Software Architect's Handbook

Transferring the risk

Transferring the risk to another party can be a viable strategy for some security threats. Some common ways in which risk can be shifted to another party is through an insurance policy and through contracts.

If an insurance policy is purchased, an insurance company will assume the financial risks that might result from a security threat. Keep in mind though that it may not be possible for insurance to make up for the damage that a security attack can inflict on an organization. If an organization's reputation is ruined and the trust of customers is lost, the consequences to a business can be catastrophic.

We can also transfer a security risk to another party by contracting out the work. We will discuss the different ...