Skip to content

FRM Part II · FRM Exam Part II · Cyber-resilience: Range of Practices

A firm's critical service has a board-approved maximum tolerable outage of 4 hours. Scenario testing of a destructive-malware event shows detection takes 1.5 hours, containment 1 hour, and restoration from backups 2.5 hours, with restoration starting only after containment is complete. Which conclusion is correct?

Total disruption is 5 hours, exceeding the 4-hour tolerance by 1 hour. The stages are sequential, so detection of 1.5 hours, containment of 1 hour and restoration of 2.5 hours add up to 5 hours, meaning the firm cannot currently meet its board-approved tolerance.

  1. ATotal disruption is 4 hours, exactly within tolerance
  2. BTotal disruption is 5 hours, exceeding tolerance by 1 hourCorrect
  3. CTotal disruption is 5 hours, exceeding tolerance by 2.5 hours
  4. DTotal disruption is 3.5 hours, within tolerance

Explanation

Sequential stages: 1.5 + 1 + 2.5 = 5 hours. Against a 4-hour tolerance, the excess is 1 hour. The firm must shorten a stage, such as faster detection or parallel restoration, or revisit its tolerance. 4 hours would wrongly drop the detection time or restoration overlap.

Did you get it right without looking?

One question tells you little. A timed set on Cyber-resilience: Range of Practices shows your real accuracy, how long you take and where you lose marks.

Practise Cyber-resilience: Range of PracticesFree diagnostic mock

More Cyber-resilience: Range of Practices questions