The value and limitations of cyber insurance

What is cyber insurance?

A cyber insurance, also known as cybersecurity insurance, can cover certain direct and indirect damage caused by digital incidents. Think of costs for incident response, research, recovery, legal support, communication, corporate damage or liability. The exact coverage varies by insurer and policy.

The NCSC stresses that there is no uniform definition of a cyber insurance. Therefore, check existing insurance. Some cyber-related damage may already be covered by a different policy or part of it, while others are explicitly excluded.

Use a cyber insurance as a conscious form of risk transfer. A quantified risk register and clear treatment choices help determine which coverage, limits and conditions fit the organisation.

Why cyber insurance is sometimes taken out too quickly

In my work I regularly see that cyber insurance is taken out without prior careful risk analysis. The organisation then purchases cover before it is clear which business processes are critical, which scenarios have the greatest financial impact and which risk is actually transferred.

That's a missed opportunity. You can only spend budget once. A broad policy can cost money for risks that the organisation itself can manage properly, while a relevant scenario is not adequately covered or can only be covered by additional coverage.

Is cyber insurance necessary?

The answer depends on the dependence of digital systems, the possible business impact, available financial reserves, contractual obligations and the risk appetite of the board and executive management. For a digitally dependent organisation, a serious incident can lead to substantial recovery costs and long-term business break.

Insurance can transfer part of these financial consequences and give access to specialised assistance. The policy shall not take over operational responsibility, board-level consideration and need for appropriate security measures. The organisation itself remains responsible for preparation, prevention and a reliable application.

• How long can the organisation function without critical systems or data?
• What maximum financial damage can the organisation itself bear?
• Which incident aid is available immediately?
• What risks are already covered by existing insurance?
• What residual risks does the board deliberately want to transfer?

What does cyber insurance cover?

The coverage of a cyber insurance scheme for companies may contain several parts. The policy conditions determine which events, costs and limits apply. Therefore, do not compare insurance on premium only.

Discuss the direct costs, business damage and liability covered by the relevant scenario. Also look at waiting times, own risk, maximum fees and the parties that may be involved in an incident.

• Digital forensic analysis and incident response
• restoration of systems, configurations and data
• business damage and additional costs during breakdown
• legal support and notification of data leaks
• liability to customers and other stakeholders
• crisis communication and reputation support
• cyber extortion, fraud and incidents involving suppliers

The amount insured shall not automatically apply to any cyber incident

A high amount of insurance at the top of the policy does not say much about the compensation in case of a specific incident. For example, social engineering, cyber theft, extortion, telecom fraud or failure with an external IT service provider may be subject to lower sub-limits. These amounts are often also within the maximum total that the insurer pays out in one insurance year.

Therefore, do not compare policies on the total insured amount alone. Explain the scenarios of risk analysis in addition to coverage and assess, per scenario, the extent of damage that the organisation can suffer and the amount actually available. For example, an organisation can be heavily dependent on one SaaS supplier, whereas the limit for failure at that supplier is much lower.

• the total insured amount per year
• sub-limitations per cause of injury or type of cost
• own risk by scenario
• the maximum duration of benefits in the case of occupational damage
• the combination of multiple costs within the same annual limit

The small print determines the actual value

The AFM concluded that cyber insurance is difficult to compare due to the complexity of the risk and the conditions. That is precisely why the policy, annexes and application declarations deserve board-level attention before an insurance policy is concluded.

Certain events or costs may fall outside standard coverage, have a lower sub-limit or be insured only after additional agreements. Preventive requirements may also apply. Incomplete or outdated security information can cause discussion in case of damage.

• What security measures are required and how is their operation proven?
• What exclusions, waiting times and sub-limitations apply per scenario?
• Have fraud, social engineering, ransomware and vendor incidents been included?
• What is the reporting period for an incident and what emergency workers are prescribed?
• What changes in systems, turnover or risk profile are subject to an interim reporting obligation?
• Do existing policies connect or create gaps and double coverage?

Provenly in order to prevent

Cyber insurance usually imposes conditions on the establishment of information security. Think of multifactor authentication, current backups, endpoint security, patch and vulnerabilities management, supported software, secure external access and a tested incident response plan. In the case of fraud, an authorisation matrix, the four-eyed principle and a fixed payment protocol may also be important.

The application is therefore more than an administrative questionnaire. Provide correct, complete and up-to-date answers. Also check how concepts are defined in the application. For example, multifactor authentication may be required not only for Microsoft 365, but also for management accounts, VPN, cloud management and other external access.

If a mandatory measure is missing or not working, it may have an impact on coverage if the defect is linked to the incident. Therefore, define the requirements, who owns and how the operation is periodically monitored.

