A small e-commerce company has identified a risk that a ransomware attack could halt online sales and cause significant financial loss. The security team has already deployed backups and endpoint protection, but leadership is still concerned about the potential cost of a major incident. To address the remaining financial exposure, the company purchases a cyber insurance policy that would cover recovery costs and lost revenue. Which risk treatment strategy does purchasing this policy represent?