Skip to content

FRM Part II · FRM Exam Part II · Cyber-resilience: Range of Practices

Which element is most important for a cyber-resilience strategy to be credible to the board and regulators?

A credible strategy defines risk appetite with measurable metrics, assigns clear ownership, and aligns resources to critical business services. Promising zero incidents is unrealistic, vendor lists are not strategy, and a policy never revisited cannot keep pace with changing cyber threats.

  1. AA defined risk appetite with measurable metrics, assigned ownership, and resources aligned to critical business servicesCorrect
  2. BA commitment that no cyber incident will ever occur
  3. CA list of security vendors under contract
  4. DA policy approved once and not revisited unless a breach occurs

Explanation

Credible strategy needs measurable appetite, clear ownership and adequate resources tied to critical services, and it should be reviewed regularly. Promising zero incidents is unrealistic, vendor lists are not strategy, and static policies fail to adapt to evolving threats.

Did you get it right without looking?

One question tells you little. A timed set on Cyber-resilience: Range of Practices shows your real accuracy, how long you take and where you lose marks.

Practise Cyber-resilience: Range of PracticesFree diagnostic mock

More Cyber-resilience: Range of Practices questions