A company buys cyber insurance that will pay for business losses if its primary cloud provider suffers a prolonged regional outage. Which statement best describes this risk treatment?
Select an answer to reveal the explanation.
Short Explanation
Insurance is like a safety net under a tightrope walker: it softens the landing, but you're still the one who fell in front of the crowd. The insurer pays some of the bill, while your customers, regulators and reputation still hold you accountable. That's the trap here, because the money moves and the accountability doesn't.
Full Explanation
Risk transfer shifts some or all of the financial consequence of a risk to a third party, most commonly through insurance or contractual indemnities. A cyber or business interruption policy compensates the company for covered losses during a provider outage, reducing the financial impact the company bears. Accountability, however, cannot be transferred: the company remains responsible to its customers, regulators and shareholders for service continuity and for decisions about its reliance on a single provider, and reputational damage is not covered by the payout. The statement that accountability moves to the insurer is the common misconception the question targets; an insurer pays claims but has no obligation for the company's service commitments. Risk mitigation reduces likelihood or impact through controls, such as multi-region architecture; insurance does nothing to make the outage less likely. Risk acceptance means consciously retaining the risk without further action; purchasing coverage is an action that moves cost elsewhere, the opposite of absorbing it. Exam caveat: some frameworks, including ISO 31000, describe insurance as risk sharing; either way, accountability stays with the organization. Operational check: compare the policy's exclusions, waiting periods and limits against the business impact analysis to confirm what portion of the loss is actually covered.