Question

A mid-sized retailer's CISO is building the business case for purchasing a cyber risk insurance policy. During a board meeting, a director asks what the policy is fundamentally intended to accomplish for the organization, given that they already invest heavily in preventive controls. Which statement best describes the primary purpose of cyber risk insurance in this context?

Accepted Answer

It offsets the financial impact of a security incident by covering costs such as breach notification, legal fees, and recovery expenses

Answer

It eliminates the organization's residual risk by transferring all liability for breaches to the insurer

Answer

It replaces the need for technical controls by contractually obligating the insurer to prevent future attacks

Answer

It guarantees regulatory compliance with standards such as PCI DSS and GDPR by satisfying their control requirements