Skip to content

FRM Part II · FRM Exam Part II · Cyber-resilience: Range of Practices

A bank's cyber-resilience framework sets a recovery time objective (RTO) for its payment-processing system. Which statement best describes what the RTO represents?

The recovery time objective is the target duration within which a system or service must be restored after a disruption. It is distinct from the recovery point objective, which limits acceptable data loss, and from detection or evidence retention periods.

  1. AThe maximum amount of data, measured in time, that the bank can afford to lose
  2. BThe target duration within which the system must be restored after a disruptionCorrect
  3. CThe time taken to detect that an attack has begun
  4. DThe period over which forensic evidence must be retained

Explanation

RTO is the targeted time within which a service must be restored after disruption. The maximum tolerable data loss is the recovery point objective (RPO), which is the key distractor. Detection time and evidence retention are separate concepts.

Did you get it right without looking?

One question tells you little. A timed set on Cyber-resilience: Range of Practices shows your real accuracy, how long you take and where you lose marks.

Practise Cyber-resilience: Range of PracticesFree diagnostic mock

More Cyber-resilience: Range of Practices questions