Question

A manufacturer purchases a cyber insurance policy to transfer the financial impact of a ransomware event. During the annual policy review, the risk practitioner notices the policy excludes losses arising from unpatched systems and from any state-sponsored attack. The organization's current patching backlog is significant. What should the risk practitioner communicate to management regarding this risk response?

Accepted Answer

The insurance transfer only partially addresses the exposure; retained residual risk from the exclusions must still be assessed and treated.

Answer

The ransomware risk has been fully transferred to the insurer and can now be closed in the risk register.

Answer

The organization should immediately cancel the policy because the exclusions make it worthless.

Answer

Because premiums are being paid, no further mitigation of the patching backlog is required.