A company purchased cyber insurance to address items listed on the risk register. Which of the following strategies does this represent?

Purchasing cyber insurance is a form of risk treatment where the financial impact of a

potential cyber incident is shifted to a third party (the insurer). This strategy is known as

risk transference. According to NIST SP 800-37, "Risk sharing or transfer: Shifting a

given risk to other organizations or entities (e.g., by using insurance, service level

agreements, contracts, or other agreements)." Similarly, university courseware on risk

management categorizes insurance as a primary example of risk transfer.

A. Accept: Risk acceptance means acknowledging a risk and deciding not to take

action to reduce it, often because the cost of mitigation outweighs the potential impact.

Purchasing insurance is an active measure, not acceptance. (NIST SP 800-37)

C. Mitigate: Risk mitigation involves implementing controls or countermeasures to

reduce the likelihood or impact of a risk. While insurance can cover financial losses

(impact), it doesn't reduce the likelihood of the event itself. (NIST SP 800-37)

D. Avoid: Risk avoidance means deciding not to engage in the activities that would

create the risk. Purchasing insurance addresses the financial consequences of a risk,

not avoiding the activities that lead to it. (NIST SP 800-37)

National Institute of Standards and Technology (NIST). (2010). Special Publication

800-37, Revision 1: Guide for Applying the Risk Management Framework to Federal

Information Systems: A Security Life Cycle Approach. Page B-20 (Appendix B,

Section B.4 RISK RESPONSE).

URL: https://csrc.nist.gov/publications/detail/sp/800-37/rev-1/final

Specific Reference: "Risk sharing or transfer: Shifting a given risk to other

organizations or entities (e.g., by using insurance, service level agreements, contracts,

or other agreements)." Also defines risk acceptance, mitigation (risk reduction), and

avoidance.

Huber, M., & P R. (2013). Managing Information Security Risks: The OCTAVE Approach.

Addison-Wesley Professional. (Though a book, it is published by a reputable academic

publisher and aligns with NIST concepts widely taught in university courses).

Note: While a direct link to specific page numbers isn't feasible for a commercial book,

it's a widely recognized academic resource. Risk treatment options including transfer

(sharing) via insurance are standard concepts covered. For a specific university

reference embodying these concepts:

University of Washington. (n.d.). ITLC - IT Risk Management - Risk Treatment.

URL: https://www.washington.edu/itlc/what-we-do/it-risk-management/risk- treatment/

Specific Reference: Defines "Transfer (Share)" as: "Transferring or sharing a risk with a

third party (e.g., contracts, insurance). Reduces the impact of the risk to the UW." Also

defines Avoid, Accept, and Mitigate (Reduce).