Cyber incident response panel
A list of vendors preselected by the insurer, lawyers, investigators, negotiators, communicators, that the insured calls on in an incident at negotiated rates, and whose use sometimes conditions reimbursement.
The panel is the set of vendors that the cyber insurer has preselected and with whom it has negotiated rates and response-time commitments: breach coaches, forensic firms, negotiators, restoration specialists, crisis communication agencies, notification call centers, credit monitoring services. In an incident, the insured calls a hotline and the setup is in place within hours, without having to find and contract vendors in the middle of a crisis. The policy often provides that costs incurred with an off-panel vendor are reimbursed only with the insurer's prior consent, or up to panel rates. The arrangement serves both parties: the insured gets an immediate, proven response, and the insurer controls the cost and quality of a service on which claim severity depends. It does, however, raise a governance question for large insureds, who already have vendors under contract who know their systems, and whom the panel might sideline at the moment their knowledge is most valuable. Hence the practice of pre-approving the insured's own vendors.
Textbook case: a midsize company hit by ransomware on a Saturday calls its insurer's hotline at 10 p.m.: a breach coach is appointed within the hour, a forensic team is connected to its systems on Sunday morning, and a negotiator contacts the attackers on Sunday afternoon, all at panel rates.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.