Well, today on our Tech for Business podcast, Todd, our COO and CISO and Ann, our Quality
Assurance Analyst and GRC Specialist are joining us to talk about cybersecurity insurance and
compliance, where they overlap and maybe where they fall short.
So I'm going to start with Todd.
We have a cybersecurity insurance podcast and we talked all about what it is and who
needs it.
So I'm hoping you can give us a quick overview and maybe anything that has changed for cybersecurity
insurance since that podcast, which was two years ago.
Wow.
I know.
How long ago are you?
Is it not wild?
Yeah, I mean, I think the extremely brief overview is that we still believe in it.
We still think it's probably something most organizations should have.
There are reasons why you wouldn't get it and those typically are cost related.
What's changed over the last couple of years cost would probably be the majority of the
change.
Before, it was kind of the wild, wild west.
Every insurance company thought it was a pot of gold.
They were going to get into it and they were offering insurance.
And unfortunately, if you've been paying attention to cybersecurity and the world of attacks,
it's gone absolutely bananas.
And so there was a lot of payouts that insurance companies have done.
As such, the insurance costs have gone up.
The requirements to get it have become more complicated.
And it's probably not terribly surprising.
It's kind of the same old song for insurance in general, but it definitely matches what
we see going on in within the industry as well.
So Anne, because I really want to talk about where this overlap is in the compliance.
Do you see overlap at all?
Do you see businesses who have robust compliance requirements typically buy into cybersecurity
insurance or are they just two separate entities?
It's actually an interesting question.
There are elements of, say, the financial industry that are already insured through
FDIC, but even those rules are coming and evolving to make it harder.
There is absolutely a correlation.
Those that have higher regulations, I think, and in compliance frameworks, they definitely
have that correlation.
There seem to be more knowledgeable and much more risk averse in managing that risk with
insurance and how it's covered.
A lot of the financial industry, just as an example, not just through something like FDIC,
is requiring a ransomware rider on their insurance.
Now, it's not a suggestion.
Interesting.
I'm going to expand on that real briefly.
I think Anne nailed it, but I just wanted to kind of really emphasize this.
So the question was whether or not there's an overlap.
And there are 100% is, if you look at the banking industry in specific, the FDIC is
the insurer.
So they're the ones that are driving it forward.
And they have had a play in what the compliance looks like in the banking industry.
So if you're in banking, you'll know this, but they have something called the FFIC, and
I won't get into what the abbreviation means.
But it is basically the playbook that says, the questionnaire, do you do this?
Do you do that?
Have you considered this?
And it's all based on maturity.
They had a hand to plane it.
That wasn't solely of them.
The government played a role in it and sort of the variety of other things.
But to just really emphasize it as to them, it's so incredibly important that they're
deeply ingrained on what compliance looks like in the banking industry specific.
And you don't see quite that same involvement in healthcare in a few other areas, but it's
still there, right?
And I think that ultimately gets to where we're going to today.
Yeah, so I was going to ask what those biggest overlap things are.
Is it the simple stuff that we already know?
Like you need MFA, you need EDR, or is the cybersecurity insurance companies really paying
attention to those compliance requirements?
Are they really making sure that they're including those things, or are they just getting the
basics?
It's all over the place to be honest.
It depends, right?
It depends.
There it is.
You'll still see insurance applications, cyber insurance, be two pages, and half of it is
just location information.
But you'll now see 15-page that want to know where you're storing your data.
Is that it's almost like an audit questionnaire, more so than it is an insurance application.
And it's really going through and saying, okay, we do get it.
But in order for us to ensure what you want us to protect, this has got to be in place.
And for the big ticket items like the MFA is the EDR is that kind of thing, that it's
exclusionary.
They may not cover you, but they may also say, well, tell us more on different elements
of how do you secure your cloud environment?
And I do laugh sometimes at the questions that are asked, because I would very much guess
that a provider isn't necessarily going to know and understand how to you secure your
cloud environment.
However, we still have to provide or help our customers provide that information to
say something that feels at least good in the whole scheme of data protection.
It can't just be kind of fluffy answers about nothing anymore either.
Yeah, so just from what I'm seeing over there, there has been one or two of our customers
that have not had an in-depth review, but it literally is one or two.
It's not like you're seeing a percentage of our customers don't need to go through this.
It's almost shocking to me when somebody comes in and goes, oh, we didn't really even have
a questionnaire.
We just signed it and we moved on.
I'm like, well, lucky you, because quite frankly, that is not the industry.
And it is, to your question, if you're a fan of the podcast, you probably know this.
There are certain things that we classify as non-negotiable.
So there's the things you have to be doing.
And they are in every single form that I see.
That's MFA.
That's EDR.
Do you do cybersecurity training?
What does admin permissions look like?
