Skip to content

FRM Part II · FRM Exam Part II · Cyber-resilience: Range of Practices

A bank's last year of vulnerability scanning shows 400 critical vulnerabilities found; 300 were remediated within the 30-day policy window, 60 were remediated late, and 40 remain open. The CISO proposes reporting 'remediation rate' as (300+60)/400. Which assessment is most appropriate?

Timely remediation is 300 of 400, or 75%, with 15% fixed late and 10% still open. The 90% figure counts late fixes as successes, overstating compliance with the 30-day policy, so management should report timeliness separately alongside the open backlog.

  1. AThe 90% figure overstates control effectiveness relative to the policy; timely remediation is 75% and 10% remain openCorrect
  2. BThe 90% figure is correct and no further metric is needed
  3. CTimely remediation is 85% because late fixes count half
  4. DTimely remediation is 60% because late and open items are both excluded and doubled

Explanation

Within policy: 300/400 = 75%. Late: 60/400 = 15%. Open: 40/400 = 10%. The 90% figure includes late fixes, masking policy breaches, so a timeliness metric is more meaningful. Half-credit for late fixes (85%) has no basis, and 60% is a miscalculation.

Did you get it right without looking?

One question tells you little. A timed set on Cyber-resilience: Range of Practices shows your real accuracy, how long you take and where you lose marks.

Practise Cyber-resilience: Range of PracticesFree diagnostic mock

More Cyber-resilience: Range of Practices questions