Cyber hygiene
The set of minimum cybersecurity practices and measures that any organization should implement to reduce its exposure to common cyber threats.
On May 7, 2021, Colonial Pipeline shut down the line that carries fuel to the US East Coast. The DarkSide ransomware had come in through a legacy VPN account with no multi-factor authentication, as its CEO, Joseph Blount, acknowledged before the Senate on June 8. Cyber hygiene refers to the baseline of cybersecurity practices considered necessary and non-negotiable for any organization, regardless of its size or sector. It typically covers regular software and system updates, multi-factor authentication for sensitive access, rigorous backup management with regular testing, network segmentation, phishing awareness training for users, and identity and privileged access management. The NIS2 Directive wrote this baseline into European law through Article 21, which lists ten categories of mandatory measures for essential and important entities. For cyber insurers, cyber hygiene is the first underwriting filter, the level below which a risk becomes either uninsurable or insured only on very restrictive terms. The concept has moved with the threats: the 2020 standard rarely included continuous behavioral monitoring or least-privilege access segmentation, which are now part of the expected minimum. NIS2 gives cyber hygiene a legal dimension, so its absence is a sanctionable regulatory breach as well as an aggravating factor at underwriting.
Textbook case: when renewing its cyber policy, an industrial SME submits an underwriting questionnaire showing no multi-factor authentication on its remote access and no tested backups for eighteen months. The insurer declines to renew on previous terms, citing an insufficient level of cyber hygiene. It offers a policy with a doubled deductible and a sub-limit for incidents linked to unprotected access, and makes a return to normal terms conditional on rolling out multi-factor authentication within three months of the effective date.
- U.S. Senate, Committee on Homeland Security and Governmental Affairs, hearing of June 8, 2021, testimony of Joseph Blount, CEO of Colonial Pipeline
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.