After conducting a qualitative risk assessment of her organization, Maria recommends purchasing cybersecurity breach insurance. What type of risk response behavior is she recommending?

Purchasing insurance is a means of transferring risk. If Maria had worked to decrease the likelihood of the events occurring, she would have been using a reduce or risk mitigation strategy, while simply continuing to function as the organization has would be an example of an acceptance strategy. Rejection, or denial of the risk, is not a valid strategy, even though it occurs!