US federal response to catastrophic cyber risk
Work undertaken since 2022 by the US Treasury's Federal Insurance Office on whether a public mechanism should cover catastrophic cyberattacks the private market cannot carry alone.
The cyber insurance market can absorb individual losses and mid-sized events. It cannot alone carry a systemic cyberattack that simultaneously paralyzed an entire sector, a power grid or a payment system: the accumulation would exceed its capital, and war and infrastructure exclusions already leave a large share of these scenarios uncovered. In the United States, the public terrorism program covers cyber acts that would be certified as terrorism, but such certification has never been issued for a cyberattack and does not cover acts by a state. In September 2022, the Federal Insurance Office, part of the Treasury Department, launched a consultation on whether a federal response to catastrophic cyber incidents was warranted, following a recommendation from Congress's watchdog. The work examined options: public reinsurance above a threshold, a market pool, a terrorism-style mechanism. No scheme has been created to date. The question arises in other countries, where schemes such as the UK terrorism pool already cover some cyber acts. It goes to the heart of AlgoPolis's course: when cyber risk becomes political by its author or its scale, who carries it, and at what price?
On September 29, 2022, the US Treasury's Federal Insurance Office issued a request for comment on whether a federal insurance response to catastrophic cyber events is warranted, following up on a June 2022 Government Accountability Office report that had recommended studying the question.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.