Finance proposes cyber insurance for a payments-outage risk at a municipal utility. How should that decision be reflected in IRM?
Select an answer to reveal the explanation.
Short Explanation
Insurance is sharing the bill, not pretending the fire vanished. Log transfer on the risk for the cyber policy — do not delete the risk and walk away.
Full Explanation
When finance proposes cyber insurance for a payments-outage risk at a municipal utility, record a transfer treatment against the risk for that insurance decision rather than pretending exposure vanished. Transfer acknowledges another party shares financial consequence while the risk remains visible. Deleting the risk because insurance exists fails by concept because insurance does not erase operational outage exposure or the need for register visibility. Marking the risk mitigated solely because a policy quote was requested fails by concept because a quote is not mitigation of likelihood or impact drivers. Moving the risk into a knowledge article titled insurance fails by concept because knowledge content is not a treatment field on the risk. Exam caveat: CIS-RC records transfer as a treatment for insurance decisions without deleting the risk. Operational check: set treatment to transfer on the payments-outage risk, reference the cyber insurance decision, keep the risk active for monitoring, and confirm dashboards still show residual with transfer noted. In civic IRM programs, retain configuration and decision evidence so examiners can reconstruct why this design supports public services. In civic IRM programs, retain configuration and decision evidence so examiners can reconstruct why this design supports public services.