IUA report highlights need for cyber business-interruption risk assessment

Companies must fully explore the possible ways in which cyber events could affect their business and identify the key operational risks before deciding on cyber business-interruption cover because the market is complex and protection offered by different policies can vary widely, according to a new report from the International Underwriting Association (IUA). The IUA explained that most current business-interruption coverages are standalone policy extensions, and the many different triggers, including unauthorised access to a network, cyberextortion or system failure, are separately defined in the contract wording. For the business-interruption section of a cyber policy to be triggered, the majority of current policies require there to be disruption to, or a failure of, the company’s IT system or network. The new report, from the IUA’s Cyber Underwriting Group, warns companies that not all triggers are included in every policy and that it is important, therefore, to perform an effective risk assessment before considering coverage options. Other cyber triggers include: denial of service attack or denial of access, including ransomware; receipt or transmission of malicious code, including viruses; damage, loss or theft of data, including confidential data; reputation harm following a cyber event; administrative or operational errors; and internal power outage, caused by an external hacker or other operational issue. “As cyber is a relatively new and ever-developing area of insurance, policy coverage and wordings can vary considerably. It is therefore important for companies to compare these wordings to their key risks to ensure that the coverage that is bought meets the needs of the business. Given that cyber business-interruption coverage is not standard across the market, a three-way conversation between the company, their broker and underwriters will assist in ensuring that the cover that is purchased will respond appropriately in the event of a loss,” states the report. It notes that while all cyber business-interruption policies provide cover for the period of restoration, not all will include a period of extended coverage. As a result, companies need to consider the impact on operations of cyber risks crystallising and the likely duration of this impact. Consideration can then be given to ensuring that the expected periods of interruption match the maximum period of loss provided by the cyber policy, notes the report. One of the key messages of the report is that cyber business-interruption cover is very much a tailored product that requires considerable risk assessment work and discussion between insured and insurer to ensure appropriate and relevant cover. For example, the report states: “Each and every loss calculation will be different, as it will need to take into account the specific characteristics of the business impacted by the incident, as well as those of the incident itself. While any calculation of loss of profit will ultimately use financial data, the above commentary also highlights the need to use other nonfinancial or operational data as part of preparing any calculation. Most importantly, it emphasises the need to work with the insured entity to ensure that all issues that will influence a calculation are appropriately identified and considered.” Specifically, the report explains that when reviewing the types of events that may trigger a cyber policy, “both insurers and insureds need to consider a) what system performance information is available, b) the period of time for which this information is retained and c) how this can be analysed to determine what represents ‘business as usual’”. Matthew Hogg, chairman of the IUA Cyber Underwriting Group, commented: “The continued education of businesses about cyber risk exposures is an essential task, both at an operational risk management level and in the boardroom. As cyber is a relatively new and continually developing area of insurance, the range of different cover available can be quite extensive. It is not available as standard across the market and so requires a discussion between clients, brokers and underwriters to ensure that policy wordings meet business needs and will respond appropriately in the event of a loss.”

IUA report highlights need for cyber business-interruption risk assessment

Want to read this article?

Read Next

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Want to read this article?

Read Next

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Related Articles