Skip to content

FRM Part II · FRM Exam Part II · Cyber-resilience: Range of Practices

A bank's cyber risk team is building an inventory as the first step of its cyber risk identification process. Which activity best reflects the practice described in the BCBS/CPMI-style range-of-practices reading on cyber-resilience for identification?

Mapping critical business functions to the information assets, systems and third-party dependencies that support them is the core identification activity. Protection, insurance and awareness measures depend on this inventory, so they are later steps rather than identification itself.

  1. AMapping critical business functions to the supporting information assets, systems and third-party dependenciesCorrect
  2. BPurchasing cyber insurance sized to last year's incident losses
  3. CRunning a phishing simulation for all staff once a year
  4. DSwitching on automatic patching for all endpoint devices

Explanation

Identification starts with knowing what must be protected: critical functions, the assets and systems that support them, and their interconnections including third parties. Insurance, phishing tests and patching are transfer, awareness or protective controls that follow identification rather than constitute it.

Did you get it right without looking?

One question tells you little. A timed set on Cyber-resilience: Range of Practices shows your real accuracy, how long you take and where you lose marks.

Practise Cyber-resilience: Range of PracticesFree diagnostic mock

More Cyber-resilience: Range of Practices questions