Skip to content

FRM Part II · FRM Exam Part II · Cyber-resilience: Range of Practices

A bank's cyber strategy is assessed by a supervisor. Which finding most clearly indicates that the strategy is not aligned with sound practice for cyber resilience, as opposed to cyber security only?

A strategy focused only on prevention and detection, without objectives for response, recovery and continued delivery of critical services after a successful attack, reflects cyber security rather than cyber resilience. Resilience assumes compromise can happen and plans to keep critical functions running.

  1. AThe strategy covers only prevention and detection controls, with no objectives for response, recovery and continued delivery of critical services after an attackCorrect
  2. BThe strategy is reviewed annually and after major incidents
  3. CThe strategy identifies critical business functions and their dependencies
  4. DThe strategy is linked to the enterprise risk appetite

Explanation

Cyber resilience goes beyond protecting systems to assuming compromise can occur and ensuring critical operations continue and recover. A strategy limited to prevention and detection lacks that. The other options are features of good practice.

Did you get it right without looking?

One question tells you little. A timed set on Cyber-resilience: Range of Practices shows your real accuracy, how long you take and where you lose marks.

Practise Cyber-resilience: Range of PracticesFree diagnostic mock

More Cyber-resilience: Range of Practices questions