An insurer covers some financial loss from cyber incidents. What must the manager still assess?

1. That no security controls are needed after purchase
2. That every incident will be paid in full
3. Coverage limits, exclusions, control duties, and retained operational consequences
4. That insurance eliminates all security risk