3.2 Cyber Risk Cover
There is no standard “cyber risk” cover available in the insurance market. The
products that are on offer intend to fill the gaps which conventional insurances
leave open in relation to cyber-related perils. Thus, the assured could tailor the cyber
insurance policy by taking into account their particular circumstances and needs.
14
Cyber coverage can typically be obtained for losses arising from:
• Business interruption. Shipping companies increasingly rely on computers and
digital storage of essential data. A cyber attack which leads to shutting down of
the systems as a precaution or cripples companies from performing normal
business activities could lead to a significant financial loss. There is no consistency in terms of cover offered. but generally it is required that there is some
degradation in network performance caused by (1) Unauthorised use of or access
to the network; (2) Denial of service attack or denial of access, including
ransomware; (3) Receipt or transmission of malicious code, including viruses;
or (4) Damage, loss or theft of data, including confidential data; and this degradation should be the cause of any interruption to commercial operations. Cyber
policies would invariably state that all losses that flow directly from the event will
be covered until the end of a fixed period (known as “maximum indemnity
period”), which is usually capped in the policy between 60 and 120 days. The
value of “loss of profit” in cyber policies is calculated either by reference to “loss
of gross profit” or “net profit plus continuing fixed costs”.
• Cyber extortion. Some policies will also indemnify the assured when a ransom is
paid in response to a threat to disable its computer system but before any attack
has actually been carried out.
• Crisis management costs. Policies usually indemnify the assured for notification
expenses, forensic expenses, public relations costs and other assistance costs.
• Property damage including recovering and repairing data. Some policies would
cover damage to digital assets (data and programmes) and in some cases personal
injury.
• Loss of data. This would normally include cover for any liability payments made
to third parties whose data has been lost or damaged by the assured as a result of a
data breach, as long as the quantum of the payment has been the subject of
judicial ruling or is the result of a settlement that the insurer has endorsed.
• Regulatory fines, penalties, costs and expenses. Most policies would stipulate that
fines and penalties are payable “to the extent allowed under applicable law”.
14 However, it is often stated that lack of product standardization in the cyber insurance market
continues to pose a challenge for companies, making it difficult to conduct comparisons or to find a
product that matches their exposure. See, the paper produced by Cambridge Centre for Risk Studies
in collaboration with Risk Management Solutions in 2017, Managing Cyber Insurance Accumulation Risks (can be found at: https://www.jbs.cam.ac.uk/fileadmin/user_upload/research/centres/
risk/downloads/crs-rms-managing-cyber-insurance-accumulation-risk.pdf
(last
tested
on
31 December 2018).
632
B. Soyer
There is no standard “cyber risk” cover available in the insurance market. The
products that are on offer intend to fill the gaps which conventional insurances
leave open in relation to cyber-related perils. Thus, the assured could tailor the cyber
insurance policy by taking into account their particular circumstances and needs.
14
Cyber coverage can typically be obtained for losses arising from:
• Business interruption. Shipping companies increasingly rely on computers and
digital storage of essential data. A cyber attack which leads to shutting down of
the systems as a precaution or cripples companies from performing normal
business activities could lead to a significant financial loss. There is no consistency in terms of cover offered. but generally it is required that there is some
degradation in network performance caused by (1) Unauthorised use of or access
to the network; (2) Denial of service attack or denial of access, including
ransomware; (3) Receipt or transmission of malicious code, including viruses;
or (4) Damage, loss or theft of data, including confidential data; and this degradation should be the cause of any interruption to commercial operations. Cyber
policies would invariably state that all losses that flow directly from the event will
be covered until the end of a fixed period (known as “maximum indemnity
period”), which is usually capped in the policy between 60 and 120 days. The
value of “loss of profit” in cyber policies is calculated either by reference to “loss
of gross profit” or “net profit plus continuing fixed costs”.
• Cyber extortion. Some policies will also indemnify the assured when a ransom is
paid in response to a threat to disable its computer system but before any attack
has actually been carried out.
• Crisis management costs. Policies usually indemnify the assured for notification
expenses, forensic expenses, public relations costs and other assistance costs.
• Property damage including recovering and repairing data. Some policies would
cover damage to digital assets (data and programmes) and in some cases personal
injury.
• Loss of data. This would normally include cover for any liability payments made
to third parties whose data has been lost or damaged by the assured as a result of a
data breach, as long as the quantum of the payment has been the subject of
judicial ruling or is the result of a settlement that the insurer has endorsed.
• Regulatory fines, penalties, costs and expenses. Most policies would stipulate that
fines and penalties are payable “to the extent allowed under applicable law”.
14 However, it is often stated that lack of product standardization in the cyber insurance market
continues to pose a challenge for companies, making it difficult to conduct comparisons or to find a
product that matches their exposure. See, the paper produced by Cambridge Centre for Risk Studies
in collaboration with Risk Management Solutions in 2017, Managing Cyber Insurance Accumulation Risks (can be found at: https://www.jbs.cam.ac.uk/fileadmin/user_upload/research/centres/
risk/downloads/crs-rms-managing-cyber-insurance-accumulation-risk.pdf
(last
tested
on
31 December 2018).
632
B. Soyer