Cyber Security, Resilience and Operational Risk
What this domain tests
The exam tests the confidentiality, integrity and availability (CIA) model, the control set used against cyber threats, and the operational resilience regime: important business services, impact tolerances, severe-but-plausible scenarios, recovery objectives and incident reporting.
Core rules and concepts
- Threats and controls: phishing, ransomware, insider threat, supply chain compromise. Controls include multi-factor authentication, least privilege, patching, network segmentation, endpoint detection, SIEM monitoring, data loss prevention, encryption and tested backups.
- Third-party risk: concentration, subcontracting chains, fourth-party dependencies and contractual security requirements.
- BCP and DR: recovery time objective (RTO) is how quickly a service must be restored; recovery point objective (RPO) is how much data loss is tolerable. Both need testing, not just documentation.
- Operational resilience: identify important business services, set impact tolerances, test severe-but-plausible scenarios, and remediate gaps (PRA SS1/21, FCA SYSC 15A). DORA applies in the EU from 17 January 2025.
- Frameworks: NIST Cybersecurity Framework, ISO 27001, Cyber Essentials; penetration testing and tabletop exercises provide evidence.
- Incident response: detect, contain, eradicate, recover, learn; notify regulators and clients where required.
Worked example
Ransomware encrypts the portfolio management system. The valuation service has an impact tolerance of four hours; RTO is two hours and RPO is 15 minutes. Reasoning: the impact tolerance is about client harm - missed NAV or inaccurate positions - not about server uptime. Recovery must restore service within two hours, losing no more than 15 minutes of data; the firm runs a manual fallback using custodian statements while restoring from immutable backups. If the four-hour tolerance is breached, the incident is escalated and regulators are notified under the applicable regime. The exam marks the distinction between tolerance, RTO and RPO.
Traps that cost marks
Using RTO and RPO interchangeably; treating resilience as disaster recovery alone; treating cyber as an IT-only issue; ignoring third-party concentration; assuming backups will restore without testing; writing a plan that has never been exercised.