Advice For Cyber Insurance Buyers

The cyber insurance market continues to evolve, and the number of companies buying cyber insurance continues to expand. What’s more, that expanding cyber market offers a wide variety of coverage terms at different price points.

But companies interested in securing cyber insurance should know that the underwriting process requires careful diligence on their part. CFOs and risk managers need to have a firm grasp of the processes insurers use, not only to price a policy but also to determine whether they will agree to underwrite the risk at all.

One of the first steps in the underwriting process requires the company to submit an application to the insurer. The application will seek baseline information about the company’s size, number of records maintained, type of information maintained, security policies and procedures, and disaster planning.

The company’s ability to answer those questions with complete and detailed information is critical. Comprehensive answers can help ensure that the policy will be competitively bid by a number of insurers and secure the lowest premium pricing.

Underwriters will be most interested in companies that can communicate effectively that they know where their records are maintained and how many records are at risk. They’re also more open to companies that have implemented strong security measures to protect their records and minimise the likelihood of a breach.

Further, cyber carriers will also look for representations in their application about whether the corporation, and sometimes what’s termed “any insured” (which means all employees), has knowledge of claims, facts, or circumstances that can spawn a claim.

Some companies blunder by providing a response to that question without giving enough consideration as to who within the organisation is being asked to make that representation or on whose behalf the representation will be made. The consequence of failing to understand the importance of these requested representations can be severe.

For example, let’s look at the experience of a hypothetical credit card company which has just disclosed a hacking incident that compromised many customer email accounts several years ago. In its current disclosure, the company admitted that some of its employees, including senior executives and attorneys, knew about the breach at the time of the incident.

Even though the company had applied for and bought a cyber insurance policy late last year, coverage in this fact scenario could be seriously at risk. That’s because employee previous knowledge of the facts could lead to a claim by the insurer objecting to the fact that the company hadn’t disclosed that knowledge for several years.

Further, basing their claim on these facts, some insurers may seek to rescind the entire policy, asserting that a material misrepresentation was made in the application. In other words, insurers may argue that they have no coverage obligation for the undisclosed known breach or any other claims that may arise because the policy was issued under false pretenses.

“Meet and Greet” Underwriting

Once the application has been submitted, the underwriters may want direct access to the chief information officer or others responsible for protecting company information. Companies must understand that those individuals will play a key role in whether the insurer will agree to quote and/or how much will be charged to insure the risks.

But most CIOs and other “techies” aren’t familiar with the insurance procurement process and may not understand how information should be communicated to the insurer. To avoid missteps, companies should have a detailed planning meeting with representatives of the insurer along with the insurance broker and coverage counsel before information is relayed to the underwriter.

Finally, many insurers conduct their own diligence to evaluate whether to underwrite a risk and, if so, at what premium price point. Risk managers and CFOs should be aware that insurers are using a new type of metric to assess their companies’ cyber risk exposure. It’s called a “security score”, a concept akin to a credit score.

For example, BitSight Technologies is a risk assessment vendor that analyses companies for breach risk and response preparedness and assigns a security rating. According to its website, BitSight gathers data on security breaches from sensors deployed across the globe and uses algorithms to assess a company’s records management, encryption methods, and security vulnerabilities.

The firm then assigns a security rating and provides benchmarking information to demonstrate where the company falls short on the risk assessment spectrum. Companies on the lower end of the spectrum may not receive a quote for cyber insurance, while companies on the higher end may receive such better terms as lower premium or lower retentions. Companies looking to buy cyber coverage need to know that, in an important sense, they are not alone.

CFO:

For more information and help with your organisation’s security contact: Cyber Security Intelligence

You Might Also Read:

Five Pitfalls of Cybersecurity Insurance:

Cyber Crime Drives Up The Cost Of Insurance:

Cyber Should Be Standalone Insurance:

 

« Power Companies Cyber ‘Nightmare’
AI Meets Music’s Evolution »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

NCC Group

NCC Group

NCC Group is a global cyber and software resilience business operating across multiple sectors, geographies and technologies.

Morgan Lewis Law

Morgan Lewis Law

Morgan Lewis is an international law firm with offices in North America, Europe, Asia, and the Middle East. Practice areas include Privacy and Cybersecurity.

Cigniti Technologies

Cigniti Technologies

Cigniti Technologies provides Independent Software Testing (IST) Services including software security testing.

Security Audit Systems

Security Audit Systems

Security Audit Systems is a website security specialist providing website security audits and managed web security services.

Oodrive

Oodrive

Oodrive is the first trusted European collaborative suite allowing users to collaborate, communicate and streamline business with transparent tools that ensure security.

Search Guard

Search Guard

Search Guard® is an Open Source security suite for #Elasticsearch and the entire #ELK stack that offers encryption, authentication, authorization, audit logging and multi tenancy.

TechRate

TechRate

Techrate is an analytics agency focused on blockchain technology and engineering. Or expertise includes security and technical audits of projects.

Bionic

Bionic

Bionic is an agentless way to get control over your increasingly complex applications so you can manage, operate, and secure them faster and more efficiently.

BCN Group

BCN Group

BCN Group is an agile IT solutions provider. We are experts in delivering and managing business-critical technology solutions.

Centraleyes

Centraleyes

Centraleyes (formerly CyGov) is a cutting-edge integrated cyber risk management platform that gives organizations unparalleled understanding of their cyber risk and compliance.

Content+Cloud

Content+Cloud

Content+Cloud is a leading technology services business and Managed Services Provider (MSP) with a genuine passion for helping your organisation to succeed, whatever your ambitions.

PCS Security (PCSS)

PCS Security (PCSS)

PCS Security provides secure, reliable and state-of-the-art security solutions to help our customers address their security concerns.

Netgo

Netgo

Netgo group meet the requirements of a complex, digitized world with IT consulting, IT solutions & services, managed & cloud services and software products & development.

Flexxon

Flexxon

Flexxon is the industry leader to develop NAND flash storage devices. Our key focus is to innovate memory devices ensuring data security and reliability.

Dapple Security

Dapple Security

Dapple Security is creating cutting edge technology utilizing responsible biometrics that protects people and privacy through a first-of-its-kind passwordless platform.

SPYROS Information & Technology Consulting

SPYROS Information & Technology Consulting

SPYROS specializes in providing highly qualified professionals in Computer Network Operations, Signals Intelligence, Technical Training and Certifications, Network Administration and Security.