Public backstop
A mechanism by which the public authority takes on the catastrophic share of a risk that the private market cannot absorb.
On March 2, 2023, the White House National Cybersecurity Strategy called for a study of a federal insurance response to a catastrophic cyber event. A public backstop is a last-resort mechanism: the government covers the share of a risk that exceeds what the private market can carry. It addresses fundamental risks, too correlated and too large to pool. Terrorism is the clearest precedent, with Pool Re in the UK, the TRIA program in the US and GAREAT in France. The same debate has opened for catastrophic cyber and hybrid war. But a backstop runs into the same obstacle as the exclusion it would complement. Someone has to define the event that triggers it, which brings back the problems of attribution and characterization. Too broad, it subsidizes imprudence and creates moral hazard; too narrow, it leaves the victims of unattributable attacks without relief.
Just as GAREAT, set up in 2002, pools terrorism risk with, above a threshold and once its private reinsurance is exhausted, the unlimited State guarantee carried by CCR, a cyber public backstop would intervene after the most devastating attacks that insurers cannot bear alone.
- GAREAT, AMRAE technical note (2019); Atlas Magazine, "Le pool Gareat renouvelé pour cinq ans" (managed by CCR, unlimited State guarantee)
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.