Designing model for calculating the amount of cyber risk insurance

Abstract

In the last few years, rising sophistication and impact of cyberattacks has led companies to reassessment of their approach to risk management. Many of them admitted that they are not able to successfully prevent these attacks and they tried to find other ways to mitigate the risk. One of the possible solutions can be a cybersecurity insurance that enables companies to transfer the risk connected with a security breach to an insurance company. Basic problem is then how the cost of insurance should be calculated and how to assess the level of client's IT security controls and related risk. Unlike traditional insurance that derives the premium from target value and statistical models, the cyber insurance should take into account other factors. In this article, authors propose scoring model for cyber insurance that is based on the results of internal and external audits and compliance with mandatory and voluntary standards.