FRM Part II · FRM Exam Part II · Cyber-resilience: Range of Practices
A bank's cyber risk team is building its inventory for cyber risk identification. Which step best reflects the range of practices observed for identifying cyber risk, according to the BCBS/CPMI-IOSCO-style cyber-resilience guidance?
Effective cyber risk identification starts by identifying and classifying business functions, information assets and their interdependencies, including third-party and external connections, then ranking them by criticality. Restricting scope to owned systems or ranking by cost ignores dependencies and business impact.
- AIdentify and classify business functions, information assets and their interdependencies, including those provided by third parties, and rank them by criticalityCorrect
- BRely solely on annual external penetration tests to determine which systems are important
- CLimit the inventory to systems owned and operated within the bank's own data centres
- DPrioritise assets by purchase cost so that the most expensive hardware receives the strongest controls
Explanation
Identification begins with understanding what the firm relies on: business functions, information assets, and the connections among them, including third-party and interconnected parties, ranked by criticality. Limiting scope to owned systems misses outsourced dependencies, and cost is not a proxy for business criticality.
Did you get it right without looking?
One question tells you little. A timed set on Cyber-resilience: Range of Practices shows your real accuracy, how long you take and where you lose marks.
More Cyber-resilience: Range of Practices questions
- A firm relies on a cloud provider that itself uses several subcontractors. In the cyber risk identification process, what is the most approp…
- A bank's board is reviewing its cyber-resilience framework based on the range of practices observed across large financial institutions. Whi…
- A bank's board sets a cyber risk appetite statement. Which of the following is the most appropriate form of the statement for it to be effec…
- After a destructive cyberattack, a bank's recovery plan relies on restoring from backups held on the same network as production systems. Whi…
- A global bank's cyber strategy is aligned with the three lines model. The first-line technology team has reported that all controls tested a…
- A risk manager wants to test whether the bank's cyber defences and response would hold up against a realistic, targeted attack by a skilled …