Part II · Chapter 3 · Risk, without the score · lesson 8

Handing it to somebody else moves the money, not the outage

11 min

Builds on Four things you can do, and only one of them is work

A row from a register, with the treatment column filled in and a note beside it:

An attacker encrypts the production database and we cannot restore it. Treatment: hand it over. Note: covered by our cyber policy.

The policy is real. It has a limit of one million, an excess of fifty thousand, a sixty-day claim process, and four pages of exclusions that nobody in the organisation has read since the broker sent them.

Now the awkward question. On the morning this happens, what does the policy do?

Insurance pays money, later, minus an excess, if the event is inside the wording.

That is not a criticism. It is the product, and the product is valuable: it converts an unknown loss that could end you into a known premium you can budget. For a small organisation that is the single most useful financial thing available.

What it does not touch is the morning. Your product is still down. Your customers are still being told. Your engineers are still restoring from whatever you have, and the money arrives after the claim, which is after the assessment, which is after the incident report somebody has to write.

So transfer moves who pays. It does not move whether it happens or how long it lasts, and the register has to keep both halves apart or it begins to describe a company that does not exist.

Something people say

“We have cyber insurance, so that risk is covered.”

Why it spreads: It is the one treatment with a document and an invoice behind it. Reduce is a promise about future work, accept is an argument, avoid is somebody's revenue — and transfer arrives with a policy schedule you can attach to the row. Attaching something feels like finishing.
The part that is true: Insurance really does remove the part that would end you. The tail — the loss so large you could not fund it — is exactly what the product exists to take away, and for that job it works.

The policy is in place. What is the risk that remains on the row?

The contract version, which looks stronger and is usually weaker

The other way to hand something over is to put it in somebody else's contract. A supplier processes the data, the contract says they are responsible, and the row gets marked transfer.

Read the liability clause before believing the row. The cap in a supplier agreement is very often twelve months of fees. Pay them forty thousand a year and your recovery ceiling is forty thousand, against an exposure that has nothing to do with what you pay them.

And recovery is a lawsuit. A lawsuit is eighteen months and a relationship you no longer have, and at the end of it you have money rather than the eighteen months.

What the contract genuinely buys you is a named party with an obligation, an agreed standard to measure them against, and the right to ask them questions — which is worth having and is not the same as the risk having left.

Check

You mark a row transfer because a supplier now holds the data under contract. What should happen to the register?

The row closes. The data is somebody else's problem now.The row stays as written, with the treatment changed to transfer.The row is rewritten for the new path, and a second row appears about the supplier.The row moves to a supplier register kept separately.

Why transfer is the treatment auditors ask about mostOptional

Because it is the one with a document, and a document invites a question.

A row marked reduce points at a control, and the conversation is about whether the control runs. A row marked transfer points at a policy or a contract, and the conversation is about what that paper says — which is a conversation about wording, in a register written by people who did not write the wording.

The cheap preparation is to read the exclusions and the cap once, and write one line on the row saying what is and is not inside them. Nobody here can tell you how that line will be received. What it does is move the question from one you cannot answer in the room to one you can.

Worth remembering

Transfer moves who pays, never whether it happens or how long it lasts.
A policy is a limit, an excess, an exclusion list and a delay.
Insurance removes the tail, which is the part that would end you.
A supplier liability cap is often twelve months of fees.
Recovery under a contract is a lawsuit, and you get money, not time.
Handing a risk over creates a second risk: the counterparty.
A transferred row gets rewritten for the new path, never closed.