Skip to content

FRM Part II · FRM Exam Part II · Cyber-resilience: Range of Practices

A firm defines its cyber risk appetite as tolerating no more than 4 hours of unavailability for its payments platform. Testing shows recovery of the platform takes 6 hours. Which is the most appropriate governance response?

The firm should treat the 6-hour recovery as a breach of its 4-hour tolerance and escalate it to the risk committee with a remediation plan. Changing the appetite to fit current capability, or deferring reporting, would undermine the purpose of an appetite statement.

  1. ATreat the result as a breach of tolerance and escalate it, with a remediation plan to the risk committeeCorrect
  2. BRevise the appetite statement to 6 hours so that the gap disappears
  3. CRecord the result as acceptable because the platform has not yet failed
  4. DWait until the next annual strategy review before reporting it

Explanation

Recovery of 6 hours exceeds the 4-hour tolerance, so the firm is outside appetite. Governance requires escalation and remediation. Loosening the appetite merely to fit capability defeats its purpose, and ignoring or delaying the finding leaves the board uninformed.

Did you get it right without looking?

One question tells you little. A timed set on Cyber-resilience: Range of Practices shows your real accuracy, how long you take and where you lose marks.

Practise Cyber-resilience: Range of PracticesFree diagnostic mock

More Cyber-resilience: Range of Practices questions