545 Washington Boulevard GEORGE A. ORTIZ

Jersey City, New Jersey 07310 Director of Federal Affairs

www.verisk.com Government Relations

Telephone: 201.469.2662 gortiz@verisk.com

Facsimile: 201.748.7085

September 7, 2016

National Institute of Standards and Technology

100 Bureau Drive, Stop 2000

Gaithersburg, Maryland 20899

Attention: Nakia Grayson, Applied Cybersecurity

RE: Information on Current and Future States of Cybersecurity in the Digital 

Economy 

To Whom It May Concern:

Verisk Analytics welcomes the opportunity to present the Commission on Enhancing National

Cybersecurity with comments to consider regarding Information on Current and Future States of

Cybersecurity in the Digital Economy. Verisk Analytics is a leading provider of information

about risk to professionals in insurance, healthcare, financial services, government, supply chain,

and risk management. Using advanced technologies to collect and analyze billions of records, we

draw on industry expertise and unique proprietary data sets to provide predictive analytics and

decision­support solutions in fraud prevention, actuarial science, insurance coverages, fire

protection, catastrophe and weather risk, profitability optimization, data management, and many

other fields. In the United States and around the world, we help customers protect people,

property, and financial assets.

The cyber risk insurance industry is still relatively nascent. In many surveys of business leaders,

cyber risk is reported to be the most unknown and unfamiliar type of risk faced by the Chief

Risk Officer (CRO), Chief Information Officer (CIO), Chief Information Security Officer

(CISO) and ultimately the Chief Executive Officer (CEO). While there is tremendous demand

for cyber insurance in the market, supply has not been so forthcoming from carriers largely due

to some of the challenges listed below:

Staff Specialization: The alignment of two sets of technical expertise, underwriting and

cybersecurity, are not easily found together. Insurance carriers that are not investing in specific

cyber underwriting expertise are very often not able to drive to the market as strongly as those

that do.

Lack of Standardization: While many industries are standardizing their cybersecurity best

practices around the NIST Cybersecurity Framework, a push is needed for standardized language

and terminology in cyber insurance underwriting. Also, a trusted data repository that archives
                           

                           

                          

                     

                           

                               

  

                     

                                 

                             

                            

       

                                 

                                 

    

                             

                           

                       

                       

                         

                           

                               

                 

                           

                                 

                               

                       

             

                             

                           

                               

                               

                                 

                       

organization security postures, incidents and losses across all industry sectors is needed as that

data today rests in multiple silos that do not currently aggregate data or readily communicate

with one another. The CIDAWG and the CIDAR efforts are focused around this.

Lack of Actuarial Data: Traditionally, insurance ratemaking has heavily depended upon years

of historical policy and claims information. While this currently does not exist in cyber

insurance, we are optimistic that the development of aggregated loss data will emerge in the near

future.

Current Market Concentration: Currently, cyber insurance is primarily being underwritten by

a small number of carriers. Those carriers tend to value their proprietary data and leverage their

expertise. Some carriers who are looking to expand their product offerings and newly enter the

cyber insurance market might find this current landscape to present related obstacles to entry.

PROMISING APPROACHES TO ADDRESSING THE CHALLENGES

In the future, we expect, hope and are driving for the following changes in the cybersecurity and

specifically the cyber insurance market. We are looking at the following to be done over the next

1­2 years::

Standardization: The Verisk Cyber Exposure Data Standard is the first of its kind and creates a

common language for the collection and transfer of data across the insurance value chain.

Acceptance of a common language will aim to reduce the need for time­consuming

interpretations and data conversions as insurers communicate with each other. The Verisk

standard will also inform underwriting guidelines and identify data attributes that are most

critical for risk selection decisions. By capturing data following the Verisk standard, insurers will

be able to create analytics utilizing aggregations of risk. The standard is open source and freely

available to be used by the government, corporations, and the (re)insurance industry.

In addition, a National and an International Cyber Incident and Related Losses database would

be helpful to allow for a single data source across all industry sectors and combine both public

and private data in one place. Verisk continues to support the efforts of the CIDAWG and

CIDAR.

Verisk/ISO is continuing to enhance its standardized cyber insurance forms to introduce

coverages specifically designed for small/middle market businesses.

Expansion of Data Sources: Verisk’s ISO Business Unit has been a leading source of data

analytics and business insights for the property and casualty insurance industry since 1971. To

that end, ISO collects and provides analytics on cyber insurance policy data and claims with the

industry. We realize that cyber insurance is unique in relation to other forms of insurance and

hence also requires unique data assets. We are in the process of expanding our data assets and

seek to collaborate with federal agencies in continuing to do so.
                             

                           

                             

                 

                   

                           

                 

                           

                           

                           

         

        

    

      

               

       

               

         

Cyber Risk Modeling: The AIR Cyber Risk Model will provide insurers with insight into the

likelihood of extreme but plausible cyber breaches and their potential financial impact in the

form of expected claims. Output from the model can be used to inform pricing, mitigation,

portfolio management, enterprise risk management, and claims management decision making,

among other processes. While the probabilistic model is currently under development,

deterministic scenarios have already been released and can be used for decision making today.

As the Commission on Enhancing National Cybersecurity deliberates its recommendations,

Verisk Analytics welcomes the opportunity to provide you with further technical expertise on the

critical issues facing the insurance industry. Please do not hesitate to contact me at 201­469­2662

or via email at gortiz@verisk.com with any questions regarding the foregoing. Thank you in

advance for your kind courtesies.

Respectfully submitted,

George A. Ortiz

Director of Federal Affairs

References:

• AIR Cyber Risk Webpage: http://www.air­worldwide.com/Models/Cyber/

• Verisk Releases Industry's First Cyber Exposure Data Standard: http://www.airworldwide.com/Press­Releases/Verisk­Releases­Industry­s­First­Cyber­Exposure­DataStandard/

• Navigating the Cyber Gray Area: http://www.air­worldwide.com/Publications/AIRCurrents/2016/Challenges­of­the­Cyber­Gray­Area/