Bank regulators issue guidance on cyber insurance

Thompson Coburn LLP
Contact

Thompson Coburn LLP

Federal bank regulators issued a statement on April 10 alerting banks of risk management issues regarding cyber insurance coverage.

The statement was issued jointly by the Federal Reserve, FDIC, OCC, NCUA and CFPB through their affiliation in the Federal Financial Institutions Examination Council (FFIEC).

Statement cites cyber incident risk and role of insurance

The statement acknowledges the increasing number and sophistication of cyber incidents, such as data breaches, that make consideration and evaluation of cyber insurance protections worthwhile for banks of all sizes.

Although the regulators do not require banks to obtain cyber insurance coverage, the statement explains that such coverage can be an important part of a bank’s overall risk management program by offsetting losses stemming from cyber incident risks. Those losses can result from customer identity theft, fraud and even extortion. Losses can include income decreases, lawsuits, regulatory fines and reputation damage.

Evaluation of cyber insurance coverage and related risks

In considering a cyber insurance policy, the statement advises each bank to involve multiple stakeholders within its organization (for example, legal, risk management, IT and financial staff) to review the bank’s existing control environment and related cyber risks. The statement also advises banks to consider due diligence to evaluate existing and potential cyber insurance coverage by:

  • Reviewing coverage scope and identifying gaps;
  • Understanding coverage triggers, limits, sub-limits, exclusions and costs;
  • Assessing the financial strength and claims paying history of the insurance carrier;
  • Understanding the policy’s risk management requirements for the bank that may impact coverage; and
  • Avoiding over-reliance on insurance coverage to mitigate cyber risks.

Cyber insurance policy variances

Cyber insurance can be obtained in stand-alone policies. General liability and other types of standard insurance policies may include some coverage for cyber incidents, but banks should not assume this without confirmation. The standard general liability policy, typical directors’ and officers’ liability policies, and many other liability policies are unlikely to satisfy first party loss suffered by the insured, including its expenses in responding to a cyber incident.

Cyber insurance policy coverage can vary greatly by provider and policy type, so banks should be careful to ensure that they fully understand their existing and potential coverage to properly manage cyber risks.

Thompson Coburn cyber insurance program and cyber incident response practice

In 2017, Thompson Coburn presented an overview of cyber insurance coverage issues and risks for the Association of Corporate Counsel, entitled “Are you protected? Insurance coverage for cyber risks” at the St. Louis Chapter Corporate Counsel Institute. This presentation (which is accessible via the link above) provided a more in-depth review of some of the issues addressed in the FFIEC joint statement.

Thompson Coburn partners have advised clients on cyber insurance issues through evaluation of policies being reviewed, as well as through the claims process that unfolds after a cyber incident. Thompson Coburn also has a cybersecurity practice group devoted to managing cyber incident response for clients.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Thompson Coburn LLP | Attorney Advertising

Written by:

Thompson Coburn LLP
Contact
more
less

Thompson Coburn LLP on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.