Why Small Businesses Need More Than Just Cyber Insurance to Protect Themselves

The Importance of Proactive Cybersecurity

In light of the guidance from the Federal Trade Commission (FTC) and the National Association of Insurance Commissioners (NAIC) suggesting that companies consider cyber insurance as a means of resilience against cyberattacks, it is important to recognize that while cyber insurance is an essential tool in risk management, it is not a comprehensive solution to all cybersecurity challenges. The digital age has brought immense benefits, but it has also increased cyber threats to businesses. Therefore, businesses must take proactive steps to prevent cyber-risks and ensure the affordability and availability of cyber insurance.

The Limitations of Cyber Insurance

Cyber insurance is not a one-size-fits-all solution. It may be beyond the financial means of small businesses, and the cost of premiums has been increasing. According to the NAIC, cyber insurance premiums grew by 61% in 2021 alone. The variety of coverages, exceptions, and exclusions in policies further complicates the purchasing process, and inexperienced buyers may not fully understand the protection limitations.

In addition, cyber insurance policies only cover a set of named perils and may not include coverage for cyber terrorism, state-sponsored attacks, contractual liabilities, or intellectual property infringement. They may also have deductibles, co-payments, and sublimits that reduce the amount of coverage. Therefore, businesses cannot solely rely on cyber insurance to protect against all types of security breaches.

The Role of Agencies in Promoting Cyber Insurance

The government has a crucial role in ensuring the availability and affordability of cyber insurance, especially for small businesses. Agencies should take a holistic approach that supports businesses’ use of proactive cybersecurity measures. This can be achieved through education, industry self-regulation, and policy cost subsidization.

Standardization and Education

The lack of standardization in the cyber insurance market makes it difficult for consumers and brokers to evaluate policies. Agencies can promote a standardized format for presenting policies, similar to the approach used for auto insurance or energy facts labels. This would aid consumers in making informed purchase decisions and encourage industry self-regulation to ensure consistent policy presentation and clarity.

Furthermore, government outreach to businesses can help them understand the importance and implementation of good cybersecurity practices. By providing education and support, agencies can help keep losses and policy premiums low, while also preventing incidents from occurring and benefiting society at large.

Government Subsidization

Government subsidies can play a significant role in increasing cyber insurance uptake. Uninsured businesses create harms that are transferred to the public if they fail after a cyber incident. To incentivize purchasing cyber insurance, federal and state governments can offer tax credits. Additionally, the government can create a backstop fund to cover catastrophic cyber incident costs, similar to state-backed models for other catastrophic risks.

Regulatory Measures

Regulators should also take steps to increase market efficiency by ensuring that policies provide the implied coverage. Existing fair-trading authorities can be utilized to enforce common policy benefits presentation and accurate translation into policy language. This will facilitate competition and reduce the effort required to compare and purchase policies. Agencies can contribute to this by developing curriculum and licensing practices targeted at cyber insurance providers and resellers.

Conclusion

While cyber insurance is an important risk management tool, it is not a comprehensive solution to cybersecurity challenges. Businesses must take proactive steps to prevent cyber-risks and ensure the availability and affordability of cyber insurance. The government can play a crucial role in supporting businesses by promoting standardized policy presentation, providing education, and offering subsidies. Implementation of these targeted actions should be a top priority for relevant agencies in order to protect businesses and society from the ever-growing cyber threats in the digital age.