Skip to content

FRM Part II · FRM Exam Part II · Cyber-resilience: Range of Practices

Nordvik Bank's CISO reports to the head of IT, who also owns system delivery deadlines. An internal review finds that security findings are sometimes deprioritised to meet project launch dates. Which governance change most directly addresses this conflict of interest in line with sound cyber-resilience practice?

Giving the CISO an independent reporting line to senior management or the board addresses the conflict, because security findings can then be escalated without being suppressed by the IT head whose delivery targets compete with them. Testing, training or outsourcing leave the flawed reporting structure unchanged.

  1. AIncrease the number of penetration tests performed each year
  2. BGive the CISO an independent reporting line to senior management or the board, separate from IT deliveryCorrect
  3. CTransfer all security tooling to an external vendor
  4. DRequire IT staff to complete additional annual security training

Explanation

The problem is structural: the security function's escalation is controlled by a party with competing incentives. Independence of the cyber/information security function, with direct access to senior management or the board, resolves this. More tests, training or outsourcing do not change who can override findings.

Did you get it right without looking?

One question tells you little. A timed set on Cyber-resilience: Range of Practices shows your real accuracy, how long you take and where you lose marks.

Practise Cyber-resilience: Range of PracticesFree diagnostic mock

More Cyber-resilience: Range of Practices questions