Skip to content

FRM Part II · FRM Exam Part II · Cyber-resilience: Range of Practices

A regulator asks a bank how its cyber-resilience approach keeps pace with changing threats. Which practice would provide the strongest evidence of an evolving framework?

Regular review of threats, test results and incidents that leads to documented updates of strategy and controls is the strongest evidence. It shows a continuous learning cycle. A static strategy, budget increases without reprioritization, or vendor certificates do not demonstrate adaptation to evolving threats.

  1. AA static five-year cyber strategy approved once by the board
  2. BRegular review of the threat landscape, testing results, and incidents, leading to documented updates of strategy and controlsCorrect
  3. CA large increase in the security budget with no change in priorities
  4. DReliance on the vendor's annual certification of its security products

Explanation

Evolution is shown by a repeated cycle of monitoring threats, testing, and learning from incidents, then documenting adjustments. A static strategy, spending without direction, or vendor certification does not show adaptation to the firm's own risks.

Did you get it right without looking?

One question tells you little. A timed set on Cyber-resilience: Range of Practices shows your real accuracy, how long you take and where you lose marks.

Practise Cyber-resilience: Range of PracticesFree diagnostic mock

More Cyber-resilience: Range of Practices questions