Office of the Chief Information Officer (OCIO) 1

FIO Request for Comments on a 

Potential Federal Insurance Response 

to Catastrophic Cyber Incidents

Federal Advisory Committee on Insurance

September 29, 2022
FIO’s Prior and Current Work on Cyber Insurance

2

 FIO continues its ongoing efforts relating to cyber insurance and insurer cybersecurity. 

 FIO administers the Terrorism Risk Insurance Program (TRIP), and cyber insurance 

may be written in TRIP-eligible lines of insurance.

• FIO increased its collection of cyber-related elements in the most recent TRIP 

data call. FIO’s 2022 Report on the Effectiveness of the Terrorism Risk Insurance 

Program discussed the results of the expanded data call on cyber risk insurance 

and the state of the cyber risk insurance market.

 FIO Annual Reports include information on cyber insurance and insurer cybersecurity.

 FIO coordinates with other Treasury offices and federal agencies, including Treasury’s 

Office of Cybersecurity and Critical Infrastructure Protection (OCCIP) and the White 

House Office of the National Cyber Director (ONCD).

 FIO is now working on a joint project with the Department of Homeland Security’s 

Cybersecurity and Infrastructure Agency (CISA) in response to a GAO Report, Cyber 

Insurance: Action Needed to Assess Potential Federal Response to Catastrophic 

Attacks (June 2022)
GAO Report, Cyber Insurance: Action Needed to Assess Potential 

Federal Response to Catastrophic Attacks

3

 Findings. The GAO report notes, among other things: 

• U.S. critical infrastructure faces increasing cybersecurity risks: cyber incidents to 

critical infrastructure have increased in frequency and severity.

• Recent attacks demonstrate the potential for systemic cyber incidents.

• Cyber insurance and TRIP are limited in their ability to cover potentially 

catastrophic losses from systemic cyberattacks. 

 Conclusion and Recommendation: The GAO report concludes that a full evaluation 

of whether there should be a federal insurance response in connection with 

catastrophic cyber risks would be best addressed jointly by FIO (given its statutory 

authorities, including monitoring of the insurance sector and assisting the Secretary of 

the Treasury with administration of TRIP) and CISA (given its expertise in connection 

with cyber and physical risks to U.S. infrastructure). 

 Next Steps: FIO and CISA have accepted the GAO Report recommendation and 

begun work on this joint project. 

• FIO will be seeking public comment on questions relating to cyber insurance and 

catastrophic cyber incidents, with a Federal Register Notice (FRN) scheduled to 

be published on September 29, 2022.
FRN Overview: Potential Federal Insurance Response to Catastrophic 

Cyber Incidents

4

 FIO requests comments relating to whether a federal insurance response to 

“catastrophic” cyber incidents may be warranted, as well as how such an insurance 

response should be structured.

 FRN acknowledges that an “insurance response” can take many forms, and there are a 

variety of potential models for response that might be considered. 

• FIO intends to assess potential responses that are outside TRIP but will also 

consider how potential responses could interact with, or be part of, TRIP. 

 FRN seeks information on Catastrophic Cyber Incidents and information relevant to 

Potential Federal Insurance Response for Catastrophic Cyber Incidents.
FIO FRN Questions on Catastrophic Cyber Incidents

5

 Nature of Event. What type of cyber incidents could have a catastrophic effect on 

U.S. critical infrastructure? How likely are such incidents? Are particular sectors of 

U.S. critical infrastructure more susceptible to such incidents? How should the federal 

government and/or the insurance industry address the potential for cascading, crosssector impacts from a cyber incident? What type of potential “catastrophic” cyber 

incident could justify the creation of a federal insurance response?

 Measuring Financial and Insured Losses. What data and methodologies could the 

federal government and/or the insurance industry use to predict, measure and assess 

the financial impact of catastrophic cyber incidents? What amount of financial losses 

should be deemed “catastrophic” for purposes of any potential federal insurance 

response? How should FIO measure and assess potential insured loss from 

catastrophic cyber incidents?

 Cybersecurity Measures. What cybersecurity measures would most effectively 

reduce the likelihood or magnitude of catastrophic cyber incidents? What steps could 

the federal government take to potentially incentivize or require policyholders to adopt 

these measures?
FIO FRN Questions on Potential Federal Insurance Response

6

 Insurance Coverage Availability. What insurance coverage is currently available for 

catastrophic cyber incidents? What are the current limitations on coverage for 

catastrophic cyber incidents? What rationales have been (or likely would be) used to 

deny coverage for catastrophic cyber incidents? Is the private market currently making 

available insurance for catastrophic cyber incidents that is desired by policyholders, in 

terms of the limits, the scope of coverage, and the type and size of businesses seeking 

coverage?

 Data and Research. What data do you collect that you would be willing to share with 

FIO and/or CISA to consider in their assessment of catastrophic cyber incidents and 

cyber insurance? What other information regarding catastrophic cyber incidents and 

cyber insurance should FIO and CISA consider? What data should FIO and/or CISA 

consider collecting to help inform this assessment and their ongoing work?

 Federal Insurance Response. Is a federal insurance response for catastrophic cyber 

incidents warranted? Why or why not?
FIO FRN Questions on Potential Federal Insurance Response Structure 

(continued) and General Question

7

 Potential Structures for Federal Insurance Response. What structures should be 

considered by FIO and CISA for a potential federal insurance response for catastrophic 

cyber incidents? 

 This question asks respondents to also address related questions concerning: 

Potential Models, Participation, Scope of Coverage, Cybersecurity Measures, 

Moral Hazard, Risk Sharing, Reinsurance/Capital Markets, Funding, 

Evaluation/Data Collection, and Limitations.

 Effects on Cyber Insurance Market. How might a federal insurance response affect 

the availability and affordability of cyber insurance across the entire insurance market? 

What would be the effect on any part of the cyber insurance market that would remain 

outside the parameters of a federal insurance response?

 Other. Please provide any additional comments or information on any other issues or 

topics relating to cyber insurance and catastrophic cyber incidents.