Risk Assessment

When you apply for cyber insurance showing that your organization uses modern security controls and a Written Information Security Program (WISP), carriers will offer the lowest rates possible.

There is a difference between checking 'yes' on the self-assessment questionnaire for the "Are all your endpoints secured with anti-virus?", versus providing a document with each endpoint under your management, with the exact version of protection it has installed. Having a living and breathing WISP, loads of documentation, supporting evidence, and documented procedures for various scenarios, makes all the difference.

When everything is documented in the WISP, it’s difficult to deny a claim when a policy was written based on all the evidence provided.

Most common reasons for claims getting denied:

• Failure to provide evidence

• Absence of an incident response plan and practice

• Insufficient security on endpoints

• Inadequate security on vendors

• Lack of education and awareness (Not just phishing)

Carries are looking more and more for their policyholder's knowledge on controls and documentation.

It may become harder to gain insurance due to lack of competition in the space and market limitations. For example, it’s more difficult right now as a Florida business, homeowner, or even the hobbyist airplane industry.

When insurance providers pull out of the industry or the competition is tight, insurance companies can be much pickier with their policy holders. Being compliant ensures you have the best chances to secure a policy.

Insurance companies and other entities are suing their policyholders and vendors for non-compliance. In case of an incident, some carriers are more than just denying the claim, but are actually pressing charges on the insured because of fraudulent, misrepresented, or falsified applications. Vendors may sue for damages due to negligence or misrepresentation in case of an incident that indirectly affects them.

When you implement technical controls, a WISP is used to document and retain all evidence of the said control, remediation, or rule set. The WISP contains all the technical proof that everything is as it should be, and the journey is ever-evolving.

More businesses are starting to make decisions on who to work with based solely on Insurance and Compliance regulations. Would you ever hire a roofer for a major project without verifying their business liability insurance, OSHA compliance and reputation? More and more companies today want to verify that their partners have Cyber insurance before doing business with them, especially when sharing private and confidential information with them.

Businesses are more likely to trust you when you show that you comply with regulation standards. When you can present evidence of regulatory compliance, third-party assessment results, and have documented processes, it shows that your business is worthy of trust with private, personal and confidential information.

Meeting multiple regulatory compliance standards is not something that is taken lightly and is certainly no small feat! It’s like giving your business multiple prestigious degrees and accreditations. Not all organizations you encounter may recognize what these are, or even care about them--but those that do will be exactly the ones you want to work with, because they can sense the value and care you place in your company. It’s likely that they hold their own company to the same standard as well!

Having well-documented security controls and a WISP (Written Information Security Process) allows us to Provide Evidence instead of just submitting Yes or No answers on Cyber Insurance self-assessments. Attaching evidence for every single question, submitting a list of devices, backup data, etc. nets us the best possible outcomes with Cyber Insurance underwriters.