Cyber Insurance Is Great – Except When It’s Not

It would be great if cybersecurity insurance provided an affordable, reliable means of protecting your business from the innumerable cyber threats it faces today.

Unfortunately, it doesn’t. While cyber insurance has its purposes and can be a good investment, it’s hardly a panacea when defending against cybersecurity risks. It’s a type of product that has hit a “plateau,” as Harvard Business Review puts it because cyber insurance has not evolved quickly enough to meet modern security threats.

That’s why, for example, cyber insurance won’t reliably protect you against supply chain security attacks. Even if you find a policy that does address supply chain threats, actually claiming your insurance benefit may take so long that the insurance doesn’t end up doing your business much good following a significant breach.

Please keep reading for an overview of the advantages and drawbacks of cyber insurance and tips on when it does and doesn’t make sense to rely on cyber insurance alone.

Here’s the top reasons why CMMC will be good for your business

What Does Cyber Insurance Cover?

Cyber insurance was introduced in the 1990s and was hailed to protect against IT-related risks that are typically not covered by other types of business insurance. The original intent was to give companies a means of protecting against the financial fallout resulting from data breaches and disruptions to critical IT systems.

Several insurance companies offer cyber insurance today, including Hiscox, The Hartford, CNA, and Nationwide.

5 Potential Disadvantages of Cyber Insurance

On the surface, cyber insurance probably sounds like a simple way to make sure a cyber attack doesn’t render your business bankrupt. In reality, though, cyber insurance isn’t necessarily so rosy. There are a number of potential pitfalls or drawbacks to purchasing cyber insurance.

1. High Costs

The first is the simple cost of cyber insurance. Although cyber insurance premiums were relatively affordable in the past, they have surged in cost in recent years, as this graph of policy costs shows:

Source: https://blog.alta.org/2021/09/cyber-coverage-premiums-increase-25-survey-shows.html

Thus, the cost of cyber insurance may be too high for many businesses today.

2. Management Challenges

Cyber insurance is not a set-it-and-forget-it affair. You have to manage your coverage actively by ensuring that your policy is kept up-to-date as your risks change – which they typically will, because you’ll roll out new systems or collect new types of data, for example, your original policy may not have covered that.

Most cyber insurance policies also place strict requirements on the insured to keep detailed records, secure their systems, and manage risks. If you fail to demonstrate that you took the steps required to protect your business against a breach, an insurer may deny your claim.

This isn’t to say that managing cyber insurance is infeasible. But it is to say that businesses shouldn’t underestimate how much effort goes into it.

3. Coverage Limitations

It’s easy to fall into the trap of assuming that as long as you’ve purchased cyber insurance, you’re covered against any and all cyber-related risks.

The truth, unfortunately, is that cyber insurance policies will always have exclusions or limitations regarding what they cover. “Insurers are demanding great security and are cutting back the amounts of cover they are willing to offer,” ZDNet reports. If you don’t read your policy disclosures very carefully, you may find that a breach you thought was covered is not.

Also, remember that merely interpreting coverage rules can be complicated – so complex that you may need to go to court to prove you are entitled to coverage. That’s what Merck had to do in a recent claim involving $1.4 billion in losses following a cyberattack. Merck, whose insurer said the claim was excluded from its cyber insurance policy because it was an act of war instead of a standard cyberattack, prevailed in that case.

But for smaller companies, in particular, this should be a warning: Going to court to defend your cyber insurance entitlements can be costly and time-consuming. Even if you have a legitimate claim, you may never get a payout if your insurer contests it and you lack the resources to defend it.

4. Claiming Insurance Takes Time

Even if you don’t have to go to court to get your insurer to payout, there’s no guarantee that cyber insurance will result in immediate financial assistance following a breach. The claims process could take months or even years, especially if it requires collecting detailed information about the source of a breach to determine whether the breach is covered.

If a cyber event causes significant financial disruption, then your business may not be able to survive it if the insurance claim process takes too long.

5. The Supply Chain is Not Insured.

In general, cyber insurance covers risks that affect your IT resources directly. Software supply chain threats originate in third-party systems and are not usually covered.

This is especially bad news given that advanced supply chain attacks are projected to increase by about 650 percent in the coming years. It means that investing in cyber insurance is not reliable for protecting against supply chain risks. For that, you need different tools – like a software supply chain risk assessment and disclosure platform.

Here is your supply chain security crisis management plan

The Future of Cyber Insurance

Cyber insurance may well evolve to close the gaps described above in the future. We may see a reduction in costs, for example, or the creation of new policies that specifically address supply chain risks. Indeed, the U.S. Government Accountability Office has found that more insurers are creating dedicated cyber insurance policies, which could lead to more comprehensive coverage down the line.

Even if that happens, though, it’s impossible to guarantee that any cyber insurance product will fully protect your business against all threats. That’s why it’s critical to invest in other tools that help you detect and respond to risks. The security blanket of a cyber insurance policy doesn’t suffice to keep your business safe.

