The Case for a Federal Cyber-Insurance Backstop

The uptick and evolving nature of cyberattacks — and the economic challenges they pose — have sparked much-needed conversations about the benefits of cyber insurance. But with so many organizations now considering the value of cyber insurance as part of a comprehensive plan for addressing their cyber-risk, insurers are closely evaluating if and how they'd remain viable in the event of a catastrophic, widespread cyberattack that implicates high volumes of policyholders.

Many cyber-insurance policies include war exclusions, nuances with widespread event coverage, and even naming specific technology providers that could present systemic risk to an insurer. Therefore, there continues to be growing uncertainty around coverage and rising exclusions that attempt to eliminate cyber-insurance providers' risk from a broad or systemic catastrophic event. This approach also exposes insurance customers (and companies in general) to risk for which they have extremely limited alternative options for mitigation or transfer.

Insurance and government leaders are working to identify how to make cyber insurance more sustainable and are considering a broad array of tools for addressing the systemic risk of a catastrophic, widespread cyber event. One of these tools, highlighted in the Biden Administration's National Cybersecurity Strategy, is to explore a possible federal cyber-insurance backstop. While the details in the strategy are minimal, here's what such a tool might entail and how it could potentially work to protect both insurers and their policyholders from the impact of detrimental cyberattacks.

What Is a Cyber-Insurance Backstop?

Put simply, a federal cyber-insurance backstop would involve the US government stepping in to provide aid (likely at least in part financially) to stabilize the economy in the event of a catastrophic, widespread cyber incident. Under such a framework, legislators could set requirements for private insurers to qualify for federal support.

Holistically constructed, a federal cyber-insurance backstop would transfer remote but potentially catastrophic risks from qualifying insurers (or their policyholders) to the federal government. These would be systemic risks that insurers cannot sustain on their own due to financial stability concerns; however, a federal insurance backstop could ease coverage restrictions by providing reinsurance in the event of a catastrophic loss.

The US government has similar backstop programs to assist with natural disasters, even underwriting direct insurance coverage. The first step toward putting something like this into practice would be to identify what constitutes a catastrophic cyber event. Fortunately, cybersecurity experts are well-positioned to support this area. While building out what this would look like for cybersecurity would take time, it has the potential to be a legitimate resolution to a complex problem.

Potential Benefits

If implemented properly, there are many potential benefits to putting a federal cyber-insurance backstop into practice. To name a few:

An Industrywide Effort

The implementation of a federal backstop could be a positive move for the security community overall and a step forward in continuing to make cyber insurance a viable option for corporations. This can also build and enforce the cyber-insurance industry's ultimate goal: leveraging insurance to enforce and encourage better cybersecurity practices from their clients, ultimately driving down cyber-risk and making risk transfer more affordable.

With that said, to do this effectively, it cannot be built in a vacuum. Cybersecurity experts, insurers, and the federal government must all work together to design a backstop that considers the nuances and complexities of the evolving cyber-threat landscape. Its inclusion in the National Cybersecurity Strategy is just the start.