective of 15 minutes was exceeded because 30 minutes of data was lost. The test exposes gaps in recovery capability that must be remediated.

  1. ABoth the RTO and the RPO were breached, so recovery capability does not meet the stated tolerancesCorrect
  2. BOnly the RTO was breached because the RPO concerns restoration time
  3. COnly the RPO was breached because the RTO concerns data loss
  4. DNeither was breached because the system was ultimately restored

Explanation

RTO measures time to restore: 5 hours exceeds 2 hours. RPO measures tolerable data loss: 30 minutes of lost data exceeds 15 minutes. Both are breached, and the scenario test reveals a gap to remediate. Final restoration does not satisfy the objectives.

Did you get it right without looking?

One question tells you little. A timed set on Cyber-resilience: Range of Practices shows your real accuracy, how long you take and where you lose marks.

Practise Cyber-resilience: Range of PracticesFree diagnostic mock

More Cyber-resilience: Range of Practices questions