Coverage is available from many insurers for various aspects of cyber risk covering both first party and third party losses. For mid-sized to larger businesses, these are structured in modular coverage parts, so a buyer can elect just the coverages they feel they need, and not pay for coverages they don't need. Typically third party coverages include:

Regulatory Investigation Expense: Often regulatory fines can't be covered, but insurance for the expense to defend against regulatory actions is available.

Breach or Loss of Data: If data is lost, suits for damages can result, which could be class actions. Note there is also first party cover for remediation and notification expenses.

Media Liability: As on-line information increasingly replaces traditional sources such as newspapers, television, and radio, losses due to infringement are possible.

First party coverages include:

Crisis Management Expenses: Often the insurer provides the vendor to manage a loss event, and other expense associated with an event such as data loss. This high quality management of the loss event protects both the insured and the insurer from further losses.

Breach of the Network: This includes both remediation expenses and notification to third parties whose data may be compromised.

Extortion: If a cyber-criminal accesses and encrypts data to charge a ransom for the release, this covers the ransom, and other restoration expenses.

Business Income and Extra Expense: Similar to property policies, this can be covered subject to agreed waiting periods.

Other first party coverages that can be available include data restoration expenses, computer fraud, or fund transfer fraud.

Of course, all of the coverages may be subject to an aggregate limit of liability, in addition to the specific limits of liability for each coverage part. Be sure to check if the defense costs on third party coverage is limited or in addition to the limit.

Non-cyber coverage

Coverage for cyber events from insurance that isn't cyber-specific is rare, but there is some. Inland marine forms on an all risk basis could cover property losses from cyber events. However, the standard property forms specify causes of loss. Only if a cyber-event triggers a property peril that is covered, such as an explosion, or fire, the property form may provide coverage. The standard General Liability form is usually issued with endorsements that exclude cyber coverage. Directors and Officers insurance (D&O) may cover suits against D&O's resulting from a cyber loss. Overall, insurance that isn't specific to cyber can't be counted on to cover cyber exposure.

Conclusion

A market for cyber risk is developing. The pace of development is frustrating for both buyers and sellers. Insureds need to stay informed on the risks and coverages, and insurers need to stay creative with the coverage and pricing. As cyber coverage is complex and insurers approaches vary, insureds should seek the advice of a qualified broker.

Chris Nyce, FCAS, MAAA, is a principal in KPMG's Actuarial Services practice. He specializes in helping insurance companies quantify and manage the many risks they face. He can be reached at [email protected].