Mike Brown

Advisory Director, Security & Privacy Practice
Infotech

Your Challenge

The cyber insurance market continues to constantly evolve, and organizations are finding it difficult to adapt to changes in requirements and costs.

• Organizations must adapt their information security programs to accommodate insurance requirements.
• Organizations need to reduce insurance costs.
• Some organizations must find alternatives to cyber insurance.

Common Obstacles

Cyber insurance changes are meant to reduce the amount of risk taken on by insurance companies, often requiring change on the part of the insured.

• As the list of controls insurers want to see implemented grows, organizations may not know which ones to focus on and prioritize.
• Some organizations are seeing premiums that are prohibitively expensive, in many cases due to insufficient controls.
• Alternatives to cyber insurance are not always apparent.

Infotech’s Approach

Members should understand the needs of their organization when it comes to risk management, so they can plan an appropriate strategy.

• Understand risks and risk tolerance.
• Mature key information security controls.
• Understand the impacts of realized risk, cost of program maturation, and the benefits of having insurance in the event of an incident.
• Consider and pursue alternatives to cyber insurance.

First-party versus third-party

First-party insurance protects the organization from impacts that it directly suffers. First-party coverage usually covers costs arising from:

• Loss of income as a result of incident
• Expenses around customer notification
• Extortion/Ransomware
• Forensic investigative services
• Data and/or hardware restoration
• Reputational loss

Third-party insurance protects you from claims made against you by a third-party. This can include costs related to:

• Expenses as a result of lawsuits
• Costs for responding to regulatory inquiries
• Payments made to affected consumers
• Regulatory fines and financial penalties

Data breach versus cyber liability insurance

Data breach insurance protects organizations from impacts related to a data breach, whether the breach was a result of a cyber event or non-cyber event. While it does cover costs to the organization related to breach, it typically does not include protection from third-party claims.

Cyber liability insurance will protect organizations from impacts as a result of cyber risks and protect an organization from costs associated with claims made by a third-party.

Retention versus deductible

Both retentions and deductibles serve to keep more risk with the insured.

A retention is a monetary amount the organization must pay before the insurance company gets involved.

For deductibles, the insurance company provides coverage from the beginning, and will seek reimbursement for the deductible amount after the fact.

Threat and Risk Assessment Tool

Enhance your threat landscape assessment and begin a risk management program.

Business Impact Analysis Tool

Estimate your remediation costs to determine how much coverage you need.

BIA Scoring Context Example

Support your scoring development process with this example.

Cyber Insurance Controls Checklist Tool

Decrease insurance premiums by implementing the most common controls required by underwriters.

IT benefits

• Increased visibility into threat and risk exposure
• Assessment of necessary security controls
• Improved understanding of IT operation and recovery costs
• Enhanced insurance policy evaluation skills and outcomes
• Incorporation of new risk management strategies (i.e. via insurance)

Business benefits

• Estimates on total downtime and recovery costs to help guide IT risk decisions
• New options to help improve recovery times to limit lost revenue
• Added input from technology stakeholders during procurement and negotiation (in addition to Legal)
• Reduced fears for large-scale IT incidents (e.g. ransomware, data breach)