Question

A manufacturing company purchases a cyber insurance policy to cover potential losses from a ransomware attack against its production systems. During a subsequent risk review, the board asks the information security manager who is accountable for the residual risk that remains after this insurance is in place. What is the MOST accurate response?

Accepted Answer

The business process owner retains accountability for the residual risk, as risk cannot be fully outsourced through transfer.

Answer

The insurance provider assumes accountability for the residual risk once the policy premium is paid.

Answer

The information security manager becomes accountable because they arranged and manage the insurance coverage.

Answer

Accountability shifts entirely to the third-party incident response firm named in the policy.