De facto, blocking and tackling cybersecurity, those are in every single questionnaire.
They are getting a lot more complex, though, to Anne's point, where you're seeing these
15-page monsters.
It's a monster.
Some of them are just absolutely ridiculous, but it's not terribly surprising.
If you look at the insurance industry, they are basically the kings of risk.
They understand it inside.
Now, they really do.
They go through the whole, I mean, no, there is no other industry that is better prepared
to define what risk looks like.
They do it from an underwriting standpoint.
Ultimately, they're saying, hey, we'll back you with X amount of dollars.
And in order to do that, they're like Vegas.
They know the odds.
They know what the payout is.
I hope I don't get in trouble.
I'm looking over here.
But they are, right?
They know all of that.
They are very statistically driven, so they know what it is.
And they have looked to the compliance industry and say, well, how do you protect yourself?
And then they've adopted those rules.
But you can see it across the board.
I mean, it happened in the auto industry when they did the airbag deployment.
I think it was the, I read this somewhere.
I was just going to use that example.
They took the US government to court because the auto manufacturers are like, no, we don't
believe in this.
And they're like, you need to do this because this dramatically reduces the risk of injury
and death in cars.
So I mean, that's the kind of role insurance plays.
And they know this stuff inside now.
And so I'm, I'm bambling.
So I'll be quiet.
Go ahead, Ann.
No, that was awesome.
I always like to, to correlate something as, as what feels gooey like this to something
that's known like the auto industry or your own auto insurance.
It didn't used to be a requirement to have seat belts.
You have to get a waiver to, to ensure a classic car that doesn't have shoulder belts.
You have all those different, different elements that used to be just so like, like, we can
we'll think about that.
And then Todd's example, perfect.
Like, no, these need to be here.
And that's really where those MFA is in the EDRs have, have correlated into even different
requirements.
So to, to kind of, kind of come full circle to what you asked there.
Now, not only standards in the requirements for operations in, in certain industries and,
and regulatory frameworks, but they're required by insurance.
So the one feeds the other, I guess it's, it's going both ways that, that I think, and
it seems some industries are a little more behind than others.
Financial seems to be kind of at the forefront in a lot of these.
And that's good, that's good for all of us for our own protection of our, our, our own
financial data and, and money for that matter.
But we want our, our organizations to, to be risk averse with our, with our funds for
sure.
But as it goes to just kind of extrapolating on that, where we get to what, what might
be behind a little bit is, is the different elements of their cyber policies.
And one thing I'm looking at as, as we're looking at these for our customers is, it's
not even necessarily the, the monetary loss that you're compensating for or the risk that
you're compensating for.
But a lot of, in most, to be honest, are, have a reputational riders within it.
So your, your insurance now is covering what might happen if you end to fix something for
you reputationally, it should something happen that there's even marketing firms to that
specialize in, in this incident management or, or cyber incident management.
So it's really evolving in such a light speed way.
And I think of the reputational, especially in, in say healthcare, in that it's, it's
very difficult for say, let's say a clinic lost a lot of data or was ransomed and they
can't guarantee it.
Not only are there requirements of, of, of healthcare data loss, PHI and that, but reputationally,
I wouldn't want to go to the clinic anymore and what they can do to try to gain and retain
the business.
So those are weird things that are now included in our cyber insurance that never would have
been before.
Even a year, a couple of years ago, you didn't see that.
Yeah.
I mean, it's, it's interesting.
There's a lot of stuff that, that and covered that I kind of wanted to expand on.
I, she kind of mentioned, no, no, no, no, you're great.
I thought that was fantastic.
But, but the, the comment that you had about the banking industry being slightly ahead and
my comment of the insurance company has deeply ingrained in that, right?
They know that they need to do this and that might be a reason why they're a bit ahead.
One of the benefits that I think you can see is coming from the insurance and maybe people
don't love the concept of using insurance as a benefit, but most people have it for
a reason.
The benefit of it is they don't care about the industry, right?
Their statistics are the same for industry across industry.
They don't care, right?
They're a couple of years ago, it used to be like the banks were that got attacked because
that's quote unquote, that's where the money is, but it doesn't matter anymore.
Everybody's got money.
Everybody's got money is in business to make money.
And so the, the attacker really could care less what your industry is.
And the insurance company doesn't care your industry.
They just aren't trying to make sure that they're, they're giving you what you need and
helping you out.
So they are the ones driving that regulation across industry.
So you will see it start to standardize.
Right now it's a bit fractured.
You've got the FFIC from the FDIC.
You've got HIPAA and the healthcare.
You got CMMC coming from a government perspective.
At some point, they're very, they all mirror each other to a larger degree, but it is going
to come together and that is what we're seeing in the, the questionnaires that are coming
to us.
It's very standardized.
It's the same things over and over again.
