13 February 2017Analysis

Captives provide flexibility in managing non-standardised cyber risk

Captive insurance can offer advantages to companies looking to protect their business against cyber threats, according to Steve Kinion, director of the Bureau of Captive and Financial Insurance Products at the ‎Delaware Insurance Department.

A lack of a standardised policy form for cyber coverage in the US along with being able to fill in the exclusions contained in commercially available cyber policies are among the reasons for opting to insure cyber risk with a captive insurer, Kinion explained.

Kinion told Captive International that many commercial insurance policies are sold under a variety of names that often do not meet the specific need of a company.
He suggested that captive insurance policies can provide a wider scope of coverage with regard to defending against the risk.

“So you have to couple this with the state data breach laws in the United States. Right now, data breach is primarily handled on a state-by-state basis in terms of what a company or a business must do in the event of a data breach,” he said.

Many states in the US have a requirement that a company conducts some form of regulatory investigation if it suffers a breach, for example.

Kinion said there is a lot of confusion as to what it means to conduct a reasonable investigation into a cyber breach, as they are usually detailed on a case-by-case basis.
He suggested that it is unclear what exactly is meant by the requirement to conduct an investigation. “Does that mean that you must hire a cyber security specialist to figure out where the holes are in your security systems? Or does that mean you must hire other forms of consultancy?”

In the US there are investigatory costs, and not all insurance policies may cover this, Kinion added.

“These costs may be for litigation if there is actually a formal lawsuit, but not at the investigatory stage. There's coverage against litigation but maybe not against the investigation.”

Kinion said that a captive issued policy can provide coverage for this stage, which is typically very costly.

Did you enjoy reading this story?  Sign up to our free weekly newsletters and get stories like this sent straight to your inbox.