Voluntary shutdown
An extension of cyber business interruption covering a shutdown decided by the insured itself to contain an incident, while its systems are not yet, or not all, affected.
Cyber business interruption was long drafted as the consequence of a system interruption caused by an incident. Yet in real attacks, a large part of the outage comes not from the attack but from the insured's decision to shut everything down to prevent spread: disconnecting sites, suspending production, isolating industrial networks. Strict wording left that loss uncovered, since no system had been interrupted by the attacker. The voluntary shutdown extension fixes the flaw by covering a shutdown reasonably decided to contain an actual incident or limit its consequences, sometimes at an authority's request. It raises a moral hazard question for the underwriter: an insured might prolong the outage beyond what is necessary. Policies respond with a demanding definition of a reasonable decision, a time deductible and, often, a sublimit or maximum duration. The cover illustrates a trait specific to cyber: the best crisis management decision can cost more than the technical damage, and insurance must encourage it rather than penalize it.
Hit by ransomware on March 19, 2019, the aluminum group Norsk Hydro isolated its plants and switched several production lines to manual operation, and estimated the total cost of the attack at about 800 million Norwegian kroner. A large part of the loss came from that slowdown decided to contain the attack, not from the encryption itself.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.