June 16, 2022 By Sue Poremba 3 min read

Before leaving on an extended (and expensive) vacation, I bought travel insurance. I wanted to protect myself in case I or my traveling partner tested positive for COVID-19. I had to answer a number of questions about my eligibility for such insurance before they would approve me. Nor did the insurance come cheap, but I wanted to protect myself and recover most of my expenses if my trip was canceled.

Insurance is a necessary expense if you want to protect your assets. But, to purchase the insurance you need to meet certain criteria. This is mandatory for health, vehicle, life, business insurance and so on.

As organizations face increasing numbers of cyber threats, cyber insurance is becoming a vital need. It’s a good way to protect against financial loss if there is a data breach or ransomware attack. However, just as you would have to pass a physical and meet certain requirements for life or health insurance, your cybersecurity system will have to undergo its own physical of sorts. Cyber insurers require businesses to meet certain standards and practices before approving a policy.

What cyber insurers want to see

Most insurance rules fall into basic cybersecurity measures, Jack Kudale, founder and CEO of Cowbell Cyber, an AI-powered cyber insurance company for small and medium-sized businesses, explained in an email interview. What insurers want to see are fairly standard best practices, such as multi-factor authentication (MFA), incident response plans and patching processes.

“We are seeing a significant shift where companies are now using cyber insurance requirements to build a compelling business case for higher priority and investment in cybersecurity,” Kudale said. “This can really become a win-win for all, as companies will easily become more secure and resilient to cyberattacks.”

There are specific types of attacks and threats that cyber insurers want to see addressed. According to Risk Strategies’ State of the Market 2022 Report, cyber insurance carriers are looking more closely at cyber risks caused by ransomware attacks, stricter government and industry regulations, weaknesses in the cloud and disruptions to the supply chain.

The pandemic increased cyber risk, the report warned, because of the greater reliance on technology to keep business running smoothly across a remote workforce. This increased risk led to higher insurance payouts, so cyber insurers need to protect their own interests. This is why they have set a higher standard for organizations to meet to be eligible for cyber insurance.

“It is important for businesses to use proprietary assessment tools to identify risk management controls that are deficient to their peer group,” Rob Rosenzweig, National Cyber Risk Practice for Risk Strategies, wrote in the report. Businesses should work closely with insurance brokers, Rosenzweig added, to ensure risk control standards are followed.

Best practices for cyber insurance

Companies that have a mature cybersecurity system should be ready to meet the requirements set by cyber insurers. Others with less mature systems or that have struggled to meet risk assessment goals during the pandemic will need to be more proactive. However, any company can benefit from conducting a risk assessment when applying for or updating cyber insurance contracts.

“One benefit of a risk assessment conducted for cyber insurance is that it covers all facets of risk exposures: technology, processes and people,” said Kudale.

Consider checking the following before you look for cyber insurance:

  • Conducting an intensive data inventory to know where data lives, where you store it and how you use it
  • Ensuring you have MFA set up
  • Taking a closer look at how you conduct backups. Are they done daily? Are they segmented from the network? Will you be able to put the backup into place quickly if a ransomware attack or other outage causes downtime?
  • Setting up a patching schedule and controls to make sure patches and updates aren’t ignored
  • Updating the incident response plan
  • Deploying regular security awareness training for employees
  • Setting up a least-privileged access model to prevent unauthorized users from causing cyber incidents and data breaches
  • Updating encryption processes.

The good news

According to NetDiligence’s Cyber Claims Study 2021 Report, an interruption in business due to a cyber incident can cost a company hundreds of thousands of dollars, including recovery expenses. Fines and fees surrounding exposed records cost companies close to $1 million. As the number of cyber incidents increases, so will the cost to insure the business losses. It’s no wonder cyber insurance companies are looking to protect themselves.

There’s good news. The more your organization does to meet the requirements set up by cyber insurance companies, the more protection you’ll have. And that means your insurance will be a small expense toward protecting your assets.

More from Data Protection

Overheard at RSA Conference 2024: Top trends cybersecurity experts are talking about

4 min read - At a brunch roundtable, one of the many informal events held during the RSA Conference 2024 (RSAC), the conversation turned to the most popular trends and themes at this year’s events. There was no disagreement in what people presenting sessions or companies on the Expo show floor were talking about: RSAC 2024 is all about artificial intelligence (or as one CISO said, “It’s not RSAC; it’s RSAI”). The chatter around AI shouldn’t have been a surprise to anyone who attended…

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

How data residency impacts security and compliance

3 min read - Every piece of your organization’s data is stored in a physical location. Even data stored in a cloud environment lives in a physical location on the virtual server. However, the data may not be in the location you expect, especially if your company uses multiple cloud providers. The data you are trying to protect may be stored literally across the world from where you sit right now or even in multiple locations at the same time. And if you don’t…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today