A retailer buys cyber insurance for breach response costs while still maintaining its monitoring program. Which risk treatment is shown?