IPA IP 2022 Question 76
A question IPA Japan published in 令和4年度 ITパスポート試験 公開問題 問76, translated into English. ITPEC is based on the same exams.
When risk treatment in risk management for information security is classified into the four (4) categories of risk avoidance, risk sharing, risk mitigation, and risk retention, which of the following is the category of taking out cyber insurance in preparation for damage when an information leakage occurs?
Explanation
Risk sharing — insurance hands part of the financial damage of a risk over to another party, the insurer.
The four kinds of risk treatment:
- •Risk avoidance: stop the activity that carries the risk, for example stop handling personal information
- •Risk sharing (transfer): pass the loss to another party by agreement, through insurance or outsourcing
- •Risk mitigation (reduction): lower the likelihood or the impact with countermeasures such as encryption or access control
- •Risk retention (acceptance): take no special measure and bear the loss if it occurs
Cyber insurance does not make a leak less likely; it pays for the damage after one, so the cost is shared with the insurer.
Answer (b)
Why not others:
- •(a) Risk avoidance — would mean no longer handling the information at all
- •(c) Risk mitigation — would act on the leak itself, making it less likely or less harmful, through security measures
- •(d) Risk retention — would mean accepting the loss without any arrangement, insurance included
Key rule: Insurance and outsourcing contracts are risk sharing (transfer): the risk stays, but someone else bears part of its cost.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.