Cybersecurity Insurance: Once Optional, Now Essential

Conduct a business impact analysis (BIA). It is imperative to understand the risks you face and quantify the impact various cyberattacks could have on the resiliency of the business. Ideally, the business impact analysis is governed by senior-leadership and includes representatives from IT, operations, finance, compliance, legal, human resources, marketing, public relations, any other key business unit leaders, and the board. This analysis effectively weighs the merits of different approaches to cybersecurity insurance.

Closely review cybersecurity insurance policies. In the face of cyber risks that can shutter otherwise healthy companies, underwriters are adding addendums and dependent clauses that policy holders must comply with. Far too many businesses find out after an attack that they didn’t satisfy the requirements of the insurance company’s contract and are on their own. Make sure to also look for more stringent rules on how quickly a breach must be reported. This is where organizational collaboration is required, as a CFO, a CIO, and legal counsel may evaluate insurance policies through different lenses.

Talk with a broker. It is important to stay informed of new cybersecurity options. Enterprises should also explore the merits of various approaches. For example, it is worth considering a hybrid approach in which your budget is strategically divided, with some spend invested into commercial insurance and some reserved for self-insurance. When purchasing a policy make sure to get several estimates. There is significant variability across plans and payers.

Make sure to baseline with standards and hold your vendors accountable (as well). Proactively implementing a control environment in line with industry accepted standards can significantly reduce your premiums. For those in regulated industries, it is imperative to remain in compliance with new and evolving regulations, for example the Securities and Exchange Commission’s rules finalized this summer. Business leaders in non-regulated industries should absolutely make sure they are meeting baseline standards like ISO 2700, NIST-CSF, SOC, HiTRUST, or PCI-DSS. While not bulletproof alone, in the face of them, attackers will often move on to less protected targets. This is why it is important that any vendors connected to your network should also be vetted to ensure they meet these fundamental standards.

Conduct a security assessment with a third party. We don’t know what we don’t know. Make sure to regularly get an external assessment before the insurance company’s own assessment. Insurance companies will often assess when the policy is created or when it is up for renewal. This includes looking at the security technology you have in place, privacy policies, governance, incidence response, employee training, encryption, vendor management, patch management and penetration testing to name a few. Having an annual independent assessment of your controls environment not only helps business leaders sleep at night, but it can also significantly affect premiums.