Case 3 - The Risk That Was 'Transferred' and Closed
Harlow & Finch is an online retailer with €85 million turnover. It outsources card processing to a payment service provider (PSP) under a contract with a 99.9% availability SLA, a €2 million liability cap and a cyber-insurance policy covering the retailer's own losses up to €5 million. Following the PSP's breach, 300,000 customer card records were exposed. The retailer suffered no direct ransom cost, but card schemes levied €600,000 in scheme fees, the site was down for nine hours, and 4% of customers churned. The risk register entry 'card data breach at PSP' had been closed 18 months earlier with the note 'transferred to PSP and insurer - residual risk: none'. Losses are still being quantified; the insurer has reserved judgment pending its own investigation. The board now asks whether transfer failed.
1. Was the risk transferred? Explain using ISO/IEC 27005 treatment concepts.
Read the worked answer
Only part of the financial consequence was shared. Risk sharing or transfer moves some consequence to another party - here the PSP's €2 million liability cap and the cyber policy covering the retailer's own losses - but it does not move the risk itself, the accountability of the risk owner, or consequences that cannot be contracted away: card scheme fees, churn, regulatory scrutiny and reputational damage.
The register note 'residual risk: none' was therefore wrong on its face. A transfer always leaves residual risk made up of uninsured and uninsurable elements, deductibles, exclusions, counterparty failure, disputes and timing. The insurer reserving judgment illustrates the point precisely: cover is a claim, not a certainty.
The entry was also closed rather than monitored, although the supplier's controls and the adequacy of the contract change over time. The correct handling is to keep the risk open with an owner, record the treatment, assess and document residual risk, and monitor the supplier and the policy.
2. What should the register have contained, and who accepts the residual risk?
Read the worked answer
A scenario - card data held at the PSP exposed through the PSP's systems - with consequence dimensions (customers affected, scheme fees, regulatory exposure, reputational harm), likelihood with a time horizon, and the existing controls: contractual security requirements, right to audit, SLA, liability cap and insurance. Each control's effectiveness should be assessed rather than assumed, and residual risk expressed as a value or range with its basis.
The entry should name a risk owner, typically a senior manager accountable for the payment relationship, and record a risk acceptance decision at the authority level matching the residual value, with conditions and a review date. Monitoring evidence would include assurance from the PSP - audit reports and the scope of any certification - plus periodic re-evaluation.
The board, or the delegate named in the risk criteria, accepts residual risk; the CISO advises but does not own a business risk. Acceptance should state when it expires or becomes invalid.
3. The insurer disputes cover, arguing the retailer failed to patch its own systems. What does this change?
Read the worked answer
It changes the assessment of control effectiveness, not the risk criteria. Insurance had been treated as a certain mitigation; the dispute shows it is conditional on the retailer meeting its own obligations - patching, access control, accurate information in the proposal.
The organisation should reassess residual risk upward until the claim is resolved; verify that the controls the policy depends on are actually operating and record that dependency; review every other risk where insurance was the sole or main treatment; check whether the contractual allocations with the PSP, including the cap and any indemnities, are enforceable; and update the treatment plan with additional reduction measures rather than assuming transfer will respond.
This is monitoring and review in practice: the control environment and the assumptions behind the evaluation changed, so the evaluation must be revisited and the acceptance decision re-taken.