Sepay Technologies Ltd., a Pune-based multinational IT services firm, had earned a reputation for its cutting-edge solutions in cloud computing and artificial intelligence. With over 12,000 employees and clients in 25 co

Sepay Technologies Ltd., a Pune-based multinational IT services firm, had earned a reputation for its cutting-edge solutions in cloud computing and artificial intelligence. With over 12,000 employees and clients in 25 countries, the Company was considered a trusted partner in digital transformation initiatives. The Company had good processes and procedures in place which would help them navigate any unforeseen circumstances. In March 2025, Sepay faced a critical challenge when a sophisticated ransomware attack locked its central client management system. Payroll operations were stalled, sensitive customer data was at risk and employees could not access emails or work files for the first 48 hours, leading to widespread panic. The Board immediately activated the Crisis Management Plan (CMP). A cross-functional crisis committee, including finance, HR, IT, and marketing heads, was tasked with responding. The Finance Manager ensured emergency funds were released to hire external cybersecurity experts and kept regulators informed to maintain compliance. HR focused on employee morale, establishing alternative communication channels and ensuring salaries were processed via backup systems. Marketing and PR teams communicated proactively with clients, mitigating reputational risk. Simultaneously, the Business Continuity Plan (BCP) was implemented. Sepay had previously identified critical functions client support, payroll and internal communications as "essential services." Within 72 hours, makeshift systems supported priority client accounts. Off-site data backups enabled partial restoration of operations. The BCP also guided coordination with vendors and cloud service providers, minimizing disruption in client service delivery. The Disaster Recovery Plan (DRP) proved equally crucial. It outlined steps to restore IT infrastructure and mitigate technical losses. The IT team, working with external experts, isolated infected systems, cleaned servers and restored data from secure backups. Thanks to these coordinated efforts, Sepay was able to restore 80% of operations within two weeks, regaining client confidence. This incident highlighted the interdependence of CMP, BCP, and DRP. While the CMP enabled immediate decision-making and communication, the BCP ensured business continuity and the DRP provided technical restoration. Post-incident, the Board recognized the need to strengthen client communication and conduct regular simulation testing. The cyberattack became a turning point for Sepay. The Company institutionalized quarterly simulation drills, upgraded data security protocols and refined the CMP to include social media crisis management. Leadership acknowledged that without these pre-designed frameworks, Sepay's reputation and financial stability could have suffered irreparable damage. There was a detailed discussion about the event and the risks being addressed. One of the board members suggested that, risk transfer should be considered rather than risk reduction. Further the Board and the management were keen to appoint a consultant who would do a risk analysis and submit a detailed report highlighting various aspects of governance risks as well. One of the directors, who was on Board of another conglomerate, mentioned to the board members that the risks are not limited to cyber security risk or governance risks alone, they even include climate risk. In the background of above facts, answer the following questions: Distinguish between risk transfer and risk reduction.