Last Updated 5/27/2021
Issue: Cybersecurity is perhaps one of the most important topics for the insurance sector today. Insurers and insurance producers must protect the highly sensitive consumer financial and health information collected as part of the underwriting and claims processes. This personally identifiable information (PII) is entrusted to the industry by the public.
Amid the rising incidence of cyberattacks and the growing number of high-profile data breaches, the government has stepped up its scrutiny of cybersecurity. This has led to increasing calls for legislation and regulation for enhanced cybersecurity measures to address the numerous risks posed by a cyberattack, including, but not limited to: (1) identity theft; (2) business interruption; (3) damage to reputation; (4) data repair costs; (5) theft of customer lists or trade secrets; (6) hardware and software repair costs; (7) credit monitoring services for impacted consumers; and (8) litigation costs. Most commercial property and general liability policies do not cover cyber risks, and cyber insurance policies are highly customized for clients. In 2019, premiums were estimated at around $3.15 billion, a slight decrease of .22% from the prior year. This number reflects both stand-alone cybersecurity insurance products as well as those writing cybersecurity insurance as part of a package policy. It also includes alien surplus lines data, which the NAIC began collecting in 2016.
The National Institute of Standards and Technology (NIST) has provided a framework for improving critical infrastructure cybersecurity, most recently updated in 2018. The framework provides a structure of standards, guidelines, and practices to aid organizations, regulators, and customers with critical infrastructures in effectively managing their cyber risks., most recently updated in 2018. The framework provides a structure of standards, guidelines and practices to aid organizations, regulators and customers with critical infrastructures in effectively managing their cyber risks.
State insurance regulators serve on the U.S. Department of the Treasury's (Treasury Department) Financial Banking and Information Infrastructure Committee (FBIIC) where they work with federal regulators to address cyber threats in the United States. State insurance regulators continue to monitor cybersecurity in the insurance sector closely. In addition, regulators work with insurers to resolve immediate concerns when a data breach occurs at an insurance company. State insurance regulators are also in the unique position of regulating and monitoring the solvency and market activities of insurance carriers underwriting cybersecurity policies.
Status: Prior to moving the cybersecurity charge to the Innovation and Technology (EX) Task Force in 2017, the NAIC membership adopted several Cybersecurity (EX) Working Group recommendations:
- Adopted the Principles for Effective Cybersecurity: Insurance Regulatory Guidance.
- Adopted the NAIC Roadmap for Cybersecurity Consumer Protections, a project aimed at bolstering consumer protection.
- Updated the Financial Condition Examiners Handbook for revised cybersecurity protocols.
- Recommended the Market Regulation Handbook be updated similarly.
- Adopted the new Insurance Data Security Model Law (#668) which requires insurers and other entities licensed by state insurance departments to develop, implement and maintain an information security program; investigate any cybersecurity events; and notify the state insurance commissioner of such events. Thirteen states have adopted the model to date.
The cybersecurity charges are now in the Property and Casualty Insurance (C) Committee. (Exact charge: Report on the cyber insurance market including data reported within the Cybersecurity Insurance and Identity Theft Coverage Supplement.)
In addition, the NAIC membership adopted a Cybersecurity Insurance and Identity Theft Coverage Supplement for the property/casualty annual financial statement to collect information about cybersecurity insurance markets. Filings have been received for data from 2015 - 2019. Analysis of 2019 data showed approximately 577 insurers provided business and individuals with cyber insurance in the U.S.
Committees Active on This Topic
February 2020, NAIC Consumer Resource
NAIC Passes Insurance Data Security Model Law
Cybersecurity model law creates information security standards for insurers