Publications Office of the EU
Commonality of risk assessment language in cyber insurance
DisplayCustomHeader
MyPortal
hrvatski
BasketSummary
Prikaz web sadržaja
Publication Detail Actions Portlet

Uslužni programi

Publication Detail Actions Portlet
 Ocjene korisnika
custom-survey-notification
Publication Detail Portlet

Publication detail

Home

Commonality of risk assessment language in cyber insurance

Recommendations on cyber insurance

Metapodaci o publikaciji

The cyber insurance market is growing rapidly and it is expected to further expand by the adoption of the GDPR and the NIS Directive which will incentivise organisations falling under their provisions to seek ways of residual risk transfer. As the EU cyber insurance market is still at its early development stages, with the exception of the more mature UK market, significant steps need to be taken towards its maturation if the EU economy is to reap the benefits of this emerging segment. The industry perceives the lack of commonality in risk assessment language as both an indicator of market immaturity and as an obstacle to the market’s growth. This is thought to be an inherent consequence of the changing nature and dynamics of cyber risk exposures. This lack of harmonisation, evident in various aspects of insurance – from coverage to underwriting questionnaires – reduces consumer trust and understanding of these products (especially for SMEs), creates difficulties for insurance carriers seeking to enter the market and limits the growth rate of cyber insurance adoption overall. The broad consensus in the industry is that steps towards harmonisation / standardisation will have significant benefits for all stakeholders involved and for the insurance market as a whole. Moreover, the resulting increased adoption of cyber insurance would prepare the market to respond more effectively to large-scale incidents such as WannaCry and NotPetya and support the economic sustainability of organisations affected by similar major incidents. However, while some initiatives have started to take form, the industry has yet to make significant steps towards harmonisation for a variety of reasons. Competitive advantage, lack of incident and claims data, reluctance to share data, lack of generally accepted standards, insufficient in-house skills, lack of guidance, lack of legislation, market immaturity and the complexity of cyber insurance products and cyber risks overall, all act as barriers towards language harmonisation. However, the industry stakeholders have enough incentives to achieve a higher level of language convergence as everyone stands to gain from it. The main drivers that are expected to act as catalysts behind the language harmonisation are: - the adoption of Regulations and Standards that will provide the common framework on which to build harmonized terminology and offerings; - the increasing Availability of Data which will allow better understanding and modelling of cyber risks; - the Evolution of the Demand Side which will create the need for more standardised and easily comparable products;  the overall Market Maturation which will naturally resolve a number of market frictions. This report proposes two sets of recommendations, one towards the industry itself and one towards policy makers in order to support this evolution towards language harmonisation without stifling innovation. Specifically, the industry is encouraged to standardise policy language and underwriting questionnaires, promote data sharing between the stakeholders, develop industry standards, build inhouse expertise in cyber security, contribute to the collection of data on aggregated loss scenarios, build offerings around information security and privacy regulations, adopt a sectorial approach in harmonising language, address the needs of the SME market and improve overall data quality by integrating various heterogeneous sources. EU and Member States Policy Makers are encouraged to create minimum coverage requirements, leverage the upcoming mandatory incident reporting schemes via the NIS Directive and the GDPR to produce meaningful data, create a central EU repository of incident data, raise awareness to increase demand and buyer maturity and develop guidelines for cyber insurance.
Prikaži više
Prikaži manje
ISBN 978-92-9204-228-8
DOI 10.2824/691163
Kataloški broj TP-04-17-907-EN-N
PDF
ISSN ISBN 978-92-9204-228-8 DOI 10.2824/691163 Kataloški broj TP-04-17-907-EN-N
  • Released on EU publications website:
Publication Viewer

Preglednik dokumenata

Pop up window annotations