I did like the reputation thing too.
I thought that was really good stuff because there is a lot that goes into it.
You're trying to rebuild trust after that.
And what does it look like?
We do tabletop exercises with our customers very often.
And when we do, we do a ransomware one, right?
You've got to pay it.
And then, you know, we kind of go down the supply chain too and says, well, what happens
if this happened to one of your suppliers and almost every one of those businesses says,
we'd stop working with them.
And so we get to ask the question, really, is that, is that what you need?
Is that what the answer is?
Do you need to dig into it further?
Do you need to understand what happened?
Do you need to understand how they're remediating it?
Because what if that was you instead?
How would you recover?
The turnaround is fair play now.
Right.
So if it wasn't just them, the supplier, now what?
So it's a really interesting thing.
And again, I'm tangenting a little bit.
And again, because that's what happens in every podcast.
It's really interesting to kind of look at how that works.
And I thought that reputational stuff that Ann covered was fantastic.
It's interesting.
I also thought as I was just kind of the correlations, a lot of it is the now show me part of an
audit where you can easily, the yes, no questions of insurance applications have gone the way
side.
It's the yes, but now show me what evidence.
Yeah.
Yes, you have EDR.
Okay.
What kind?
Who manages that?
And if my kids would say, what's their last name?
What's their parents name?
Like that's my kids say.
What's their, what do they do?
Where do they go to school?
Like we want more information, please.
That we want to make sure that we're validating that it's not just a, does someone, do we
have end point?
Yeah.
I think so.
Asking someone down the hall and sure, check.
Well, you can't really do that anymore because you have to be able to prove where those go.
And that's where you're even, even your, it's the correlation back to car insurance.
You're saying that all your cars have all the safety mechanisms as would that model
year and whatnot.
And if that were to change or not be true, you're eliminating yourself out of the game.
Your insurance can say, sorry, you've eliminated yourself from coverage by doing X, Y, Z or
not being completely forthright or having the right information on your policies or applications.
I highlighted what I thought one of the benefits was of insurance.
The downside, because it's only fair, right?
We got to talk about the downside.
The downside is exactly what I just covered there.
The downside is that it's getting extremely complicated and it's very hard for organizations
to fill them out by themselves.
So the comment she made is, do we have end point protection or do we have EDR or is it
the same thing?
Those are complicated questions and most organizations are not well equipped to answer them.
Inevitably they come to organizations like CIT or other professionals in the industry
that say, here, let me help you through that.
Again, the downside is it's unfortunate it's in a situation where you can't answer it on
your own.
The plus side to that is there are people that can help you.
It's not usually an incredibly onerous process either.
It's as long as somebody's working with you and they can tell you your control is a logical
control like X.
Your control is an administrative one like Y.
Those kinds of things will help you answer those questions and you can get through them
in a relatively painless method.
If you're curious, if you haven't gone through one and you're curious what it feels like,
it's like when you try to get life insurance.
It feels like that.
It's brutal.
That was my net?
We're on to Nate, Todd.
It is.
It's gone from just a couple questions about your random location.
What do you do for a living?
Will be at your house, give you a health test, a blood test, and go ahead and answer this
hour and a half of questions about your family lifestyle, history, health history, blah,
blah, blah.
We're clarity, not currently asking for blood to the best of my knowledge, but.
Right.
Oh, man.
So, is there any, we talked a lot about how these two entities really work together.
Are there any places where they fall short?
Maybe places where insurance is saying, we're not interested in knowing about that specific
compliance requirement or helping you with that or covering that, where do they sort
of diverge, if at all?
I would answer this from a different angle.
And that's, Matthew and I joke all the time, another one of the CIT staff that does these
podcasts, that the devils of the details, they fall short where you may not have read
what would be included or what the writers, what the exclusions, inclusions are within
the policy.
And I even try to counsel my teenage boys, please read the fine print.
It's real dull.
It's not, but when you find the little gems in there that could really hold up, that's
where you can go back and say, no, we need this to cover ransomware.
I don't see that anywhere in my policy.
If we're going to go this far, we need this to be to the ability to cover our network,
replacing our network.
What does that mean?
And go the extra mile.
And again, back to the car analogy, it's really going through and ensuring personally that
your policy doesn't fall short.
Do you need full replacement?
Do you need reputational?
Do you need, I hope I wouldn't, but I mean, just as trying to stay along those lines.
But if it doesn't cover glass, the different writers don't cover glass, and that's really
important.
Does it cover your hardware?
What does that look like?
Does it cover your hardware in six months?
That's not acceptable.
And that's where reading the fine print is kind of the, I don't see that.
I don't see that any one writer or sorry, policy or application falls short.
It's really looking at what it covers, what you're signing up to and what your needs are.
