After analyzing ransomware risk, a company decides to buy a cyber insurance policy that would cover recovery costs and business interruption losses if an attack succeeds. Which risk treatment does this purchase represent?
Select an answer to reveal the explanation.
Short Explanation
Insurance is the textbook case of handing the financial hit to someone else, so that's transfer. Notice the attack can still happen; you've just moved who pays for it. The trap is mitigation, which would lower the chance or the damage instead.
Full Explanation
Risk transfer shifts the financial consequence of a risk to another party, most commonly through insurance or contractual terms. A cyber insurance policy that pays recovery costs and business interruption losses after a ransomware attack transfers part of the financial impact to the insurer in exchange for a premium. The likelihood of attack is unchanged, and some consequences, such as reputational damage or regulatory obligations, generally cannot be transferred. Avoidance eliminates the risk by stopping the activity that creates it, such as retiring a vulnerable service; buying insurance does not remove the activity or the exposure. Acceptance is a documented decision to take on the risk without further action, usually because it falls within appetite or treatment costs exceed the benefit; purchasing a policy is an action, so it is not acceptance. Mitigation reduces likelihood or impact through controls such as offline backups, endpoint protection, and segmentation; insurance pays after the fact but does not reduce the probability of infection or the operational disruption. Exam caveat: insurers increasingly require baseline controls before issuing a policy, so transfer often depends on mitigation being in place. Operational check: map the policy's coverage and exclusions to the risk register entry and record what portion of the risk remains with the organization as residual risk.