Skip to content

FRM Part II · FRM Exam Part II · Cyber-resilience: Range of Practices

After a significant cyber incident is contained, a firm's CISO proposes a post-incident review. Which outcome of the review is most consistent with a cyber-resilience framework that evolves over time?

The review should feed root-cause findings back into controls, response playbooks and testing scenarios. Cyber-resilience depends on continuous learning and adaptation. Closing the record at restoration, assigning blame, or hiding findings within one team prevents the framework from improving after the incident.

  1. AClosing the incident record once systems are restored to service
  2. BAssigning individual blame to the staff member who clicked the malicious link
  3. CFeeding root-cause findings into updates of controls, response playbooks, and testing scenariosCorrect
  4. DKeeping the findings within the security team to limit reputational exposure

Explanation

Resilience practices stress learning from incidents and tests, and then adapting the framework, playbooks and scenarios. Closing the record at restoration forfeits the lessons. Blame and secrecy undermine learning and sharing.

Did you get it right without looking?

One question tells you little. A timed set on Cyber-resilience: Range of Practices shows your real accuracy, how long you take and where you lose marks.

Practise Cyber-resilience: Range of PracticesFree diagnostic mock

More Cyber-resilience: Range of Practices questions