The Role of CISOs in Cyber Insurance Negotiation: Bridging the Gap between Security and Coverage

The Dilemma of the CISO: Recognizing the Value of Cyber Insurance

The No-Win Situation of CISOs

CISOs (Chief Information Security Officers) face a challenging position within organizations, often lacking the recognition and authority needed to effectively protect the company’s digital assets. A recent survey conducted by Heidrick & Struggles, a human resources and management consulting firm, revealed that more than half of all CISOs report to technical corporate officers such as the CIO or CTO, rather than to the business side of the organization. This imbalance diminishes the CISO‘s ability to provide critical insights and recommendations to the board, leaving cybersecurity operations with less influence compared to other departments.

Furthermore, CISOs frequently find themselves burdened with the responsibility to protect the company without the necessary authority and budget to accomplish the task at hand. They lack the ability to bridge the gap between the technical aspects of cybersecurity and the strategic decision-making process within the organization.

The Emergence of Cyber Insurance as a Business Imperative

In today’s corporate environment, boards are increasingly seeking the input of CISOs due to a business imperative: cyber insurance. Generally, negotiating cyber insurance policies has traditionally fallen within the domain of the general counsel, chief financial officer, or chief operations officer. However, involving the CISO in these negotiations is essential to ensure that insurers understand not only the security controls in place but also why these controls are configured in a specific manner and aligned with the organization’s strategy.

Despite the importance of involving the CISO in cyber insurance discussions, this best practice is often overlooked due to factors such as expediency and a lack of acceptance by other C-suite executives. By including the CISO, insurers can gain access to critical threat intelligence and a deeper understanding of the organization’s cybersecurity landscape, ultimately reducing risks for both the insurance company and its clients.

The Benefits of Partnership

According to Jason Rebholz, CISO at cyber insurer Corvus, engaging insurers directly can provide CISOs with resources and benefits that they may not be aware of. By viewing insurers as threat intelligence partners rather than just financial partners, CISOs can gain valuable insights that can enhance their ability to perform their job effectively.

CISOs can also tap into insurers’ knowledge and experience, as they have a broader perspective on security trends and emerging threats. Tracie Grella, global head of cyber risk insurance at AIG, emphasizes the potential partnership between CISOs and insurance carriers. She believes that this collaboration can significantly contribute to improving organizations’ security postures.

The Downside for Organizations without a CISO

While CISOs are often included in cyber insurance discussions at larger companies, smaller and some midsize organizations might not have a dedicated CISO position. This puts these organizations at a disadvantage, particularly when it comes to insurance claims. Scott Godes, attorney at Barnes & Thornburg LLP, highlights the importance of having a strong CISO to address technical cybersecurity issues and explain their significance to the board.

Additionally, the process of filling out cybersecurity insurance applications is complex and requires technical expertise. Failure to provide accurate information could lead to claim denials or even legal repercussions. It is crucial to involve the individuals who are knowledgeable about the organization’s cybersecurity practices and can provide accurate representations in the application process.

Cyber Insurance and the Pandemic

Marc Schein, national co-chair of the Cyber Center of Excellence at Marsh McLennan Agency, notes that the chaos the cyber insurance industry faced during the pandemic has lessened. CISOs who focus on implementing key cybersecurity controls recommended by Marsh can now obtain better rates and terms than they could a year ago.

Conclusion

The role of the CISO in organizations is critical for ensuring robust cybersecurity. Recognizing the value of involving CISOs in cyber insurance discussions can contribute to bridging the gap between technical and strategic decision-making processes. This collaboration allows insurers to gain valuable threat intelligence and enables CISOs to access additional resources and expert guidance.

Furthermore, organizations without a dedicated CISO are at a disadvantage, particularly when it comes to addressing technical cybersecurity issues, filling out insurance applications accurately, and explaining the importance of cybersecurity initiatives to the board. Employing best practices and involving the right individuals in cyber insurance activities can greatly benefit organizations in managing cyber risks effectively.