After MFA, immutable backups, and segmentation, a school district still faces residual ransomware financial exposure. Which risk strategy best describes buying a cyber insurance policy for that remainder?
Select an answer to reveal the explanation.
Short Explanation
Insurance is handing part of the leftover bill to someone else when the storm still might hit. You've already put on the raincoat (controls); the policy transfers some of the remaining financial splash.
Full Explanation
Risk transfer shifts financial or contractual consequences of residual risk to another party after mitigations have reduced but not eliminated exposure. Buying cyber insurance for remaining ransomware financial exposure after MFA, immutable backups, and segmentation is a classic transfer of residual monetary impact. The district still operates student systems; insurance addresses leftover loss potential rather than pretending the risk is gone. Avoiding the risk by permanently shutting down every student information system would eliminate the activity that creates the exposure, but that extreme avoidance destroys the educational mission and is not what purchasing insurance describes. Avoidance removes the process; insurance transfers financial consequences while the process continues. Ignoring the risk without documentation is neglect, not a recognized treatment strategy. Untracked residual ransomware exposure fails governance and audit expectations in a school district. Accepting the risk only by deleting all backups is incoherent: deleting backups increases impact and is neither proper acceptance nor transfer. Documented acceptance retains risk within appetite with authorization; destroying mitigations worsens the risk. Exam caveat: After controls reduce risk, insurance and certain contracts illustrate transfer of residual exposure. Do not confuse transfer with avoidance, silent ignore, or actions that actually increase impact. Operational check: Confirm primary ransomware controls remain in place, quantify residual financial exposure, align the cyber policy's scope and sublimits to student-system scenarios, and document transfer as the treatment for that residual on the risk register.