What is risk transference?

• A. Handing risk off to a willing third party, such as outsourcing operations.
• B. Monitoring risk without action.
• C. Accepting all risk without action.
• D. Eliminating risk entirely.

Answer: (A)

Risk transference means shifting the potential impact of a security risk to another party, typically through a contract or policy. The idea is that someone else—often a vendor or insurer—agrees to bear the financial and operational consequences of a incident, reducing your own exposure. Practical examples include outsourcing a function to a third party or buying cyber insurance, where the vendor or insurer takes on the risk in exchange for payment and defined responsibilities in a contract or policy. You still need to ensure the arrangement requires appropriate security controls, but the core concept is that the risk burden is moved off your organization onto someone else. It’s not about just monitoring risk, not about accepting the risk, nor about eliminating it entirely.