Cyber insurance application
The form by which a cyber insurance applicant declares its security measures, which since 2021 has become a decisive contractual document whose inaccurate answer can void the cover.
The cyber insurance application gathers the applicant's statements on its business, its data and above all its security measures: multi-factor authentication on remote access, email and privileged accounts, isolated and tested backups, endpoint detection tools, patching timelines, phishing training, incident response plan. Until 2020 the document was brief and little read. The ransomware wave of 2020 and 2021 transformed it: insurers added ransomware-specific supplements, made cover conditional on affirmative answers, and began checking statements through external scans. Legally, the answers are risk disclosures, and their inaccuracy exposes the insured to the sanctions for misrepresentation, from proportional reduction to voidance depending on good or bad faith and the governing law. For the underwriter, the application is both the selection tool and the main source of moral hazard, since it rests on the word of a signatory who is not always the person who knows the systems.
In 2022, a US insurer obtained from a federal court in Illinois the rescission of a cyber policy bought by a services company, after a ransomware attack, on the ground that the application stated multi-factor authentication was in use when it protected only the firewall and not the servers: the insured agreed to the rescission, and the cover fell with its statement.
cyber proposal form, cyber application, ransomware supplemental application
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.