Resilience against Catastrophic Cyber Incidents: A Multistakeholder Analysis of Cyber Insurance

Abstract

Catastrophic cyber incidents—events of low probability but high impact, with the potential to incur billions of dollars in damages—are prompting insurers to elevate premiums, create higher barriers for potential buyers, and tighten policies with exclusions. While these responses of the insurance industry are important to prevent its insolvency during catastrophic incidents due to excessive claims, they lead to a notable gap in market protection. Using a content analysis of multistakeholder comments submitted in response to a Treasury Department Request for Information (RFI), this study seeks to define what constitutes a catastrophic cyber event, identify mitigation strategies, evaluate the current capacity of the cyber insurance sector to handle such incidents, and investigate the potential roles and support mechanisms that the government can provide to enhance the insurance sector’s capacity to manage these extreme risks. This paper is one of the pioneering studies using data and a multistakeholder perspective to provide essential guidance for policymakers, regulators, the insurance industry, and the cybersecurity sector in formulating robust policies and strategies to address catastrophic cyber risks, ultimately enhancing national economic and technological resilience.