German insurers issue new model cyber conditions

The German Insurance Industry Association (GDV) has revised its non-binding model conditions for cyber insurance to take into account the shift to home working and introduction of the General Data Protection Regulation (GDPR). The new wording expressly excludes non-physical war damages, as well as the direct and indirect impact of state-backed cyberattacks, notably on critical infrastructure. “The cyber insurance market has developed very dynamically since it [the wording] was first published in 2017, and some general conditions have also changed: more employees are working mobile, applications are increasingly being offered via cloud computing, and the General Data Protection Regulation has created new claims for damages in the event of data leaks. The new model conditions take these developments into account,” said GDV managing director Jörg Asmussen. However, nothing changes in the basic structure of cyber policies, the GDV assured the market and its clients. “A cyber policy based on GDV model conditions offers small and medium-sized companies comprehensive insurance protection against cyberattacks,” said Asmussen. The adjustments to the non-binding model conditions include, among others, the following aspects: Mobile working: The new model conditions make it clear that remote access to the company’s IT is also insured. Violation of data protection laws: Since 2018, the GDPR has given those affected by a data leak a right to compensation. Since many people are often affected by such a data breach, these payments can be very high. This risk is also insured in the new version of the model condition. War and state attacks: The new version makes it clear that war under the terms does not require the use of physical armed force. Damage caused by acts of war is also excluded if the war is waged using digital means. In addition, the new model conditions formulate an exclusion for state cyberattacks. This means that damage that is a direct or indirect consequence of a successful government attack on critical infrastructure is excluded. External service providers: Damage resulting from a disruption to external service providers – such as cloud providers, data centers or software-as-a-service solutions – was previously excluded from insurance coverage. This restriction is largely lifted in the new model conditions. If data stored by the service provider is manipulated, infected with malware or accessible to unauthorised persons, insurance coverage applies. However, the failure of the service provider, e.g. the lack of availability of the data, remains excluded. IT security level: The obligations to be fulfilled by the insured company have been “reformulated in order to reflect the current technical status and improve… understanding”. The basis for an appropriate level of IT security continues to be the well-known, easy-to-implement measures such as regular data backups, strong passwords, individual access, virus scanners, firewalls and quickly installed security updates, the GDV assured policyholders. The GDV remains concerned, however, that medium-sized German businesses continue to underestimate dangers from the web and overestimate their own level of security. “Cyber insurance can cover the risk of a hacker attack – but such protection requires a certain level of IT security. We will therefore continue to work actively to improve the IT security of the German economy,” said Asmussen. Politicians, the police and the judiciary have a role to play in raising awareness of the cyber risk said the GDV. “In addition to business and insurers, politics must also make its contribution by creating clear responsibilities and framework conditions for more cybersecurity. The responsible authorities should quickly identify large-scale attacks on private individuals and companies, make them known and, ideally, also provide information on how to ward off the attack. Public prosecutors and police authorities should act as partners of those affected and also exert a high level of pressure to investigate and search for the perpetrators… success in the fight against cybercriminals is possible – but requires a joint effort from all actors,” said Asmussen.

German insurers issue new model cyber conditions

Cyber war position clarified by new wording

Want to read this article?

Read Next

Baltimore bridge supply chain insurance losses likely

Vast majority of global wind and solar energy assets unprotected from fire

Ardonagh to acquire PSC Insurance in Australia

Munich Re Q1 net result up 68%, buoyed by ERGO international growth and April renewals

New cyber insurance endorsement from AXA XL in US

Baltimore bridge supply chain insurance losses likely

Vast majority of global wind and solar energy assets unprotected from fire

Ardonagh to acquire PSC Insurance in Australia

Munich Re Q1 net result up 68%, buoyed by ERGO international growth and April renewals

New cyber insurance endorsement from AXA XL in US

Want to read this article?

Read Next

Baltimore bridge supply chain insurance losses likely

Vast majority of global wind and solar energy assets unprotected from fire

Ardonagh to acquire PSC Insurance in Australia

Munich Re Q1 net result up 68%, buoyed by ERGO international growth and April renewals

New cyber insurance endorsement from AXA XL in US

Related Articles