Page 17 - Digital Edition SIRC Supplement

SPECIAL FEATURE - CYBER
Data Security Standard (DSS) or a Report on Compliance
(RoC).
The review of independent assessments would be similar to
those performed by sophisticated enterprises as part of their
third party service provider oversight or vendor management
program today. If an applicant does not possess adequate
independent assurances, then a more detailed cyber security
questionnaire may be used that includes questions that are
statistically proven to be indicators of the efficacy of an
organization’s cyber security program.
A combination of an independent assessment and a
questionnaire is also an option. Instead of underwriting cyber
insurance policies based on general loss history and the contents
of the application, lower premiums can be quoted to applicants
with above average cybersecurity programs and higher
premiums can be quoted to applicants with below average
cybersecurity programs. The ability to offer below market
premiums to organisations that have invested in building
effective cybersecurity programs will result in a competitive
advantage to the insurer utilising this model – both in terms of
the insurer’s ability to land business as well as having a lower
than industry average for losses over the life of these policies.
In the absence of existing third party audits or certifications, of this data can provide the foundation for a meaningful loss
an insurer may wish to validate the applicant’s responses to
the questionnaire. They can either add the cost of validating
the questionnaire to the premium or give the applicant the
option of paying for third party validation. An applicant with
an effective cybersecurity program may be happy to pay for
the validation if it results in a reduction to the premium that
exceeds the cost of the validation.
Furthermore, if insurers (or at least a few major insurers)
can agree on the model that is used to assess cybersecurity risk,
an entire industry may blossom for independent assessors who
complete questionnaires for applications and/or validate them
for insurers (or applicants). The emergence of such an industry
may be similar to that which arose for Qualified Security
Assessors (QSAs) after the Payment Card Industry (PCI)
released its Data Security Standard (DSS) for organisations
that handle payment card data.
Cybersecurity risk scoring engine
The key element of the model is the cybersecurity risk scoring
Back to Contents SIRC Supplement • November 2015 • www.asiainsurancereview.com 15
engine. Each input is transformed into a quantitative value.
Each value is weighted depending on its predictive efficacy.
Leveraging advanced predictive analytics, an aggregate
risk score is derived for the applicant. The risk score is first
used to determine whether or not the applicant is insurable.
Assuming that a predefined threshold for insurability is met,
the risk score can then be leveraged to determine whether
the applicant is quoted a higher than average premium (i.e.,
a risk premium is applied to the cost of insurance) or a lower
than average premium (i.e., a risk discount is applied to the
cost of insurance).
To monitor that an insured’s cybersecurity program remains
robust throughout the life of the policy, insurers may tie future
premium adjustments to the results of periodic reassessments
or some form of continuous audit/assessment process. The
underwriting pricing process of cyber risks will continue to
evolve as more data becomes available and better underlying
models are developed to evaluate loss frequency and severity.
Cyber incident data is the most developed for analysis at
this time. While a uniformly specific cyber incident repository
does not yet exist, incident information is available through
public disclosure and operational risk management loss event
databases, mostly related to financial institutions. Analysis
frequency and severity model.
Insurance claims data is another area rich with information,
however, this information is just starting to be culled and
organised for usefulness. Due to the lack of a standard policy
form for cyber risk and the consequences and impacts of cyber
incidents which may be included in other policy cover (e.g.
business interruption, liability, fraud, etc.) the timeframe to
fully analye this data will be longer.
Ultimately, through the partnership of expert IT program
assessment, meaningful data analysis and model development,
the insurance industry can emerge profitably while also
creating a more efficient marketplace for cyber insurance
cover, and influencing better overall cyber security processes.
Dr Shaun Wang is the Founder and Chairman,
and Mr Mark Terris is the Managing Director of Risk Lighthouse LLC.
Mr Bradley Schaufenbuel is Principal - Security Services at
Schaufenbuel Advisory Services, Inc.