Withdrawal periods may leave the first hours of operating damage at their own expense

In case of cover for business break, a waiting period often applies. Damage in the first hours after the failure can therefore remain wholly or partially on the organisation's behalf. In addition, the period over which turnover losses and additional costs are reimbursed may be limited.

Pre-determine how quickly an incident has financial consequences. A waiting period that seems logical for an organisation that can emigrate one day may be unsuitable for a company where production, care or transaction processing is instantly stopped.

Accident costs can quickly reduce the amount insured available

After a cyber incident, multiple costs often arise at the same time: Forensic research, legal advice, repair work, crisis communication, privacy guidance, notifications and liability defence. Check that these costs are reimbursed on top of the insured amount or come from the same annual ceiling.

If all costs apply the same limit, less cover may remain for business losses or a second incident in the same insurance year. Therefore ask how the remaining insured sum is calculated and whether the limit can be recovered after a damage.

What happens to cyber insurance after a claim?

Cyber insurance does not automatically stop after a benefit. The consequences depend on the policy and the extent of the claim. The annual insured amount may be used up or partially. Conditions may also apply for continuation, termination, remedial measures or re-availability of coverage.

Therefore, let us explain in advance how much coverage remains after a claim, whether the insurer can cancel in the meantime and what obligations apply after an incident. It is precisely after a great deal of damage that clarity about continuity of insurance is important.

Cyber insurance and board member liability cover different interests

Cyber insurance focuses on the impact of the incident on the organisation, such as recovery, business interruption, incident response and certain forms of liability. Board member liability insurance may become relevant when board members are personally addressed to alleged shortcomings in oversight, decision-making or risk management.

The policies don't replace each other. Check how cyber incidents, investigations, defense costs and claims against board members connect. This is particularly relevant as the Dutch Cybersecurity Act more explicitly acts on board-level responsibility, risk management and training.

Why do we need to start carrying out a risk analysis of information security?

A risk analysis information security begins with critical processes, crown jewels and dependencies of the organisation. After that, realistic scenarios are developed and weighed on probability, impact and existing control. This creates a well-founded picture of gross and residual risk.

With that image, the board can make targeted treatment choices. The organisation will then know which risks are reduced by measures, which are consciously accepted and which are transferred to an insurer.

• a quantified risk register
• view of critical processes and possible business damage
• existing measures and residual risks in conjunction with
• treatment choices, owners and decision-making moments
• a substantiated question to insurer or consultant

Four options for cyber risk treatment

Insurance is one of the possible treatment options. The Board shall assess the appropriate and affordable combination per risk. Insurance works best as a final part of that consideration.

• Treat: reduce the probability or impact with targeted measures.
• Accept: the residual risk is deliberately identified and periodically re-evaluated.
• Transfer: transfer a financial part of the risk by contract or insurance.
• Avoid: Stop an activity or choose another device.

Can risk analysis reduce the premium of a cyber insurance?

Risk analysis does not guarantee a lower premium. It does help to avoid unnecessary or double coverage and to better underpin the desired insured sum, own risks and additional coverage.

demonstrable security measures and a clear risk profile can also contribute to insurability and possibly to more favourable conditions. The final premium remains dependent on, among other things, sector, turnover, incident history, security level, coverage and current insurance market.

Checklist for the board and management before closing

Treat cyber insurance as an board-level risk choice. Please establish the balance and assumptions, so that it is clear later on why these cover and conditions were chosen.

• What specific scenarios do we want to ensure and which remain on our own account?
• What maximum damage and drop-out period follow from our risk analysis?
• What sub-limit apply to cloud suppliers, cyber extortion, fraud and social engineering?
• What are the own risks, waiting periods and maximum periods of benefits?
• Are privacy liability, network security, incident response and forensic research appropriately covered?
• What are the prevention conditions and can we make it work?
• Are the answers in the application complete and do definitions correspond to our technical environment?
• What reporting periods and approved incident response providers prescribe the policy?
• What exclusions apply to outdated, unsupported or unpatched systems?
• Do incident costs use the same annual limit as business damage and liability?
• What happens to the remaining coverage and the policy after a large claim?
• How does cyber insurance link up with fraud, liability and board member liability insurance?
• Who checks annually whether coverage, organisation and risk picture still fit?

A cyber insurance as a conscious risk choice

Appropriate cyber insurance can increase financial resilience and allow access to valuable expertise during an incident. The policy provides the most value when it is in line with current risk analysis, realistic scenarios and demonstrable security measures.

So start with the organisation and its risks. Then decide what consequences you can bear and what residual risk you want to transfer. This makes cyber insurance a well-founded treatment choice rather than a general reassurance.