Charta is on Google Play: practise on the go. Get the app
Charta

State what cyber-resilience means and set recent regulatory initiatives on it side by side.

FRM® Part II · Operational Risk and Resilience · Cyber-resilience: Range of practices · FRM2.ORR.8.a

The idea

Cyber-resilience is the ability of an organisation to keep carrying out its mission by anticipating and adapting to cyber threats and by withstanding, containing and rapidly recovering from cyber incidents. That is wider than cybersecurity, which concerns protecting the confidentiality, integrity and availability of information and systems. Resilience accepts that some attacks will succeed and asks whether critical services continue. The official sector has built on this idea in several pieces, all non-binding and implemented nationally. The G7 Fundamental Elements give eight high-level elements for financial entities generally. They are strategy and framework, governance, risk and control assessment, monitoring, response, recovery, information sharing and continuous learning. The CPMI-IOSCO guidance applies the existing market infrastructure principles to cyber. It uses five risk management categories (governance, identification, protection, detection, response and recovery) plus three overarching components (testing, situational awareness, learning and evolving). The FSB Cyber Lexicon only supplies shared vocabulary. Know who each is aimed at and do not mix up their structures.

A practice question

From the question bank, with the reason each wrong option is wrong.

Which statement best matches the Financial Stability Board Cyber Lexicon view of cyber-resilience?

  1. The ability to continue its mission by anticipating and adapting to cyber threats and by withstanding, containing and recovering from incidents. - correct
  2. The preservation of the confidentiality, integrity and availability of information and systems from unauthorised access, use or modification.Why not: This is the definition of cybersecurity, which is narrower and does not cover continuing operations through and after an incident.
  3. Holding enough regulatory capital to absorb the financial losses from successful cyber attacks on the institution.Why not: Confuses resilience with a capital buffer; resilience is about keeping the mission going and recovering, not loss absorption.
  4. Preventing every attempted intrusion through strong perimeter controls so that no cyber incident ever disrupts the institution.Why not: Treats resilience as total prevention; the concept assumes some incidents will happen and focuses on withstanding and recovering.

The Lexicon frames cyber-resilience as anticipating, adapting, withstanding, containing and recovering so the mission continues. Confidentiality, integrity and availability describe cybersecurity, which is only part of the picture.

A harder one

A bank's board approves this objective: critical payment services must be restored within two hours of a successful ransomware attack, even if the attack could not be prevented. Which concept does the objective most directly express?

  1. Cybersecurity alone, because it seeks to protect the confidentiality, integrity and availability of systemsWhy not: Cybersecurity is mostly about protecting systems; an objective set around recovery time after a successful attack goes beyond protection.
  2. Cyber-risk transfer, because the exposure is passed to an insurer after the attackWhy not: Insurance may fund losses but does not restore services within a set time, so it is not the concept in the objective.
  3. Vulnerability management, because ransomware exploits unpatched weaknessesWhy not: Patching reduces the chance of attack but the objective concerns recovery after an attack that got through.
  4. Cyber-resilience, because it accepts that incidents will occur and targets continuity and recovery of critical services - correct

The target assumes an attack can succeed and sets a recovery objective for critical services, which is the essence of resilience: withstand, contain and recover. Protection, insurance and patching address other parts of the problem.

The hardest tier

A bank is mapping its programme to external references. Its documents are headed: strategy and framework; governance; risk and control assessment; monitoring; response; recovery; information sharing; continuous learning. Which initiative does this structure mirror, and what is its legal nature?

  1. The CPMI-IOSCO guidance, a binding rulebook of five categories and three components for all banksWhy not: Wrong initiative, and the guidance is aimed at market infrastructures and elaborates existing principles rather than binding every bank.
  2. The FSB Cyber Lexicon, a binding list of minimum controlsWhy not: The Lexicon only provides definitions and does not prescribe controls or any programme structure.
  3. The G7 Fundamental Elements, eight non-binding elements - correct
  4. The G7 Fundamental Elements, a binding regulation that sets minimum capital for cyber riskWhy not: Gets the structure right but wrongly treats it as binding and as a capital rule; it is non-binding, high-level guidance.

The eight headings are the G7 Fundamental Elements, which are high-level and non-binding, left to national authorities and firms to apply. The other initiatives differ in structure and none sets a cyber capital charge.

In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.

Start free →

More in Cyber-resilience: Range of practices