Ferma and key market players call on EU to reignite discussions over PPP for systemic cyber risks

Ferma and a group of leading (re)insurers and brokers have called on the EU to reignite discussions over a public-private-partnership (PPP) to help manage and transfer systemic cyber risks.

Releasing a joint report, the key stakeholders have urged public bodies to move beyond theoretical PPP solutions and come up with practical moves amid growing uncertainty for insurance buyers when it comes to areas such as cyber war.

The European risk management and transfer community have also encouraged large corporates to improve cyber risk identification and prevention by investing in quantification, benchmarking and crisis management training and protocols.

And backed by the report’s partners – Allianz Global Corporate & Specialty (AGCS), AXA XL, HDI Global, Howden, Lloyd’s Insurance Company (Europe), Marsh and Munich Re – Ferma has reiterated its call for an annual international cyber summit to tackle some of the issues around cyber insurance and boost resilience.

Central to the Cyber insurance dialogue – How Europe can lead the way to cyber resilience report’s findings is the need for greater collaboration between all stakeholders to achieve a balance between the risk appetite of insurers and the coverage requirements of corporate buyers to ensure a sustainable cyber market.

To help achieve this, the report’s authors “call upon public authorities to push for EU leadership on a public-private-partnership solution for the [cyber] risks that cannot be covered by the private insurance market alone”.

Launching the report in Brussels, Philippe Cotelle, vice president of Ferma and chair of its digital committee, said it is vitally important to “bridge the uncertainty that is growing around catastrophic cyber loss scenarios that are not covered by insurance”.

“We can’t be uncertain. We need to know exactly the boundaries where insurance will work so that we can adapt our risk management according to those boundaries, and supply a clear answer to top management about how we plan to address catastrophic cyber losses. This is a big element of the report. We call for Europe to seize the opportunity, as it did in the past on the GDPR, to put the continent at the leadership on those key issues,” he added.

Cotelle said Ferma and the other market players want the EC and public authorities to launch a conference with all the different stakeholders to come up with solutions. It wants the EC to develop a working group of representatives from the public and private sectors “to discuss and then implement some key measures for the benefit of Europe”.

Scot Sayce, global head of cyber at AGCS, said it is time to move beyond just discussion on how to build cyber resilience and develop a PPP for systemic cyber risks.

“We need to get to the root of some of the problems. We need to make sure the right people are in the room having the conversations that need to be had. Across different parts of the world there have been many engagements talking quite theoretically about this topic as opposed to pure action. Right now, we want to sit round a table and have that proper discussion with all stakeholders… now is the time for us to restart that in a much more robust way,” he said.

Martin Kreuzer, senior risk manager of cyber risks at Munich Re, stressed that the (re)insurance industry alone cannot absorb potential losses from cyber war or a catastrophic cyber event that might have a global impact on societies and economies throughout the world. “This is why we are here to reach out to the European Union and further intensify collaboration to close any gaps that might exist,” he said.

Jean Bayon de la Tour, managing director, head of cyber in Europe at Marsh, said there is concern among clients about cyber insurance restrictions for catastrophic events. This risks insureds losing trust in the product, and demands a joint approach to find solutions, he said.

“That is why we welcome Ferma and this group coming together in order to tackle these topics and work collectively to find solutions that will suit clients and be sustainable for insurers. We need to look to the IT security community that sometimes is lacking in our discussions on insurance. I think it is critical to get their view; they are facing the risk on a day-to-day basis,” added Bayon de la Tour.

The report puts forward a range of recommendations beyond a PPP to help boost cyber resilience across Europe. These are focused on three area – cyber risk identification and prevention, underwriting and coverage.

The authors want to see large corporates improve cyber risk identification and prevention by investing in quantification, benchmarking and crisis management training and protocols. The report also recommends developing common EU cybersecurity standards for SMEs and wants public authorities to launch campaigns and create schemes that incentivise SMEs to invest in cyber security controls.

When it comes to underwriting, the report calls for further work to a standardised baseline questionnaire used in cyber underwriting discussions. It wants to see transitional cyber coverage for SMEs on their “cybersecurity journey” and a more continuous underwriting approach for larger corporates focusing on greater feedback.

Beyond a PPP to boost cyber insurance coverage for systemic and cyber war risks, Ferma and its partners want to help develop stress-scenarios with both public and private stakeholders.

Typhaine Beaupérin, CEO and secretary general at Ferma, said: “We believe that Europe can become a world leader in efforts to bolster cyber resilience. Adopting a Europe-wide, pan-stakeholder approach to address every aspect of the cyber challenge and ensuring that through ground-breaking risk-sharing initiatives we can create the depth and breadth of capacity required to bridge the cyber protection gap.”

Cotelle said the report comes amid a collective conviction that solutions cannot be found by working in silos.

“The fact we have been able to gather all the different stakeholders, and jointly found some proposed, concrete recommendations beyond any commercial issues that anyone might have, is a demonstration of the commitment and engagement of all the stakeholders on this important topic,” he said.

“It is a call for public authorities to take charge of these issues in order to contribute again to the resilience of our economy. It is also an opportunity for Europe to show leadership on those key topics,” concluded Ferma’s vice president.