Pricing cyber-insurance for systems via maturity models

Abstract

Risks associated with information technology systems present a complex modelling challenge, combining the disciplines of operations management, security, and economics. The challenge is to establish a representation of an organization's operational and systems architecture that allows an assessment of the security postures of its various components able to support an assessment of its insurance risk. This work proposes a socioeconomic model for cyber-insurance decisions compromised of entity relationship diagrams, security maturity models, and economic models, thereby linking systemstype and economic approaches to cyber-security assessments. The concept of a cyber-loss-adjuster is introduced, who reconciles cyber-incidents with economic losses. The work aims to bridge a number of disciplines to partly address a longstanding research challenge of accounting for organizational structure in the design and pricing of cyber-insurance. It is important to note the following: insurance companies have long experience of the magnitude and frequency of losses that arise in organizations based on their size, industry sector, and location. Consequently, their calculations of premia will start from a baseline determined by these considerations. The contribution of the methodology proposed here is to provide a framework for calculating the effects of cyber-based risk on the frequency and magnitude of losses. This is achieved through a security analysis of the relationship between the operational structure of an organization and its information systems. It also provides a consistent means for those seeking insurance to describe and understand their security posture and for an insurance company to price its offer of coverage.1 Comprehensive reviews of the cyber-insurance literature can be found in Eling et al ( 2016)[2], Marotta et al (2017) [3], Aziz (2020) [4] and Skeoch (2022) [5] 2 See, for example, Woods et al (2017) [7] and Romanosky et al (2019) [8] 1

Cyber insurance risk analysis framework considerations

“…The result of the t-test showed that the average answer was larger than 3 (at 5% significance level), as illustrated below in Table 1. The importance of the maturity level of the insured organization is important, as stated also by other researchers (Skeoch and Pym, 2023). At the same time, more than 60% of the respondents indicated that an audit performed by an independent official or certified auditor chosen by the insurer is valuable in the analysis process, a result confirmed by the Wilcoxon and t tests at 1% significance level.…”

“…The result of the t -test showed that the average answer was larger than 3 (at 5% significance level), as illustrated below in Table 1. The importance of the maturity level of the insured organization is important, as stated also by other researchers (Skeoch and Pym, 2023).…”