NOT JUST FOR EMERGENCIES — Between the rise in ransomware attacks and the growth in supply chain intrusions, the federal government has no shortage of reasons to begin thinking about how to insure against damages that private markets can't — or won't — cover on their own. But as momentum builds for a so-called federal insurance backstop, those who have studied the idea of creating a financial cushion to steel the economy against catastrophic cyber incidents increasingly see it as a tool for doing a whole lot more than the name implies. Beyond serving as a rainy day fund for the long-prophesied cyber deluge, researchers believe the policy could be used to restore the original promise of the cyber insurance industry, coaxing insurers into enforcing better cybersecurity practices from their clients and taking a bite out of the high sticker price that increasingly adorns cyber insurance policies. How it would work — Beyond identifying which incidents would trigger a federal bailout and funding the program itself, legislators could set requirements for private insurers to qualify for federal support, said Sasha Romanosky, a senior policy researcher at RAND who is conducting ongoing research about the idea. By conditioning government aid on compliance with cybersecurity standards, the federal government could needle private insurers to enforce better cyber hygiene standards over their policyholders and free up new coverage for less well-off firms, said Romanosky. Properly constructed, the initiative could "help the cyber insurance market, reduce risk, provide information we otherwise lack, and…be a good forcing function for companies," he said. Avoiding the war exclusion — Legislators could also use a conditional backstop to clear up some of the legal and contractual uncertainty surrounding insurance exclusions for cyber incidents, said Bryan Cunningham, executive director of the Cybersecurity Research and Policy Institute at the University of California Irvine. In a few notable cases, cyber insurers have argued they have no obligation to cover attacks resulting from acts of war — a standard that is difficult to adjudicate in the digital domain, where attribution is imprecise and malefactors often launch attacks outside declared conflict. But Cunningham — who published a paper on the backstop last year — told MC that legislators could require the government to declare what incidents would qualify. Thus, it could "get rid of massive litigation risk" in private markets, preventing insurers and insureds from waging costly legal battles in the muddy trenches of cyber attribution. What's next — The Treasury Department's Federal Insurance Office closed a public comment period on the cyber emergency fund in December, after the idea wormed its way from the inaugural report of the Cyberspace Solarium Commission to Congress and the White House. But policymakers and executive branch officials have plenty left to iron out, said Romanosky, and they might opt for something far less ambitious than a highly qualified backstop — at least in the short term. "There's momentum, there's impetus behind creating something," he said. And if they want, lawmakers could always advance something simple now and "amend it later on."
| 
Comments
Post a Comment