Update on the Federal Insurance Office’s 

Assessment of a Potential Federal Insurance 

Response to Catastrophic Cyber Incidents

Presentation to Advisory Committee on Risk-Sharing Mechanisms

February 1, 2024
Introduction and Background (1)

2

▪ At the July 2023 ACRSM meeting, the Federal Insurance Office (FIO) provided a 

briefing on the joint assessment of a federal insurance response to catastrophic cyber 

incidents that FIO and the Cybersecurity and Infrastructure Security Agency (CISA) 

launched in June 2022. Some of the background to that assessment included the 

following:

• FIO has monitored the development of the cyber insurance market since the 

2014 Annual Report. The Terrorism Risk Insurance Program (TRIP) has 

monitored these developments since 2016 because cyber insurance may be 

written within TRIP-eligible lines and TRIP could apply to a cyber attack if the 

attack is certified as an “act of terrorism.”

• The 2019 TRIP Reauthorization Act instructed the Government Accountability 

Office (GAO) to produce a report on cyber terrorism that would address overall 

vulnerabilities and potential costs of cyber attacks to critical infrastructure and the 

adequacy of TRIP to cover systemic cyber incidents.

• In June 2022, GAO released a report on Cyber Insurance: Action Needed to 

Assess Potential Federal Response to Catastrophic Attacks. The report found 

that TRIP is limited in its ability to cover catastrophic cyber incidents that are not 

cyber terrorist attacks. The report recommended that FIO and CISA conduct a 

joint assessment of whether a federal insurance response to catastrophic cyber 

incidents more generally is warranted. FIO and CISA accepted the 

recommendation and began the assessment.
Introduction and Background (2)

3

▪ In the previous update FIO briefed this group on:

• the Request for Information that we published in the Federal Register in 

September 2022; 

• President Biden’s March 2023 National Cybersecurity Strategy, which committed 

the Administration to assessing the need for and possible structures of a federal 

insurance response to catastrophic cyber events that would support the existing 

cyber insurance market; and

• the July 2023 Implementation Plan for the National Cybersecurity Strategy, which 

charged FIO with responsibility (in coordination with CISA and ONCD) for the 

initial phase of the assessment: assessing the need for a federal insurance 

response to catastrophic cyber events that would support the existing cyber 

insurance market, to be completed by the end of calendar year 2023.

▪ FIO conducted extensive engagement on the subject with primary insurers, reinsurers, 

brokers, representatives of critical infrastructure policyholders, and other stakeholders. 

▪ Most recently, in November 2023 FIO co-sponsored a half-day conference in New York 

with NYU’s Volatility and Risk Institute on catastrophic cyber risk and a potential federal 

insurance response that featured panels with senior insurance industry executives, 

senior cyber insurance experts, and cyber insurance policyholder representatives, 

among other stakeholders, and keynote remarks by senior officials of Treasury, CISA, 

and the Office of the National Cyber Director (ONCD).
November 17 FIO-NYU Conference on 

Catastrophic Cyber Risk and a Potential Federal Insurance Response (1)

▪ Agenda for FIO-NYU Volatility and Risk Institute conference in New York on Nov. 17:

• Welcoming remarks by Richard Berner, Co-Director, Volatility and Risk Institute, 

NYU Stern and FIO Director Steven Seitz

• Opening keynote by Nitin Natarajan, Deputy Director, Cybersecurity and 

Infrastructure Security Agency (CISA)

• C-Suite Fireside Chat on Insuring Catastrophic Cyber Risk as a Generational 

Risk and Opportunity

▪ John Doyle, CEO, Marsh McLennan (moderator)

▪ Albert Benchimol, former CEO, AXIS Capital

▪ John Keogh, President and COO, Chubb

▪ Martin South, President and CEO, Marsh

▪ Jim Williamson, Group COO and Head of Reinsurance, Everest Global

• Panel on Catastrophic Cyber Risk and the Cyber Insurance Market

▪ Pascal Millaire, CEO, CyberCube (moderator)

▪ Tracie Grella, Global Head of Cyber Insurance, AIG

▪ Monique Ferraro, Cyber Counsel, HSB, a Munich Re company

▪ Darren Pain, Director, Cyber, The Geneva Association

▪ Bob Wice, Head of Underwriting Management Cyber Risks, Beazley

4
November 17 FIO-NYU Conference on 

Catastrophic Cyber Risk and a Potential Federal Insurance Response (2)

▪ Nov. 17 conference agenda (cont.)

• Remarks by Drenan Dudley, Deputy National Cyber Director, Office of the 

National Cyber Director (ONCD)

• Panel on Catastrophic Cyber Risk as Viewed by the Policyholder

▪ Christian Hoffman, Global Cyber Leader, Aon (moderator)

▪ Philippe Cotelle, VP and Chair of the Digital Committee, Federation of 

European Risk Management Associations (FERMA); and Head of Insurance 

Risk Management, Airbus Defence & Space

▪ William Hillman, Chief Underwriting Officer and incoming President and 

CEO, Associated Electric & Gas Insurance Services (AEGIS)

▪ Kristen Peed, Treasurer, RIMS, and Director of Corporate Risk 

Management, CBIZ

▪ Monica Shokrai, Head of Business Risk and Insurance, Google Cloud

• Closing Keynote by Treasury Assistant Secretary Graham Steele, who noted that 

“a well-designed federal insurance response could address the risks of tail events 

while incentivizing healthy private sector practices. Conversely, a poorly 

designed program could shift too much risk to the government and reduce firms’ 

incentives to guard against certain forms of low probability, but nonetheless 

foreseeable, risks.”

5
Update on Assessment and Next Steps

6

▪ FIO has now completed the initial phase of its work on the assessment of a potential 

federal insurance response to catastrophic cyber incidents, finding that further 

exploration of the appropriate form of a federal insurance response is warranted. 

▪ FIO will undertake the exploration of the appropriate form of a federal insurance 

response in Phase 2 of the assessment, in coordination with CISA and ONCD.

▪ FIO has already taken steps on this next phase of its assessment. At the November 

conference, Assistant Secretary Steele announced that Treasury will host a second 

conference on catastrophic cyber insurance shortly after the conference of the 

International Forum of Terrorism Risk (Re)Insurance Pools (IFTRIP) this spring. The 

upcoming conference will extend FIO’s engagement on the topics discussed in 

November to begin consideration of the potential forms that a federal insurance 

response to catastrophic cyber risk might take.

▪ FIO will continue to work with CISA, ONCD, and other stakeholders in the next phase 

of the joint assessment of a federal insurance response to catastrophic cyber incidents.