Ferma concerned that buyers’ view missing from EU cyber insurance report

Ferma has welcomed the publication of an EU report on standardising various aspects of cyber insurance, but “regrets” that the voice of buyers is not represented, with evidence gathered only from the insurance industry. In particular, Ferma is concerned that the Commonality of Risk Assessment Language in Cyber Insurance report by the European Union Agency for Network and Information Security (ENISA), does not reflect its view that any cyber insurance buying process needs to begin with an in-depth risk assessment at potential buyer organisations. Ferma is pressing ENISA to support the cyber risk assessment processes and exchange of information between insurers and insureds, as well as comparisons of cyber insurance based on the views of insureds, to improve the cyber insurance market. ENISA’s report, published on 15 November, calls on the insurance industry and policymakers to standardise cyber insurance coverage, language and risk assessments. The EU’s cybersecurity agency makes several recommendations for policymakers and insurers, aimed at harmonising cyber insurance in a bid to boost the market and improve protection for insureds. Ferma welcomed the report’s publication, supports many of its recommendations and shares ENISA’s concerns over a lack of harmonisation on cyber insurance language. But the federation “regrets that the clients’” perspective is missing from the publication. When ENISA published its preliminary findings at a validation workshop in October, Ferma expressed reservations about some of its proposals. Ferma said earlier this month that the views of insurance buyers and risk managers were underrepresented in the study, but that it had developed a working relationship with ENISA and hoped its views would be reflected in the final report. It seems that not all have been taken into account. Ferma is concerned that the report does not reflect its belief that cyber risk assessments are needed at buying organisations before insurance can even be considered. “Before any decision to purchase cyber insurance, a risk assessment should first of all be performed on the customer’s side. It all starts from the situation faced by the clients. They need to define the exposure faced by their organisation to cyber risk. The risk assessment language, therefore, should be defined at the intersection of clients, brokers and insurance,” said Ferma board member Philippe Cotelle. In addition, Ferma said a gap exists between demand for cyber insurance and what is currently on offer. It said this remains one of the major obstacles to the development of a mature market. “Closing this gap requires better cyber risk financial quantification. Ferma is convinced that brokers and insurers cannot alone assess the financial exposure of their clients,” said the federation. Ferma is pleased with the report’s clarification on cyber claims management issues. “The acknowledgement that ‘claims triggers should be part of language harmonisation’ and the recommendation to ‘develop specific use cases and examples of claims triggers for different types of coverage’ are going in the right direction to increase the maturity of the cyber insurance market in Europe,” it said. “This is fully in line with our conviction that the European cyber insurance market will develop even further if clients know with better accuracy when and how their cyber insurance policy will be activated and therefore claims being paid,” said Mr Cotelle, who is also head of insurance risk management at Airbus Defence and Space. Ferma published a cyber risk governance guide in July this year, which promotes buyers undertaking a thorough enterprise wide risk assessment. The guide proposed the creation of cyber risk governance groups, chaired by the risk manager, to operate across functions within the enterprise. The group's role is to identify and quantify the business impact of cyber risks across the whole organisation and propose mitigation and risk transfer measures to the board. The ENISA report proposes that EU member states create minimum coverage requirements and develop guidelines for cyber insurance. Such requirements would define, for example, what cover should be included as a minimum under a data breach policy. ENISA sees coverage requirements as “building blocks” that then leave insurers free to develop additional cover on top. However, its recommendations do not impose obligations on insurance buyers. The agency also recommends that the insurance industry takes steps to standardise cyber policy language – including claims triggers – and underwriting questionnaires. In addition, insurers should develop industry standards to define terminology, use cases, coverage, incident types and policy trigger parameters, according to ENISA. It believes that standardised policy language and underwriting questionnaires will help insurers and customers understand what they are selling and buying, while avoiding the potential for coverage disputes and costly litigation. The agency said the adoption of regulations such as the General Data Protection Regulation (GDPR), and standards, will provide a common framework for the harmonisation of cyber insurance terminology and offerings. “Standardising policy language will help insurers and customers to mutually understand what they are selling and buying and increase buyer understanding and trust in cyber insurance products,” commented Udo Helmbrecht, ENISA’s executive director. The report also calls for insurers and regulators to share more cyber incident data. It urges EU policymakers to create a central EU repository of incident data, and allow insurers to access data breach information arising from mandatory reporting schemes under the GDPR and NIS Directive. ENISA believes that increased data availability will promote better modelling of cyber risk. In its analysis of the cyber insurance market, ENISA finds a lack of harmonisation around terminology, policy language and the type of questions asked by insurers when assessing risk. The absence of a common language reduces the appeal of cyber insurance products for customers and makes it difficult for them to understand and compare products, it adds. The study also finds a lack of consensus on security standards – such as ISO 27001/231, NIST32, COBIT 533 and NCSC – referred to in cyber risk assessments. A buyer may face different questions regarding the compliance to, or application of, security standards from different carriers, it notes. “The industry perceives the lack of commonality in risk assessment language as both an indicator of market immaturity and as an obstacle to the market’s growth,” ENISA states in the report. The ENISA report can be found at: www.enisa.europa.eu/publications/commonality-of-risk-assessment-language-in-cyber-insurance

Ferma concerned that buyers’ view missing from EU cyber insurance report

Want to read this article?

Read Next

Marsh tracks slowdown in global Q1 rate hikes

Markel names head of terrorism in London

Insurers defend Nord Stream’s €400m lawsuit as act of war

Allstate posts nat cat loss of $343m for March

UAE flash flood losses manageable as insurers adapt to changing weather

Marsh tracks slowdown in global Q1 rate hikes

Markel names head of terrorism in London

Insurers defend Nord Stream’s €400m lawsuit as act of war

Allstate posts nat cat loss of $343m for March

UAE flash flood losses manageable as insurers adapt to changing weather

Want to read this article?

Read Next

Marsh tracks slowdown in global Q1 rate hikes

Markel names head of terrorism in London

Insurers defend Nord Stream’s €400m lawsuit as act of war

Allstate posts nat cat loss of $343m for March

UAE flash flood losses manageable as insurers adapt to changing weather

Related Articles