An organization wants to share the financial consequence of a ransomware event by purchasing cyber insurance. Which option most accurately reflects the limits of this sharing approach in an ISMS?

• A.Insurance eliminates the underlying risk so no other controls are ever needed, since the financial transfer typically resolves everything automatically
• B.Insurance converts the risk into an opportunity automatically, so no further treatment is typically required
• C.Insurance transfers reputational or operational harm fully to the insurer, so no other controls are typically necessary
• D.Insurance can transfer some financial consequences but not the reputational, legal, or operational impacts, so other controls usually remain necessary