SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/secplus-risk-transfer-insurance

Buying cyber insurance to shift financial loss to an insurer is which type of risk response?

Transfer (or sharing). It moves liability but does not reduce the likelihood of the event.

Start playing free

  1. Avoid
  2. Accept
  3. Transfer ✔

Why: Risk responses include accept, avoid, mitigate, share and transfer. Insurance moves the financial burden to another party. The attack can still happen and the harm can still occur.

Huh, didn't know that: NIST says risk transfer is less useful in the public sector, where liability is usually set by law or policy.

The dad joke
I transferred my risk to an insurance company. They transferred my premium to a bigger number.
Like this card?
Play the game

References

Answer: Transfer. Risk responses include accept, avoid, mitigate, share and transfer. Insurance moves the financial burden to another party. The attack can still happen and the harm can still occur.

  1. NIST SP 800-39, Managing Information Security Risk nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-39.pdf
    e.g., using insurance to transfer risk from particular organizations to insurance companies
    Checked 2026-10-10.
  2. NIST SP 800-39, Managing Information Security Risk nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-39.pdf
    risk transfer reduces neither the likelihood of harmful events occurring nor the consequences
    Checked 2026-10-10.
  3. NIST SP 800-39, Managing Information Security Risk nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-39.pdf
    the concept of risk transfer is less applicable in the public sector
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacySplitting a sensitive task, like creating and approving payments, among different people is called what?Security & PrivacyWhich list names all six functions of NIST Cybersecurity Framework 2.0?Security & PrivacyWhich governance document gives detailed, step-by-step instructions for carrying out a security task?

That's stuff everyone should know.