Cyber Risk Investigation

The scope of "Phase 1" (completed):

The purpose of the research was to provide insight to actuaries working on capital requirements for insurers setting out the potential impact of cyber risk events and the measures available to mitigate this risk. The aim was to create a greater awareness of the risks for insurers and highlight emerging issues in an area that is changing rapidly as the dependency on computer systems to support insurers’ business increases.

• What is cyber risk?
• The types of risk
• The cost of a cyber risk breach
• Risk mitigation strategies

Phase 1 Outputs:

• Cyber Risk - your views … what our 2019 survey told us blog, February 2020
• Newsletter article, January 2020
• BAJ published an article 'Cyber operational risk scenarios for insurance companies', 19 February 2019
• 'Actuarial Post' has featured cyber risk event,12 November 2018
• Are you giving cyber risk the attention it requires? Visesh Gosrani blogs on a key issue facing global business, 6 November 2018
• GIRO 2018, 23-26 October 2018
• Article in InsuranceERM – ‘UK actuaries devise cyber risk assessment scenarios’, 19 October 2018
• Sessional meeting, paper, and accompanying spreadsheet,15 October 2018
• Talk at JFAR to give perspectives from the actuarial community about the challenges to dealing with cyber risk both from an operational risk perspective and insurance risk perspective, 1 October 2018
• Half-day seminar, 18 April 2017
• Contributed to a draft response on behalf of the profession to the PRA’s Consultation Paper CP 39/16 on “Cyber insurance underwriting risk”, December 2016
• GIRO presentation, 22/23 September 2016
• CIGI presentation, 14 April 2016

The scope of "Phase 2" (in progress):

1. Construct a framework for companies to use to identify and manage Non-Affirmative Cyber risk
2. Survey to inform future direction
3. Cyber Symposium
4. Social Media drive

Phase 2 Outputs:

• Cyber Risk within Capital Models, 14 November 2022
• GIRO Presentation, November 2022
• The silent treatment, The Actuary, 09 April 2020
• Who really understands exposure to cyber risk? The European Actuary, March 2020
• Silent Cyber Blog, January 2020
• Introduction to Silent Cyber Assessment Framework and worked example to illustrate how companies could implement the framework. Silent Cyber Framework Sessional Paper, 9 December 2019

Other outputs:

• Pension scheme cyber risk, 17 November 2020
• Response from the IFoA's Cyber Risk Working Party to the PRA Stress Test Feedback, 01 October 2020
• Cyber models:  Moving from helpful to indispensable, Blog, 01 May 2020
• Homeworking – has your business thoroughly assessed the risk blog, 26 March 2020