Meeting the New Cyber Insurance Requirements

In the event of a cyberattack, companies – especially small to mid-sized businesses – often face losses so great they risk pulling their business under. With the number of ransomware attacks, phishing schemes, and data breaches on the rise, it only makes sense that business leaders and owners take steps to protect their businesses by investing in insurance – the same way they would protect company property and assets.

Cyber insurance, or cyber liability insurance, is a specialty insurance that aims to cover the financial losses that organizations have as a result of ransomware attacks, data breaches, and other cyber incidents. Not only can having cyber insurance lessen the financial impact of a cyberattack, but it can also help organizations with legal fees, crisis communications work, system recovery, investigations went wrong, and more.

This begs the question: if cyber insurance helps that much, why doesn’t everyone just invest in a policy? Well, it’s not that simple. In response to the growing frequency of cyber threats, cybersecurity insurers have significantly revised their policies. Insurers are now requiring businesses to demonstrate not just the presence of cybersecurity protocols but also their effectiveness and ongoing maintenance. Failure to do so could result in denied claims, leaving businesses exposed during a cyber event and costing them financially. 

So, is it worth it? And how can companies meet these new requirements to ensure continued coverage? Below, we discuss the importance of cyber insurance and how to ensure ongoing protection for you and your business.

The Risks of Not Being Covered

Some new requirements that have become popular in cyber insurance agreements include comprehensive security measures like advanced threat detection, regular vulnerability assessments, and a robust incident response plan. All of these items, on top of regular cybersecurity systems and services, obviously add up, leaving many to wonder if the investment to then pay into an insurance policy makes much financial sense.

However, the financial risk of not doing so may be even greater. Without cyber insurance, a company faces the full financial impact of a cyberattack, including costs associated with data breaches, ransomware payments, legal fees, regulatory fines, and the expense of restoring compromised systems. These expenses can quickly pile up, potentially leading to financial strain or even bankruptcy, particularly for small to mid-sized businesses. Additionally, the lack of cyber insurance can damage a company’s reputation, as clients and partners may lose trust in an organization that is unprepared to handle cyber threats. Without the safety net of insurance, businesses are left vulnerable to the escalating threats in today’s digital landscape, with little recourse for recovery if an attack occurs.

Meeting Insurance Policy Requirements

The first step to ensuring a business meets any policy requirement is to understand the full picture of its security systems by conducting an audit. By doing this, companies get visibility into the state of their cybersecurity policies, tools, and strategies, where there may be vulnerabilities that need to be addressed, and their overall security posture. These audits are often led by the CISO and can include conducting a cybersecurity risk assessment or tracking against another measure of Key Performance Indicators (KPIs), such as Mean Time to Detect (MTTD) and Mean Time to Acknowledge (MTTA).

Once the audit is complete, looking at internationally or nationally recognized standards and best practices and aligning closely with those can help not only meet requirements but ensure better cybersecurity hygiene overall. For example, the CIS 18 Critical Security Controls offers a roadmap for businesses to bolster their security posture and recommends implementing multi-factor Authentication (MFA), incident response planning, data encryption, patch management plans, and regular vulnerability assessments and penetration testing. After these steps are taken, organizations must review their existing plans and protocols – as well as any gaps discovered – against any specific criteria laid out by insurers to ensure that they’re meeting minimum security requirements for coverage.

The Proof of the Pudding is in the Eating

Once the right tools, people, and protocols are in place, companies are then faced with the challenge of demonstrating they meet requirements and have taken steps to align with the policy the insurer laid out. Currently, there are limited ways in which businesses can prove their cybersecurity stack has been set up correctly and protects their systems from risk without an actual attack occurring (which would not be ideal for either party). Insurance providers must rely on businesses to do their due diligence and test their systems on a regular basis.

As CIS 18 recommends, conducting regular vulnerability and penetration tests are good options to show that the risk for an attack is low. Not only do these tests present viable results, but they also continually benefit the organization conducting them, giving them a sense of what protocols are working and what else needs to be prioritized when it comes to security.

The other thing to keep in mind is that as threats evolve, so too will cyber insurance requirements.

 Those in charge of cyber insurance policies should stay informed about the evolving standards insurers are implementing and stay up to date to ensure no claims get rejected. Consulting with a cybersecurity expert or managed services provider for a third-party audit can provide an unbiased evaluation of potential security risks and weaknesses and help businesses align their practices with the latest requirements, ensuring they are fully covered in the event of a cyberattack.

Buying a cyber insurance policy may not be simple, but for businesses, it should be a no-brainer. The level of protection offered should something go wrong far outweighs the risk of dealing with an incident alone. While there are many steps to take to get full coverage and avoid claim rejection, going through the process ultimately improves the security posture of the organization and ensures better cyber hygiene and protection no matter what may come.