A cyber underwriter believes it is examining a company and is in fact examining a document describing a company. The gap between the two has a seldom-used name and it is called the perimeter: which entities are insured, which systems they run, and which of those systems talk to each other. The previous lesson dealt with the questionnaire's truthfulness, that is, the quality of the answers. This one deals with what the questionnaire does not ask, and that is another matter: an answer can be perfectly accurate about a perimeter that is not the perimeter of the risk.
The commonest configuration is the recently acquired subsidiary. A group buys a company, consolidates it in its accounts, adds it to the schedule of insureds at the next renewal, and describes in the questionnaire the group's security policy: two-factor authentication, patching within fifteen days, tested backups. All of that is true of the group's information system. None of it is yet true of the subsidiary, whose network runs on its own servers, with its own directory and its own administration accounts, and whose integration is an eighteen-month project. The declaration is truthful and the cover attaches to a risk that was not described.
One must therefore know that the IT integration of an acquisition follows a particular curve, producing maximum risk in the middle and not at the start. So long as the two networks are separate, an attacker entering the subsidiary stays in the subsidiary. The day a trust link is opened to share a directory, a mail system or a payroll tool, a path is created between them before practices have been aligned. The dangerous period begins at the first interconnection and ends at the last harmonization, and it is precisely the period during which nobody can say who administers what.
Three other blind spots recur and deserve naming in themselves. The first is the joint venture, half owned, appearing on no insurance organigram because neither side considers it its own, and yet sharing access with both shareholders. The second is the overseas establishment, often small, with a local IT person and a maintenance contract signed on the spot, escaping head office policy for reasons of language as much as governance. The third is the entity being sold, whose security nobody funds any more because it is already thought of as gone.
Then comes the question that decides the real extent of the loss, and it bears not on entities but on links. A group whose ten subsidiaries run ten independent systems faces ten possible losses, each bounded to one subsidiary. A group whose ten subsidiaries share a single directory faces one possible loss, taking all of them in a night. Both groups complete the same questionnaire, declare the same turnover and the same headcount, and do not carry the same risk. The question to ask fits in one sentence: is there an account, a directory or an administration tool whose compromise would open more than one entity.
That question also arises for the insured, on its own account, because it decides what it should be asking for. A group that has measured its links knows what share of its activity can stop at once, and that share is what its business interruption cover has to absorb. A group that has not measured them sizes its program on its largest subsidiary and discovers at the loss that it should have sized it on their sum. No market questionnaire asks this, which makes it all the more worth asking.
The discipline therefore comes to three steps preceding any quotation. Have the schedule of insured entities produced and set against the real legal organigram, joint ventures and overseas establishments included, rather than against last year's schedule. Ask, for each entity, since when it has been integrated and by which link. And ask the question of the account that opens more than one entity, accepting that the answer may be that nobody knows, for that answer is information and not a refusal: it says the extent of the loss is not bounded, and that is an underwriting fact.
A specialist retail group, 1,400 employees, presents at its July 1 renewal an impeccable questionnaire: two-factor authentication everywhere, patching within ten days, offline backups tested twice a year, up-to-date inventory. The underwriter notes that the schedule of insureds lists eleven entities against nine last year. Asked about it, the broker explains that two companies were bought in February, one of 60 employees in France, the other of 25 in Spain, and that their IT integration is planned over eighteen months. The group's security manager adds that a directory link was opened in May with the French company to give access to the group mail system, and that the Spanish company remains entirely separate. What should be done with this submission?
The questionnaire is accurate and it describes a perimeter that is not the perimeter of the risk, which is exactly the configuration of this lesson: there is no misstatement to hunt for, there is an out-of-frame to measure. The eleven entities do not all get the same treatment, and the useful sort is not French against Spanish, it is linked against separate. The Spanish company, entirely separate, is the simplest case: it carries its own risk, bounded to itself, and twenty-five employees in Spain under a local policy can be priced or conditioned without the rest of the group being exposed; it is a small and known risk. The French company is the submission's real subject, and it sits exactly in the middle of the dangerous curve. The directory link opened in May creates a path between a network aligned with group policy and a network not yet aligned, and it created it two months before this renewal, with eighteen months of harmonization not begun. The declaration of two-factor authentication everywhere therefore has to be checked on one precise point: does it cover the French subsidiary's administration accounts, the ones that existed before the acquisition and that nobody has inventoried, or only the group's accounts. The question that decides extent comes next and is asked as it stands: since May, is there an account whose compromise would open both the subsidiary and the group. If so, the maximum loss is no longer bounded to 60 employees but to 1,400, and that is a change of nature, not of degree. Three steps follow, and none is a declinature. Ask for the inventory of the French subsidiary's administration accounts and the date they come under group policy. Handle the point by a condition bearing on it, with a date, rather than by a price that would correct nothing. And check with the broker that the business interruption cover was sized on the assumption that the group and the subsidiary stop together, since that assumption has existed since May.
- 01An answer can be perfectly accurate about a perimeter that is not the perimeter of the risk: that is not a truthfulness problem, it is an out-of-frame.
- 02Integrating an acquisition produces its maximum risk in the middle: the danger starts at the first interconnection, not at signing.
- 03Joint venture, overseas establishment, entity being sold: three entities no insurance organigram carries and that nonetheless hold access.
- 04The question that decides extent bears not on entities but on links: is there an account that would open more than one entity.
- 05"We do not know" is underwriting information, not a refusal to answer: it says the extent of the loss is not bounded.