Why the Public Sector Needs Cyber Insurance

Cyber threats and ransomware attacks can be crippling for public sector organizations. The cost of ransomware attacks in government often runs into the millions of dollars, which mostly stems from downtime and recovery (or in some cases, paying the ransom). A Sophos’ 2023 “State of Ransomware” report noted that in 2023 the K-12 education sector has seen the highest ransomware attack rate of any industry, with 80% of schools reporting a ransomware attack. Local and state government agencies are not far behind, with 69% reporting a ransomware attack.

State and local government agencies need cyber insurance to mitigate the financial risks associated with cyber attacks and data breaches. Cyber insurance, also known as cybersecurity insurance or cyber liability insurance, is a type of insurance coverage designed to protect organizations from financial losses and liabilities resulting from cyber attacks and data breaches. 

What Does Cyber Insurance Cover?

Cyber insurance helps state and local entities cover losses resulting from a cyber attack. Although policies vary by state and insurance provider, a policy typically covers data breach costs, business interruption losses, data restoration costs and ransomware payments.

Cyber insurance policies generally do not cover property damage, intellectual property, known vulnerabilities, fraudulent or criminal acts by employees or insiders, regulatory fines and penalties, or acts of nature.

What Are the Different Types of Cyber Insurance?

There are two types of cyber liability insurance to help companies respond to and recover from data breaches:

• First-party cyber liability insurance is where the insurer pays the organization’s expenses incurred directly due to a security breach. First-party coverage helps organizations quickly recover from a cyber incident by providing financial support for immediate response and recovery efforts.
  
• Third-party cyber liability insurance covers damages or settlements the organization must pay due to lawsuits or claims resulting from the organization’s actions or failure to take action. Third-party coverage helps protect an organization from financial liability that may arise from lawsuits, regulatory actions, or other claims made by individuals or entities affected by a data breach or cyber incident.

Common Underwriting Criteria

Insurance providers evaluate multiple factors to assess the risk profile of an organization when underwriting a cyber insurance policy, such as:

• The size and revenue of the organization
• Current cybersecurity practices, including the implementation of Multi-Factor Authentication (MFA), employee training, network security measures and patch management
• The types of data stored by the insured, such as Personally Identifiable Information (PII) like names, addresses, driver’s license numbers, forms of payment and Social Security numbers, Controlled Unclassified Information (CUI) or payment card data
• History of cyber incidents, which may include data breaches, malware infections, or other security breaches
• The geographic locations where an organization operates or where its data is stored may affect underwriting considerations, as cyber risk can vary by region

The initial application will likely ask several detailed technical and operational questions. In general, organizations should look to have the following security controls to qualify for cyber insurance:

• Implementation of robust backup systems
• Security awareness program for employees
• Anti-phishing email security across the organization 
• Endpoint protection against malware
• Multi-factor authentication for both web-based email and  administrative or privileged access
• Encryption for personal data, sensitive and confidential information stored on your systems and networks

Cyber Insurance Cost

Cyber insurance is increasingly becoming essential for all types of government organizations as the risk of cyber attacks against applications, devices, networks and users grows. Government agencies and educational institutions are often targeted in cybercrimes due to the sensitive information they have access to. Cybercriminals also know that public sector organizations tend to have smaller IT teams, budgets and resources to thwart cyber attacks.

Unfortunately, many governments have experienced rapidly increasing premium costs for cyber insurance due to the overall rise in cyber attacks and higher risk profile for the public sector. Cyber insurance premiums in the United States increased 50% in 2022 as increased ransomware attacks drove demand for coverage. Premiums vary greatly with smaller government annual premiums in the range of $5,000 to $20,000, while larger government organizations, such as state or federal agencies, may pay annual premiums of $100,000 or more.

How Keeper Security Government Cloud Can Help Improve Insurability

Having robust controls and security practices in place, such as using multi-factor authentication for company logins and using a password manager, can lower the premium or deductible on your policy. 

Password Management

Password managers help all employees create strong, unique passwords for all their accounts and store them in a secure location. Stolen and weak passwords are the leading cause of data breaches, yet most organizations have no visibility, security or control over their employees’ passwords and credentials. 

Keeper Security Government Cloud (KSGC) uses delegated administration and role-based enforcement policies to provide complete visibility and control over identity security and risks within your organization. Administrators can enforce MFA, which requires users to provide more than one form of authentication to access a service or application. 

Identity, Control and Access Management (ICAM)

Keeper’s Privileged Access Management (PAM) solution simplifies how organizations manage and secure access to highly sensitive systems and data. This includes access to payroll systems and IT administration systems, to name a few.

In addition to MFA to verify the identity of a user, privileged access management solutions enforce the principle of least privilege, ensuring that users have the least necessary access to systems and data by providing access to only those accounts they need to carry out their role. Access controls also provide granular levels of control and enforcement for privileged accounts. Administrators can record account and session activity, which helps to support audits and reports for compliance and regulatory purposes.

While privileged access management can assist organizations with addressing cyber insurance requirements, traditional solutions are often cost-prohibitive, difficult to deploy and contain unused features. KeeperPAM addresses the key pain points and requirements in organizations to prevent data breaches with just the features you need.

• Cost Effective: A single platform with minimal IT staff required to manage it
• Fast Provisioning: Seamlessly deploys and integrates with any tech or identity stack in just a few hours
• Easy To Use: Unified admin console and modern UI for every employee on all device types – average training time is less than 2 hours

To learn more about KeeperPAM and how it can strengthen your organization’s cybersecurity, request a demo today.