Cyber insurance market would improve Europe-wide IT security - report

A more coherent EU cyber insurance market would enable companies and individuals to better protect their information systems and data, according to a report published by the European Network and Information Security Agency (ENISA).

ENISA said current data suggests the EU insurance market for cyber security risks is some way behind the US.

In the UK for example, there are only a few insurance firms that offer dedicated cyber insurance products – compared to between 30 and 40 in the US.

The report, Incentives and barriers to the cyber insurance market in Europe, notes that while cyber security is an important concern for European and national policy makers, businesses and citizens, current coverage offered by many of Europe’s insurance providers may not comprehensively address digital risk.

ENISA said obstacles to a firmed-up cyber insurance market include a lack of actuarial data on the extent of risk and uncertainty over what type of risk should be insured against.

The body is making a number of recommendations it feels will help develop the market.

These include:

Collecting empirical data on cyber insurance in Europe to determine types of risk insured, premiums paid and levels of payouts in order to determine future trends

Looking at incentives for firms to improve their data security as a way to reduce their risk and financial liability if they breach data protection regulations

Developing agreed frameworks so that firms can put a "measurable value" on their information

Looking at the role of governments as an insurer of last resort, following other models where policy intervention is in evidence when catastrophic risk is involved

ENISA's executive director, Professor Udo Helmbrecht, said: "This new ENISA report indicates that there is potential for Europe's cyber security policies and legislation must be complemented by a prevention-focused cyber insurance market.

"As well as providing reassurance that proper cover was available, a developed market in this area would help to improve levels of cyber security by putting a true cost on cyber incidents and showing the benefits of implementing good security practices."