We agree, by all means, to invest in cyber insurance if it makes sense for your business. But don’t blindly entrust your company’s financial health to insurance alone.

Instead, invest as well in solutions like Findings, which automates cyber risk assessment and management – including not just within your business’s environment but across your supply chain. 

Most compliance frameworks change from time to time. But it’s sporadic to see the exceptional level of change that the Cybersecurity Model Maturity Certification, or CMMC, is currently undergoing. In a bid to make CMMC compliance more straightforward and affordable – and, by extension, help smaller businesses sign contracts with the U.S. Department of Defense, which requires CMMC compliance from its vendors – the U.S. federal government has revamped or rewritten critical components of the CMMC. The updated version is known as CMMC 2.0.

But, if you follow compliance news, you probably already know that the CMMC is evolving. You may not yet know what the CMMC changes mean for the typical business.

To provide some insight into that topic, here’s a look at the top three changes likely to result from the CMMC overhaul. Changes have already started to take effect over 2021 and will continue throughout 2022 for many businesses as they adapt to the brave new world of CMMC 2.0.

Here are the CMMC Compliance Requirements: Everything You Need To Know

Prediction 1: Increased CMMC compliance self-assessments

One of the most meaningful updates the government has made to CMMC is allowing self-attestation of compliance. Previously, businesses hired outside auditors to attest to their CMMC compliance.

Couple that change with the fact that the CMMC 2.0 has only three compliance steps instead of five, and it would seem very likely that we’ll see more and more businesses performing CMMC self-assessments in 2022 and beyond. Instead of hiring outside auditors and consultants, companies will take the more cost-effective self-assessment approach.

This change will also likely translate into a more significant number of SMBs becoming CMMC-compliant. In the days of CMMC 1.0, when compliance assessments cost a lot more, it was harder for smaller businesses to gain compliance attestation.

It’s essential to keep in mind that not every business can self-attest, of course. According to the DoD, only about 140,000 of the 220,000 total companies in the defense industrial base hold “federal contract-related data,” which entitles them to self-assessments. The rest will have to use the traditional, more costly assessment approach to get a higher level of assessment.

There are specific procedures to follow, including having a senior company official attest to your compliance and submitting the attestation to the Supplier Performance Risk System (SPRS). Keep in mind, too, that even if you self-assess, you can’t simply file a report and call your business CMMC-compliant. Still, the process is cheaper and easier than relying on outside consultants.

Prediction 2: More CMMC compliance transparency

More self-assessments will likely also contribute to a tendency among companies to embrace the principle of transparency when it comes to CMMC compliance. That’s because disclosing security vulnerabilities is an essential step toward making self-attestations credible.

As a result, expect transparency to become the rule, not the exception, for companies pursuing CMMC compliance. In particular, more businesses are likely to establish vulnerability disclosure programs to communicate clearly about security issues.

This will mark a significant shift from the present. Traditionally, companies have tended to be tight-lipped about vulnerabilities. They had only disclosed them when they were legally required to do so. But in the future, adopting a transparency approach to security and openness will help businesses establish their credibility and good-faith commitment to the CMMC – and, by extension, it will help position them to win government contracts.

Prediction 3: CMMC compliance will demand-supply chain security automation

While VDPs are one step toward transparency and self-assessing your CMMC compliance, another critical practice is automating software supply chain security. Given the sharp uptick in software supply chain security risks, that’s especially true.

Supply chain security automation tools make it fast and accessible to identify security risks within the supply chain and document and disclose them based on compliance requirements. Instead of manually tracking and disclosing risks, as they do today, businesses seeking CMMC compliance are likely to embrace supply chain security automation.

SMBs, in particular, are poised to take more significant advantage of supply chain security automation tooling, which will help them decrease compliance costs and complexity. (This is another reason, by the way, why the updated CMMC framework is likely to result in more involvement by SMBs in the CMMC space.)

Crystal balls

These are our predictions about how CMMC 2.0 will change the way businesses approach CMMC compliance. But since we here at Findings have built a world-class supply chain security and compliance automation platform, we’d like to think we have a pretty well-informed perspective on this topic.

We’d also like to think that, as more and more businesses seek solutions for automating CMMC compliance, they’ll turn to Findings. Findings offer the automated assessments, best practice recommendations, and reporting features businesses to need to self-assess and simplify compliance operations. In turn, it reduces the number of questions you need to answer during compliance processes from hundreds to just a few.

Ultimately, Findings places compliance with frameworks like CMMC within reach of every business, not just those with teams of compliance experts and expensive compliance consultants.

Learn more by signing up for a free trial

In third-party risk management, inherent risk is defined as the level of risk on your organization.

Therefore, the inherent risk represents the natural level of risk that your organization will incur by working with a particular vendor (without managing that risk and/or mitigating security gaps).

Why is Inherent Risk so Important?

As a work tool, inherent risk enables the security team to map the organization’s critical vendors. Subsequently, the organization can prioritize the third-party assessment process.

Here is a quick example:

Let’s assess two vendors: Vendor A and Vendor B.

