Skip to content

FRM Part II · FRM Exam Part II · Cyber-resilience: Range of Practices

A firm runs annual red-team exercises, and the last three produced the same finding: slow escalation of suspected incidents to senior management. Each time remediation was marked complete after a policy update, yet the issue recurred. Which conclusion and action best reflect a mature learning and evolution process?

Recurring findings show remediation was ineffective, so the firm should track issues to closure with accountable owners, validate fixes through retesting, and reassess root causes. Policy updates alone did not change behavior. Reducing exercise scope, dismissing the issue, or adding more documents repeats the failure.

  1. AThe red team is too aggressive; reduce the scope of exercises
  2. BThe finding is immaterial because no real incident has occurred
  3. CRemediation was ineffective; track findings to closure with validation testing and ownership, and reassess whether the fix addresses the root causeCorrect
  4. DAdd further policy documents and repeat the exercise next year unchanged

Explanation

Recurrence shows the fix addressed paperwork rather than the cause. Mature processes assign owners, validate closure through retesting, and revisit root causes. Narrowing scope or adding more policy repeats the failed approach, and dismissing the finding ignores the control weakness.

Did you get it right without looking?

One question tells you little. A timed set on Cyber-resilience: Range of Practices shows your real accuracy, how long you take and where you lose marks.

Practise Cyber-resilience: Range of PracticesFree diagnostic mock

More Cyber-resilience: Range of Practices questions