Advice For Cyber Insurance Buyers

The cyber insurance market continues to evolve, and the number of companies buying cyber insurance continues to expand. What’s more, that expanding cyber market offers a wide variety of coverage terms at different price points.

But companies interested in securing cyber insurance should know that the underwriting process requires careful diligence on their part. CFOs and risk managers need to have a firm grasp of the processes insurers use, not only to price a policy but also to determine whether they will agree to underwrite the risk at all.

One of the first steps in the underwriting process requires the company to submit an application to the insurer. The application will seek baseline information about the company’s size, number of records maintained, type of information maintained, security policies and procedures, and disaster planning.

The company’s ability to answer those questions with complete and detailed information is critical. Comprehensive answers can help ensure that the policy will be competitively bid by a number of insurers and secure the lowest premium pricing.

Underwriters will be most interested in companies that can communicate effectively that they know where their records are maintained and how many records are at risk. They’re also more open to companies that have implemented strong security measures to protect their records and minimise the likelihood of a breach.

Further, cyber carriers will also look for representations in their application about whether the corporation, and sometimes what’s termed “any insured” (which means all employees), has knowledge of claims, facts, or circumstances that can spawn a claim.

Some companies blunder by providing a response to that question without giving enough consideration as to who within the organisation is being asked to make that representation or on whose behalf the representation will be made. The consequence of failing to understand the importance of these requested representations can be severe.

For example, let’s look at the experience of a hypothetical credit card company which has just disclosed a hacking incident that compromised many customer email accounts several years ago. In its current disclosure, the company admitted that some of its employees, including senior executives and attorneys, knew about the breach at the time of the incident.

Even though the company had applied for and bought a cyber insurance policy late last year, coverage in this fact scenario could be seriously at risk. That’s because employee previous knowledge of the facts could lead to a claim by the insurer objecting to the fact that the company hadn’t disclosed that knowledge for several years.

Further, basing their claim on these facts, some insurers may seek to rescind the entire policy, asserting that a material misrepresentation was made in the application. In other words, insurers may argue that they have no coverage obligation for the undisclosed known breach or any other claims that may arise because the policy was issued under false pretenses.

“Meet and Greet” Underwriting

Once the application has been submitted, the underwriters may want direct access to the chief information officer or others responsible for protecting company information. Companies must understand that those individuals will play a key role in whether the insurer will agree to quote and/or how much will be charged to insure the risks.

But most CIOs and other “techies” aren’t familiar with the insurance procurement process and may not understand how information should be communicated to the insurer. To avoid missteps, companies should have a detailed planning meeting with representatives of the insurer along with the insurance broker and coverage counsel before information is relayed to the underwriter.

Finally, many insurers conduct their own diligence to evaluate whether to underwrite a risk and, if so, at what premium price point. Risk managers and CFOs should be aware that insurers are using a new type of metric to assess their companies’ cyber risk exposure. It’s called a “security score”, a concept akin to a credit score.

For example, BitSight Technologies is a risk assessment vendor that analyses companies for breach risk and response preparedness and assigns a security rating. According to its website, BitSight gathers data on security breaches from sensors deployed across the globe and uses algorithms to assess a company’s records management, encryption methods, and security vulnerabilities.

The firm then assigns a security rating and provides benchmarking information to demonstrate where the company falls short on the risk assessment spectrum. Companies on the lower end of the spectrum may not receive a quote for cyber insurance, while companies on the higher end may receive such better terms as lower premium or lower retentions. Companies looking to buy cyber coverage need to know that, in an important sense, they are not alone.

CFO:

For more information and help with your organisation’s security contact: Cyber Security Intelligence

You Might Also Read:

Five Pitfalls of Cybersecurity Insurance:

Cyber Crime Drives Up The Cost Of Insurance:

Cyber Should Be Standalone Insurance:

 

« Power Companies Cyber ‘Nightmare’
AI Meets Music’s Evolution »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Clifford Chance

Clifford Chance

Clifford Chance are one of the world's pre-eminent law firms with resources across five continents. Practice areas include Cyber Security & Information Protection

Lastline

Lastline

Lastline is the leader in advanced malware protection.

Boxcryptor

Boxcryptor

Boxcryptor encrypts your sensitive files before uploading them to cloud storage services.

CERT Bulgaria (CERT.BG)

CERT Bulgaria (CERT.BG)

CERT Bulfaria is the National Computer Security Incidents Response Team for Bulgaria.

Radar Cyber Security

Radar Cyber Security

Radar Cyber Security is the only European supplier of Managed Detection & Response who provides its services based on inhouse developed technology.

Bugcrowd

Bugcrowd

As leaders in crowdsourced security testing, Bugcrowd connects companies and their applications to a crowd of tens of thousands of security researchers to identify critical software vulnerabilities.

Cybersixgill

Cybersixgill

Cybersixgill was founded with a single mission: to protect organizations against malicious cyber attacks that come from the deep and dark web, before they materialize.

ANIS

ANIS

ANIS represents the interests of Romanian IT companies and supports the development of the software and services industry.

Bavarian IT Security Cluster

Bavarian IT Security Cluster

The Bavarian IT Security Cluster works to build regional IT security competencies and increase the competitiveness and market opportunities of its member companies.

SEPPmail

SEPPmail

SEPPmail is a patented e-mail encryption solution to secure your electronic communication.

Morphus Information Security

Morphus Information Security

Morphus is an information security company providing Red Team, Blue Team and GRC services as well as conducting research in cybersecurity and threat analysis.

Department of Justice & Equality - Cybercrime Division

Department of Justice & Equality - Cybercrime Division

The Cybercrime division is responsible for developing policy in relation to the criminal activity and coordinating a range of different cyber initiatives at national and international level.

ePlus

ePlus

ePlus designs and delivers effective, integrated cybersecurity programs centered on culture and technology, aimed at mitigating business risk and empowering digital transformation.

Nardello & Co

Nardello & Co

Nardello & Co. is a global investigations firm with experienced professionals handling a broad range of issues including Digital Investigations & Cybersecurity.

Primus Institute of Technology

Primus Institute of Technology

At Primus Institute of Technology our mission is to inspire, support, and empower current and aspiring IT professionals through training and career development workshops.

Triangle

Triangle

Triangle enable innovative business transformation by ensuring critical hybrid infrastructures are optimised, interoperable and secure.