How can cyber risk be managed within an ERM framework?

How can cyber risk be managed within an ERM framework?

• A. Through reactive incident handling after breaches.
• B. Through robust access controls, data backups, incident response planning, cyber and ICT controls, and ongoing monitoring.
• C. By outsourcing all cyber security to a vendor.
• D. By ignoring cyber risk if no incidents have occurred recently.

Answer: (B)

In an ERM framework, cyber risk is managed in a proactive, layered way that links governance with ongoing protection and oversight. This means implementing a coherent set of controls across people, processes, and technology so that risk is reduced before incidents occur and so the organization can detect, respond to, and recover from problems quickly. Robust access controls limit who can reach systems and data, reducing the chance of unauthorized access. Data backups and recovery planning ensure business continuity even if a cyber event happens. Incident response planning provides a clear, practiced process for containment, investigation, and recovery, so impacts are minimized and lessons learned feed back into improvements. A comprehensive suite of cyber and ICT controls covers technical safeguards, vulnerability management, configuration management, and monitoring tools. Ongoing monitoring keeps the organization aware of changing threats and control effectiveness, supporting steady alignment with risk appetite and governance oversight. Relying only on reactive incident handling cannot stop breaches or limit damage; waiting for events to occur is inconsistent with risk management. Outsourcing all cyber security to a vendor shifts responsibility and can leave gaps if the vendor is unavailable or not fully aligned with the organization’s risk stance. Ignoring cyber risk when no incidents have happened ignores that risk can materialize at any time and misses the ongoing need for assurance and improvement. So the best approach is a comprehensive, integrated set of preventive controls, planning, and continuous monitoring.

In an ERM framework, cyber risk is managed in a proactive, layered way that links governance with ongoing protection and oversight. This means implementing a coherent set of controls across people, processes, and technology so that risk is reduced before incidents occur and so the organization can detect, respond to, and recover from problems quickly.

Robust access controls limit who can reach systems and data, reducing the chance of unauthorized access. Data backups and recovery planning ensure business continuity even if a cyber event happens. Incident response planning provides a clear, practiced process for containment, investigation, and recovery, so impacts are minimized and lessons learned feed back into improvements. A comprehensive suite of cyber and ICT controls covers technical safeguards, vulnerability management, configuration management, and monitoring tools. Ongoing monitoring keeps the organization aware of changing threats and control effectiveness, supporting steady alignment with risk appetite and governance oversight.

Relying only on reactive incident handling cannot stop breaches or limit damage; waiting for events to occur is inconsistent with risk management. Outsourcing all cyber security to a vendor shifts responsibility and can leave gaps if the vendor is unavailable or not fully aligned with the organization’s risk stance. Ignoring cyber risk when no incidents have happened ignores that risk can materialize at any time and misses the ongoing need for assurance and improvement.

So the best approach is a comprehensive, integrated set of preventive controls, planning, and continuous monitoring.