Question

A financial services firm purchases a cyber-insurance policy to address the risk of a data breach affecting customer records. During a review, the risk practitioner notes that the policy covers direct financial losses but excludes regulatory fines, reputational damage, and the cost of mandatory customer notification. Which conclusion should the risk practitioner communicate to management about this risk response?

Accepted Answer

A significant portion of residual risk remains retained by the firm and must be addressed through additional response options

Answer

Transferring the risk through insurance eliminates the firm's exposure, so no further action is required

Answer

The insurance policy converts the risk from inherent to residual, satisfying the risk appetite automatically

Answer

Because insurance is in place, the firm should reclassify the breach scenario as fully avoided