Cyber Insurance Sticker Shock Gives Some Governments Pause

With the increasing number of damaging cyberattacks this last year, it’s no surprise cybersecurity insurance is harder to get. Climbing premiums, more exclusions and the extensive, in-depth assessments required for coverage are making some state and local governments question whether investing in a policy is still a good idea.

Not too long ago, agencies could get coverage by spending an hour or two filling out a basic security questionnaire, deciding on the amount of coverage and choosing a policy. Now some carriers want detailed answers about how an agency’s security controls are configured, Dallas Chief Information Security Officer Brian Gardner said in a June 30 GCN webinar.

For counties trying to get cybersecurity insurance, “it’s page after page of questions,” said Rita Reynolds, CIO with the National Association of Counties, adding that she expects carriers will also validate an agency’s statements. “Whatever you write [in your questionnaire], you had better have in place,” she advised.

Plus, she added, “if you don't have multifactor authentication in place in multiple areas — not just with your staff accounts but on the VPN and access to cloud accounts — you can pretty much forget about having cyber insurance.”

Technical debt is another risk factor insurers are looking at, Reynolds and Gardner said. Government agencies, probably more so than private sector firms, work with legacy systems that have accumulated significant technical debt, making it difficult to secure them to the degree cyber insurance policies may call for—especially with a dwindling workforce equipped with the requisite skills. 

And it’s not just the software that’s getting more attention, it’s the policies too. Agencies need more than just an acceptable use policy and a security incident plan in place. “It's now the access control policy—who has access to what and to what degree on what categories,” Reynolds said. 

On the plus side, preparing for a cybersecurity insurance renewal forces governments to take a hard look at their security gaps and their tolerance for risk—with an eye to what they can afford. Gardner said his job is to identify the security gaps and articulate the risks to C-suite leaders, who then make the decision whether to carry cybersecurity insurance.  

He advised agencies use a cybersecurity framework, like the one from the National Institute of Standards and Technology, and “stay the course.” Hewing to a recognized framework will not only help secure agency systems, but it will make it easier to qualify for cybersecurity insurance. 

So what should local governments look for in a cyber insurance policy? Reynolds listed a few services agencies should insist on:

• A dedicated cyber contact that will be available 24/7. 
• Communication services to help with public relations. This kind of assistance would provide guidance on what the press releases should contain as well as what information should be made public and when.
• Legal guidance because a county attorney or solicitor may not have the necessary experience to handle client privilege and chain of custody issues throughout the forensic investigation. Additionally, an agency’s cross-jurisdictional data is subject to various federal and state privacy laws, so legal help will assist with managing those issues, as well as the breach notification process. The firm can help make sure breach notices are sent out in a timely fashion and that the proper amount of information is shared. 

Agencies looking for policies that cover a ransom payment may be out of luck. While many insurance providers are not going to cover a ransom, in some cases they will provide the resources “to help negotiate the ransom down,” giving the victims time to determine whether they can restore their systems from backup, Reynolds said. “It gives you a little bit of time to decide” what to do instead responding with a knee-jerk reaction to pay the ransom and get systems back online right away. 

Agencies reviewing their policies should also look for damage coverage to on-premises equipment, Reynolds said. Now that many services have moved to the cloud, agencies may be able to cut back on some of their on-prem coverage.

Cybersecurity insurance is not a way to offset risk, and it is not a disaster recovery plan, Gardner said. And because of the cost and complexity of qualifying for a policy, “it’s gone from a must-have to a nice-to-have.”

With agencies looking for more flexible, affordable insurance, “I'm still a believer at this point in time that you should carry some level of cyber insurance,” Reynolds said, laying out four basic options.

The first is no insurance at all. The self-insurance option involves governments setting aside money and then managing the costs of recovery from a cyberattack from that fund.  A third option is joining an insurance pool, where similar organizations can work together to bring down costs. The last option is directly buying a cyber insurance policy. 

IT managers must articulate the risks to upper management who then can decide on what kind of policy to pursue based on their budget and appetite for risk.

“Doing nothing is not an option,” Reynolds said.