Cybersecurity insurers have augmented risk assessments amid the COVID-19 pandemic. You should, too.

The goal of deeper due diligence by insurance companies is to more accurately calculate premiums, which could raise the cost of cybersecurity policies. That’s why it is more important than ever that businesses conduct their own in-depth cybersecurity risk assessments. 

Comprehensive cyber-risk assessments have always been recommended as a matter of business as usual. But the threats associated with the COVID-19 pandemic have heightened the need to scrutinize cybersecurity programs. Thorough risk assessments can help organizations gain a holistic understanding of security controls, processes, and technologies that are in place to support a secure remote-work program. That’s mission-critical, but understanding risk exposure can also help organizations prepare to negotiate insurance policy coverage and premiums. 

It is critical that businesses assess cyber risks across the entire enterprise and third-party landscape, and not just IT. The assessment should also factor in financial, reputational, and compliance risks. 

Organizations should analyze risks with a focus on their most valuable assets, as well as the criticality of risks to business processes, operational disruptions, and impact to revenue. It is also essential to examine the potential for insider threats caused by employees, whether intentional or not. 

One external vulnerability that organizations often disregard is third-party risk management. Cybercriminals often infiltrate the networks of vendors to gain a foothold on their partners’ systems. Businesses should evaluate the risks of third parties and ensure that their security capabilities are sufficiently robust. 

Organizations also must appraise their regulatory risks related to data breaches and privacy risks. 

To gain a broad, comprehensive view into risks and current threats, organizations should:

• Perform thorough risk assessments annually, at a minimum.
• Review cybersecurity and privacy policies and programs to determine if remote-work policies are in place and up to date. 
• Evaluate security proficiencies related to remote work, including remote access and VPNs.
• Review all connected devices and determine vulnerabilities due to the expanded attack surface.
• Evaluate various monitoring and detection capabilities. 
• Assess and test security controls, processes, and systems on an ongoing basis. 
• Monitor current threats and adjust security capabilities as necessary. 
• Implement robust patch-management and malware programs. 
• Examine security risks, policies, and technologies of all third-party vendors.
• Assess employee security awareness programs to make sure they address vulnerabilities relevant to remote workers.
• Ensure that remote workers have secure, password-protected internet connections and Wi-Fi.  
• Assess processes for compliance with regulatory laws like the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

The surge in attack attempts that exploit the uncertainties of COVID-19 has elevated the need for cybersecurity insurance, and insurance companies may now ask organizations to perform an in-depth assessment of their cybersecurity and remote-work defenses before they can purchase insurance or update an existing policy. As organizations look at their cybersecurity programs, they should correlate the programs to their most valuable assets and security technologies, processes, and skills. This targeted risk assessment should connect the dots across the business and remote-work ecosystem. Once this is done, organizations can identify the right cybersecurity insurance requirements for their current and future remote-work models.

Bhavesh Vadhani, Principal, National Director, Cybersecurity and Privacy

703.744.6700