CRO Cybersecurity Risk Management 3

Question 1

A CRO must evaluate whether to purchase cyber liability insurance. Which factor most directly determines the appropriateness of the coverage limit?

Accepted Answer

The organization's maximum probable cyber loss exposure

Answer

Coverage limits should be calibrated to the organization's maximum probable loss exposure so that the policy meaningfully transfers residual risk.

Question 2

Under the SEC's 2023 cybersecurity disclosure rules, public companies must disclose material cybersecurity incidents within how many business days of determining materiality?

Accepted Answer

10 business days

Answer

The SEC's 2023 rules require public companies to file Form 8-K disclosing material cybersecurity incidents within four business days of determining the incident is material (approximately equivalent to 10 calendar days in practice — but the rule states four business days).

Question 3

Which cybersecurity control type is classified as 'detective' rather than 'preventive'?

Accepted Answer

Security Information and Event Management (SIEM)

Answer

SIEM systems aggregate and analyze logs to identify suspicious activity after it occurs, making them detective controls rather than preventive ones.

Question 4

A CRO is performing a Business Impact Analysis (BIA) for cyber risk. What does the Recovery Time Objective (RTO) specifically measure?

Accepted Answer

The maximum acceptable time to restore a system to normal operations

Answer

RTO defines the maximum acceptable duration for restoring a business function or system after disruption before unacceptable consequences occur.

Question 5

An organization is assessing supply chain cyber risk. Which vendor due diligence approach provides the most objective assurance about a vendor's security posture?

Accepted Answer

Requiring a SOC 2 Type II report from an independent auditor

Answer

A SOC 2 Type II report provides independent, audited evidence that security controls were operating effectively over a sustained period, unlike self-assessments.

(CRO) Chief Risk Officer Certification Practice Test

(CRO) Chief Risk Officer Certification Practice Test

CRO Cybersecurity Risk Management 3