TALKING POINT
Cyber insurance is forcing organisations to take compliance seriously
Ryan Boyes, Senior Security Administrator, Galix
Ryan Boyes, Senior Security Administrator from Galix, explores how cyber insurance is becoming essential to maintain partner, supplier and customer relationships.
Cyber insurance has typically been a grudge purchase, but it is rapidly becoming something businesses cannot operate without. While it is not a legal requirement in South Africa, organisations are now expected to have cover in place before partners, suppliers or customers will engage with them. At the same time, insurers are now requiring clear evidence that appropriate security controls and governance processes are in place before providing cover. This is shifting the role of cyber insurance. It is no longer only about financial protection after an incident, but also a practical way for organisations to demonstrate that they have taken the necessary steps to manage cyber-risk. In this environment, compliance specialists and Managed Security Service Providers( MSSPs) play an important role in helping organisations implement the required controls, demonstrate that they are working and maintain that standard over time.
Risk is driving compliance
Data breaches, regulatory penalties and operational disruption all have direct financial consequences, not only for the organisation affected but also for partners, suppliers and customers. As a result, businesses are becoming more cautious about who they work with, which means they are effectively enforcing compliance.
Organisations are increasingly being asked to demonstrate that they meet certain security and data protection standards, and in many cases, proof of cyber insurance forms part of that requirement.
These same liability concerns are also shaping how insurers assess risk. Before providing cover, insurers require a clearer view of how security is managed. Controls such as multi-factor authentication, access management, data protection and reliable backups are now expected as a minimum requirement.
Compliance must be maintained
AS A RESULT, BUSINESSES ARE BECOMING MORE CAUTIOUS ABOUT WHO THEY WORK WITH, WHICH MEANS THEY ARE EFFECTIVELY ENFORCING COMPLIANCE.
functioning as intended, which introduces an ongoing requirement for governance. Controls need to be monitored, maintained and tested. It is not enough to have them documented or implemented at a point in time. Organisations need to be able to demonstrate that they are applied consistently and remain effective.
There is also a direct link between how well these controls are managed and the outcome of the insurance process. Where controls are weak or inconsistently applied, premiums increase or cover may not be provided. Where controls are clearly defined and supported by governance, the risk profile improves.
The right partner sets you up for success
Maintaining this level of control requires a clear understanding of the environment. Organisations need to know what exists, what needs to be protected and where the risks lie. Without that baseline, it becomes difficult to define scope or demonstrate compliance, particularly where requirements vary depending on the systems, data and exposure involved. However, achieving this can prove challenging because environments are often complex, distributed or not effectively documented.
Meeting these requirements is not a once-off exercise. Cyber insurance is reviewed and renewed regularly, and organisations are
expected to show that the controls they have put in place are still
This is where compliance specialists and MSSPs add value. They help define scope, identify gaps and implement the controls required to meet both regulatory and insurance expectations. x
18 www. intelligentcxo. com