An agency buys a cyber insurance policy but skips phishing training and routine patching. What is the sound risk-treatment critique?
Select an answer to reveal the explanation.
Short Explanation
Cyber insurance is a spare parachute, not a reason to stop packing the main chute. Transfer helps after a hit; training and patching still cut the chance you need that claim.
Full Explanation
Insurance transfer complements risk reduction; it does not replace preventive controls is the sound critique when an agency buys cyber insurance but skips phishing training and routine patching. Policies may fund response and loss; they do not stop credential theft or unpatched exploits. Civic IT risk treatment should layer training, patching, and other reductions with insurance for residual catastrophic impact.
Claiming cyber policies require organizations to disable all technical controls after binding fails by concept because insurers typically expect—and may require—reasonable controls; disabling controls increases loss and jeopardizes coverage. Claiming phishing training is unnecessary once any deductible is selected fails because deductibles allocate retained financial share; they do not substitute for human-risk reduction. Claiming acceptance of ransomware is complete when the premium invoice is paid fails because paying premium is transfer procurement, not documented residual acceptance after controls.
Exam caveat: CRMC cyber treatment views insurance as complement to reduction controls. Premium-only strategies without prevention fail exam expectations.
Operational check: Pair any municipal cyber policy with baseline phishing training and patch SLAs; evidence control health to underwriters and the risk committee; treat insurance as backstop, not the sole control.