Cyber Insurance May Be Worth Evaluating and Here Are Some Items to Consider When Doing So

There is some debate about the usefulness of cybersecurity insurance. Many excuses cited for this have been given, from its high costs, to confusion over what it does cover, and confidence that their organization just won’t suffer from an attack, so why have that expense? However, while not specifically endorsing it, the Department of Homeland Security thinks it may be a worthwhile item to have in the budget and is working with various groups including those in academia, risk managers, insurers, chief information security officers (CISOs), and chief information officers (CIOs) to find a way to encourage businesses to improve their cybersecurity in exchange for affordable coverage.

Cybersecurity insurance, like other types of insurance is designed to mitigate losses. In this case, those losses would be from cyber incidents such as data loss from theft or destruction, business interruption, network damage, and/or extortion, for example. In some cases, they even help protect against character defamation.

According to the Ponemon Institute in its 2015 Cost of a Data Breach Report, a cyber insurance policy can reduce the cost of a data breach by $4.40 per record.

While interest in having this type of policy is growing, per a study by Hartford Steam Boiler Inspection and Insurance Company, 30% of businesses still do not have it. Among those, 44% cited that the complexity of it is the top reason they haven’t pulled the cyber insurance trigger.

There are some things to consider when evaluating it:

• Make sure to get your cybersecurity team involved in evaluating and purchasing this type of insurance. They know what risks that your organization faces and can give you a better idea of what type of coverage is worthwhile and what is not.
• Make sure the policy covers third-parties. It is not unusual to have cloud providers and consultants and contractors hook into your network. Make sure any mistakes by them are covered too.
• As with auto insurance, you should make sure that your policy will cover providers of your choosing. Sometimes, they may stipulate that you use their preferred data breach response and cyber incident response providers. If your choice is among them, then there is no problem.
• Pay attention to any exclusions and deductibles. Overall, most breaches are still small and don’t warrant news coverage. Make sure you understand your risk and if the policy excludes small breaches, keep looking. While you’re at it, get specifics on what they call “small.”
• Work with a knowledgeable broker on the various policies and coverage and make sure you are getting the best rate for your needs.

And most importantly of all, reduce your risk in the first place by ensuring you have good cybersecurity policies and processes in place. The stronger those are, the better case for good rates. In fact, Homeland Security is trying to work with those previously mentioned groups to determine what are good cybersecurity practices so that insurers will be motivated to provide less expensive coverage to companies who have them in place.

So while a data breach is likely for most companies, there is no need to let it destroy your organization financially. Take some time to evaluate cybersecurity insurance to determine if it is right for your organization. In some cases, it might not be, but it is probably worth the time to figure it out.