Question

A retail organization faces a significant risk of a ransomware attack that could halt online sales. The CFO proposes purchasing a cyber-insurance policy that would cover the financial losses from downtime and recovery costs, and argues that this fully addresses the risk. As the risk practitioner reviewing this proposal, what is the MOST important point to communicate to management?

Accepted Answer

Transferring the risk through insurance does not reduce the likelihood of the attack occurring or the operational disruption, so mitigating controls are still needed to manage residual risk

Answer

Insurance is the most cost-effective response and eliminates the need to invest further in preventive or detective controls

Answer

The risk should be formally accepted since the financial impact is now covered by the insurer

Answer

Purchasing insurance constitutes risk avoidance because the organization no longer bears the loss