Vendor A offers on-premises software development services with an inherent risk score of 80. The score is calculated by:
The risk from potential data leakage from unsecured development methods;
Exposure to the company’s business information and procedures; and
Exposure to employee personal identifiable information (PII).

Conversely, Vendor B offers a cloud-based Security as a Software (SAAS) product with an inherent risk score of 86. The score is calculated by:
An additional, potential uncontrolled attacking vector;
The cloud service provider and the vendor’s implemented security controls; and
The service availability risk.

By mapping all of the potential ‘known’ risk factors, the security team can prioritize an assessment audit for Vendor B because Vendor B’s inherent risk score is higher than Vendor A’s. 

Inherent Risk vs. Residual Risk

The difference between inherent risk and residual risk is that inherent risk represents the risk score before the organization takes any action to mitigate the risk. (The residual risk, therefore, represents the risk remaining after the vendor replied to a security/regulatory assessment request, and all the gaps have been mitigated.)

More significantly, residual risk is the risk an organization is willing to take after all considerations have been accounted for.

How to Create an Inherent Risk Score Methodology?

To calculate the inherent risk for a vendor, the organization’s security team needs to consider all the aspects of the organization that the vendor’s proposed service can compromise.

A handful of examples are as follows:

1. Technology – In case of downtime, how the technology will affect your service.
2. Compliance – Appreciating the vendor’s compliance with the relevant regulations and how it processes their data.
3. Legal – Exposure to lawsuits and fines.
4. Privacy – The risk from handling, managing, and/or processing PII by third-party vendors.
5. Business Continuity Plan (BCP) – Continuity, availability, and integrity are the three key factors of risk that an organization will be exposed to whenever they work with a vendor.

To create an effective inherent risk methodology, you must consider:
a. The impact of the vendor’s service on your business; and
b. The probability (or, rather, the likelihood) that their service will become an issue to your organization.

Ultimately, during the procurement or ongoing process, you need to ask (either yourself or the relevant personnel in the organization) a set of questions. The answers to those answers will enable you to produce a risk score that provides you/your organization with a clear understanding of the threat your organization faces due to working with a particular vendor.

How to Implement a Successful Onboarding Process for a Vendor?

A security assessment process is a lengthy one, mainly if the assessment is done manually over an excel spreadsheet.

Generally speaking, the process for many organizations contains:

1. A new vendor starts the procurement process;
2. The procurement officer approaches the security team;
3. The security team return to the procurement officer with the inherent risk (vendor profiling) questions;
4. The procurement officer sends the assessment to the vendor by email in an excel spreadsheet.
5. The vendor answers the questions in the excel spreadsheet (or ignores them).
6. A final decision is made.

The described process may take between three to four months to complete, and this does not even take into consideration:

a. The gaps that may have been found during this process (the residual risk);
b. The reduction plan that the vendor needs to respond to; and 
c. The high risk the organization may face is because of the time that passes from starting to work with the vendor to the mitigation of the gaps.

Furthermore, the security team faces significant problems managing the risks from all the other third parties working with the organization by conducting a manual process. 

Neglecting the “Longtail” Vendors

Due to the effort, time, human resources, and cost of maintaining the onboarding mentioned above process for all the organization’s third-party vendors, organizations tend to focus on 15%-20% of their most critical vendors. Consequently, organizations tend to neglect their “longtail” vendors, i.e., small, low- to medium-risk vendors.

At Findings, we conducted an internal study that found organizations at an astonishing 30% exposure to significant market vulnerabilities (SolarWinds, Kasya, etc…) due to their neglect of their “longtail” vendors.

Since the COVID-19 pandemic started, it has become routine for nefarious players online to exploit the vulnerabilities of third-party vendors to attack an organization. An organization can’t “hope for the best” anymore. The security team must scale the process to the entire supply chain.

How to Streamline the Procurement/Security Process? 

To set, manage, and scale an efficient third-party assessment process that will enable all parties to have a continuous, hands-on capability, the organization must streamline the process using automation tools.

By implementing an automation tool, you need to look for a service that supports the process end-to-end, one that gives you the flexibility to make changes and adjustments when necessary.

Findings’ Approach to Inherent Risk

1. Streamline the internal process between departments to evaluate the inherent risk for every vendor rapidly;
2. Provide a pre-defined inherent risk model; and
3. Customize your own inherent risk.

How Can You streamline the Internal Process between Departments to Evaluate a Vendor’s Inherent Risk?

Findings have replaced internal back and forth communication by emails during the onboarding process of a potential new vendor or as an ongoing requirement by regulations. Instead, we used the questions found in the excel spreadsheet (the “questionnaire”) and wrapped them into a process that we call “BO” (Business Owner). In other words, our platform enables an internal resource to open a new vendor audit request to the security team.

Additionally, the process is designed to automatically produce an inherent risk score, so the security team only needs to open the new request, see the score, and prioritize accordingly.

Lastly, every member of the process is always notified whenever there is a change in the vendor’s status during the process.