Skip to content

FRM Part II · FRM Exam Part II · Digital Resilience and Financial Stability: The Quest for Policy Tools in the Financial Sector

A bank's risk committee reviews a cyber incident scenario. The bank's critical payment service has a maximum tolerable outage of 4 hours. Testing shows recovery takes 6 hours when the main vendor is unavailable. Which conclusion and action are most consistent with a digital resilience approach?

The bank is outside its impact tolerance, since recovery takes 6 hours against a 4-hour limit. It should remediate through measures like alternative providers or quicker recovery, or escalate the gap, rather than relaxing the tolerance or relying on insurance.

  1. AResilience is adequate because recovery eventually happens, so no action is needed
  2. BReduce the tolerance to 6 hours to match current capability
  3. CThe bank is outside its impact tolerance and should invest in remediation such as alternative providers or faster recovery, or escalate the gapCorrect
  4. DTransfer the entire risk to insurance, which removes the need to meet the tolerance

Explanation

Impact tolerance is set based on harm to customers and stability, and then capability is tested against it. A 6-hour recovery exceeds the 4-hour tolerance by 2 hours, so remediation is needed. Loosening the tolerance to fit capability or relying on insurance does not restore the service.

Did you get it right without looking?

One question tells you little. A timed set on Digital Resilience and Financial Stability: The Quest for Policy Tools in the Financial Sector shows your real accuracy, how long you take and where you lose marks.

Practise Digital Resilience and Financial Stability: The Quest for Policy Tools in the Financial SectorFree diagnostic mock

More Digital Resilience and Financial Stability: The Quest for Policy Tools in the Financial Sector questions