IT service outage cost: case study and implications for cyber insurance

Abstract

Today, almost all enterprises are highly dependent on IT services. Thus, high availability IT services and the cost of downtime have received a lot of attention in recent years. One increasingly used tool for cyber risk management and transfer is cyber insurance, which typically offers some form of business interruption coverage. However, cost structures of IT service outages are still poorly understood, as costs are often just reported as lump sums. This article contributes a multiple case study of IT service outage cost in three sectors in Sweden: transport companies (N = 11), food companies (N = 9), and government agencies (N = 19). The contribution is three-fold: (i) the measurement instrument itself, (ii) the insights into different cost structures gained, and (iii) the implications of different cost structures on availability investment strategies. Main findings include that whereas some enterprises incur only fixed outage cost, some incur (almost) only lost productivity, and some incur almost only lost revenue. In the public sector, lost revenue is often negligible. The results are further contextualized by a discussion of cyber insurance implications.

The Cost of Incidents in Essential Services—Data from Swedish NIS Reporting

“…[4,15,16,25]), but these databases include incidents caused by many kinds of operational risks besides outages. One study dedicated to costs of service outages reports data from the transportation, food, and government sectors in Sweden [13], but these are a non-random sample of case-studies.…”

“…The validity of the findings is good: All the reports are based on actual incidents entailing actual costs for the operators, and the cost estimates had to be produced within four weeks after the incidents, meaning that circumstances were fresh in the memory of respondents. From this perspective, validity is better than, for instance, if cost estimates had been based on annual summaries collected ex post (as in, e.g., [13]), or based on fictitious scenario estimates (as in, e.g., [20]).…”