Study. uk . com
  1. Home
  2. All questions
  3. Question 314

CISM study material · question 314 of 1000

An organisation buys cyber insurance and treats the underlying risk as fully addressed. Which limitation does IR 8286 identify?

  1. Transfer is available only for risks rated low, since an insurer will not write cover against an exposure above that level
  2. Insurance is not a recognised risk response, so the underlying exposure remains recorded as untreated in the risk register
  3. Transfer requires a regulatory approval before it becomes effective at all, and the risk stays with the organisation until that approval is given
  4. Some consequences, such as loss of customer trust, cannot be transferred even where financial consequences can
Show the answer

Answer: D. Some consequences, such as loss of customer trust, cannot be transferred even where financial consequences can

IR 8286 treats transfer as sharing consequences with another party, an insurer typically, while noting some consequences stay put — trust once lost is not covered by a policy.

Source: NIST IR 8286 (NIST) — Table 3 Response Types

Challenge yourself on this topic → Study as cards