The Association of British Insurers (ABI) and Lloyd’s of London have co-published a guide for (re)insurers on how to approach defining a major cyber event.
As one of the most prominent systemic and emerging risks, there are not many historic major cyber events for insurers to look at when trying to establish clear definitions and policy wording. The ‘Components of a Major Cyber Event: A (Re)Insurance Approach’ seeks to address this by setting out the factors (re)insurers should consider and provides a framework to follow when defining what constitutes a major cyber event.
Written by senior cyber (re)insurance leaders, the paper represents a joint effort to build shared approaches across the industry. The steps that need to be considered, and given varying degrees of emphasis, when defining a major event include:
- WHO is responsible for the event and whether their intentions were malicious or not?
- WHAT was the cause of loss?
- WHERE did it occur geographically, in the digital ecosystem and the insured population?
- WHEN did the event start and how long did it last for?
- HOW did the cyber event spread - was it manual or automatic?
- WHY did the event occur, was the motive for financial or political gain?
- IMPACT quantified as monetary loss
Each provider’s definition may vary depending on their commercial approaches. However, the framework helps streamline this process by grouping, categorising, and systematically analysing cyber incidents for various purposes, such as risk assessment and aggregation.
Mervyn Skeet, Director of General Insurance Policy at the ABI said:
“The emerging and incredibly complex nature of cyber threats are a crucial challenge to our industry. There is no one single definition of a major cyber event, and history does not yet provide enough evidence to build one. However, getting ahead of these threats and understanding the risk they pose is where our industry excels. By collaborating with Lloyd’s, we’ve been able to develop a framework and a consistent set of components for firms to consider when trying to build their own definitions. This should provide more certainty for insurers, government and customers.”
Rachel Turk, Lloyd’s Chief Underwriting Officer said:
“With over a fifth of global cyber insurance being placed at Lloyd’s, a shared understanding of the approaches to defining a major cyber event is crucial for quantifying risks and for developing risk mitigation strategies. A robust framework for defining the components of major cyber events will ultimately enhance the resilience of the insurance industry in the face of ever-growing cyber threats, and this paper takes us a step closer to that goal.”
For more information, please contact ABI Press Office.