So it's hard when the responsibility falls on either customers or organizations that
aren't really in tune with what it means to replace their environment or adjust their
reputation, ransomware response, that kind of thing.
Yeah, I think again, and covered it extensively in details.
The question to me of are there areas where there's problems, it's ironic that I mentioned
there are some insurance organizations that may not have the maturity where they ask the
in-depth questions yet.
That may be a great example where Ann's highlighting, does this actually give you the coverage you're
looking for?
So you should look, you should pay attention to that and dig into the details of what
that means.
There's all kinds of things that are the devils in the details, as she said.
There are things like when do you contact the insurance and I'll be honest with you,
almost every one of them says immediately.
So the very first thing you do is you don't break glass and grab the fire extinguisher,
you call the insurance company and if you work with a CIT, that's the very first question
we ask you, you call us and we say, have you contacted insurance yet?
So those things are in the contracts, you do need to look at them to make sure that you're
getting what you're hoping to get, whether it's the amount of coverage, what the coverage
costs, covers, et cetera, that's all incredibly important stuff.
So businesses that have cybersecurity insurance, this seems like a silly question, but are
they better positioned to meet those compliance standards than others or is that kind of the
same?
It depends.
Yeah.
Totally.
I think the answer is yes.
It goes both directions.
If you're making progress on cybersecurity, you're most likely making progress on your
compliance and vice versa.
The ones that make it the most easy for us to walk through with them is if you're in
a banking industry or something along those lines and you have been working on your maturity,
we just zip through the questionnaire because we already know that you've got a lot of these
pieces in place.
There are occasions where there are things within them that are much more complicated
to achieve.
So for example, we see regularly as they say, do you have multi-factor authentication on
every switch and so on and so forth, which is something that's ridiculously complicated
to do, at least it is today.
And so the answer typically for a lot of that, for most organizations, is no.
That doesn't mean you can't get insurance.
It just may impact the premium.
And again, they may not know exactly what they're asking or how that is.
But again, if you've got the right people, they can say, well, no, we don't, but our
compensating control is X, Y, and Z. And you may be able to work your way through it.
But again, partners can help you with that.
That compensating control concept, completely part of compliance.
That is something that your examiners would typically look for.
So to end out today, I have one more question and then I'll open it up.
If there's anything else that you wanted to share or we didn't get a chance to cover.
So in very simple terms, compliance feels like this thing that you have to meet or you
are going to get fined, you can't function.
Cybersecurity insurance is this optional thing that is a huge safety net.
And if you don't have it, you may also not be able to function as a business.
Which one do you think is more effective in motivating businesses to prioritize cybersecurity?
It's an opinion, you know, I don't know.
I think it depends on industry, but it depends.
It depends.
I really think that there will always be organizations and even individuals that will
wait till something breaks to think about getting a certain type of insurance no matter
what it is.
I think that that compliance element though drives more people from certain industries
to be more aware of their risks and seek that risk mitigation tool insurance to support
them in operations.
Yeah, I think and nailed it again.
The answer to me is it's probably a neck and neck race.
I would probably give the slight nod to compliance depending on industry.
You just don't see the same kind of adoption and say manufacturing as you do in some of
the others.
And that's not to say that they aren't making progress.
I'm not picking on anybody.
I'm just saying the industry specific, you don't see quite as much adoption on it.
The reason that I would say compliance is slightly ahead is because more often than not, if you
have a compliance industry, you most likely have a board that cares.
And the last thing and it's somebody in compliance wants is to get something from an examiner
that comes back that says they have an item that needs board attention.
That is something that scares the crap out of almost every organization that I've ever
worked with.
Right.
You don't want to do it.
Yeah, you don't want to take it to the board.
It's rare that you give attention to certain things like that because it looks like there's
something not going quite right.
But ultimately, I think the answer really ultimately depends on the risk appetite of
the organization.
If that organization feels like they like to mitigate risks and get them out of the way,
then you're going to see that they're going to adopt it much more readily and it won't
matter whether it's insurance or a compliance in those type of situations.
What you're typically going to see is insurance isn't this thing that's hanging out there
as a hammer that you have to have that's going to force me to do it, which quite frankly
is the reason why a lot of people do insurance do it.
I'm sorry, not insurance.
Do a lot of security things is because they've got this hammer out there that well, they're
made me.
If an organization is really low on the risk level, they're going to use insurance as a
level of defense.
It's not going to be it forced me to do it.
It's just another tool in the toolbox.
This was incredibly interesting.
They aligned a lot more than I thought they were going to, which is great.
So thank you so much, Todd, and for joining us today.
If you enjoyed this podcast, please like and subscribe.
If you have a question or a topic you'd like us to discuss, please reach out to us at infoatcit-net.com
or head out to our website,cit-net.com slash podcast and we'll be back next week with an
all new episode.