Skip to content

FRM Part II · FRM Exam Part II · Cyber-resilience: Range of Practices

A bank's cyber-resilience framework sets a recovery time objective (RTO) of two hours for its payments system. Which statement best describes what the RTO represents?

The recovery time objective is the target time within which a system must be restored to an agreed service level after a disruption. It concerns how quickly service resumes, not how much data may be lost, which is governed by the recovery point objective.

  1. AThe maximum tolerable period of data loss, measured back from the point of disruption
  2. BThe target time within which the system must be restored to an agreed service level after a disruptionCorrect
  3. CThe time taken to detect that a cyber incident has begun
  4. DThe time after which regulators must be notified of an incident

Explanation

RTO is the target duration within which a process or system must be restored after disruption. The maximum tolerable data loss is the recovery point objective (RPO), which is why the first option is wrong. Detection time and regulatory notification are separate metrics.

Did you get it right without looking?

One question tells you little. A timed set on Cyber-resilience: Range of Practices shows your real accuracy, how long you take and where you lose marks.

Practise Cyber-resilience: Range of PracticesFree diagnostic mock

More Cyber-resilience: Range of Practices questions