The Financial Impact of Cyberattacks Is a Given. Why Your Board Needs to Own a Cybersecurity Focus

By: Lewis Guinard | July 21, 2022

Lewis Guignard is a director at Guidewire Software where he leads the development of cyber risk analytics technologies for the insurance industry. He received his Master’s degree in electrical engineering from Stanford University.

A series of new laws and regulations will transform the impact cyber risk and cybersecurity have on a company’s financial health. And companies must adjust their understanding of cyber risks to protect their financial wellbeing.

As a starting point, companies need to re-examine their in-house cybersecurity expertise and increase the knowledge of senior management and boards of directors in regard to cybersecurity issues.

The Government’s Approach to Cyber

Earlier this year, the Cyber Incident Reporting for Critical Infrastructure Act was signed into law. The act requires companies in broadly defined “critical infrastructure” sectors to report notable cyberattacks and ransomware payments to the Cybersecurity and Infrastructure Security Agency (CISA), within 24 to 72 hours.

The act was designed to enhance CISA’s ability to track, analyze and respond to cyberattacks.

In addition, just weeks ago, the Better Cybercrime Metrics Act was signed into law. This law is designed to “improve the way the federal government tracks, measures and analyzes cybercrime.”

The law seeks to create a classification system to categorize various cyber crimes, enabling the FBI and security community to obtain a more holistic picture of the cyber threat environment.

In addition, the Securities and Exchange Commission (SEC) is proposing a new rule to require and standardize disclosure of cybersecurity incidents at public companies.

Specifically, the SEC is calling for mandatory public disclosure of material cybersecurity incidents, as well as requiring periodic disclosure of a company’s security policies.

In response to the increasing operational and financial impact of cyber risks — and the increasing regulatory focus — insurance companies, financial institutions, and credit rating agencies are giving increased focus and weight to cyber risk and preparedness.

Even before the new regulations and reporting requirements, some financial institutions and credit rating agencies publicly warned that cyber risk would be a higher area of priority in their analysis going forward.

And while 82% of companies are concerned their company is vulnerable to a cyberattack, 49% of companies lack the expertise for adequate mitigation and incident response, according to Kroll’s “The State of Incident Response 2021” report.

It is evident that companies need to instill greater cyber risk and cybersecurity expertise in their leadership and their boards of directors.

Although the focus and objectives of a board may vary depending on industry, size and other factors, there are consistent underlying components. Financial, audit, risk, operational and strategic concerns are all well represented by board committees and members. Unfortunately, cybersecurity expertise is consistently lacking.

How Is Cyber Addressed

Most commonly, cyber risk and cybersecurity matters are handled by the audit or risk subcommittee of the board.

But this is only because cybersecurity has been shoehorned into an old-world frame, where “audit” and “risk” are treated generically.

Cybersecurity is clearly a very complex and critical topic, so it seems odd that the audit and risk committee would be lacking specific cybersecurity expertise. In such a structure, the board of directors is dependent on getting their cyber security expertise from sources external to the board. Typically, this is accomplished through periodic communications and reporting from the chief information security officer (CISO) or CIO.

This is not an ideal position, considering ransomware and cyber risks are prime operational and financial risks to the business. Cyberattacks can pose a significant risk to business operations.

Cyberattacks increased 31% from 2020 to 2021, according to Accenture’s “State of Cybersecurity Resilience 2021” report. The number of attacks per company increased from about 200 to more than 270 per year. And the cost of cybercrime is predicted to hit $10.5 trillion by 2025, according to the latest version of the Cisco/Cybersecurity Ventures “2022 Cybersecurity Almanac.”

Cyberattacks have the potential to not only interrupt operations and cause reputational damage but also cause significant financial and investment losses whether from theft of money or information or via reputational harm. And the increased required reporting of cyber incidents will increase public, investor and financial institution awareness of cyber impacts and losses.

Business leaders need to ask themselves some questions: Can the board of directors actually do what it’s supposed to do, fulfill its fiduciary duty with regard to cyber risks, given the current state of affairs? Can the board’s risk committee or the audit committee properly account for and understand cyber risk?

Is the current state what you want for your business, for a client who you are insuring, for a company you are investing in or lending to?

What Boards Should Do

Boards of directors need to understand how to account for, evaluate, plan for and mitigate cyber risk.

Currently, most boards rely on the CISO — and from a corporate view, most CISOs are still working in a silo. While the role of the CISO is evolving and has become increasingly indispensable to the business, most boards have not evolved in terms of cybersecurity.

So, as robust enterprise cybersecurity capabilities become a more critical component of the operational and financial health of a company, the C-suite and board are only becoming more reliant on that single CISO’s point of view.

One solution is to inject more CISO-like or security experience into a board, particularly outside CISO experience or governmental security experience. Prior government experience is often viewed as the path towards this expertise, but it’s only one option.

With the addition of board members with increased security experience, the board of directors can better understand and help direct investment where cyber risks exist — and better partner with CIOs and CISOs in understanding risk and the company’s capability to respond and mitigate that risk.

The SEC recently issued several proposed amendments that could have an impact in this area. Amend Item 407(j) of Regulation S-K would “require disclosure about if any member of the registrant’s board of directors has cybersecurity experience.”

This would require disclosure on annual reports, annual meeting proxy statements, and information statements if any of their board members have previous cybersecurity experience and the details necessary to fully describe that expertise.

We’ve all heard the phrase “today every company is a technology company” — and as companies increasingly depend on technology and as risk evolves, boards of directors need to evolve as well. With added CISO and cybersecurity experience available to the board of directors, companies and their shareholders will be better served. &

The Qualities to Look for when Selecting a Financial Lines Carrier

Operating a business comes with its share of challenges, but having an insurance partner that strives to understand and align with your operations can make all the difference.

By: MSIG USA | October 31, 2024

Running a commercial business is no small feat. Leaders are often tasked with making difficult decisions — sometimes with limited data — and communicating these decisions with confidence while acknowledging their inherent uncertainty.

“Expectations are incredibly high in today’s current climate,” said David Guild, head of financial lines, MSIG USA. “Companies and their leaders must be thoughtful and controlled in their communications, conveying both competence and a clear vision on an ever-evolving world stage.

Nevertheless good leaders (whether they are in the C-suite or on the board of directors) consistently persevere and face the challenges of our evolving world, equipping themselves with the necessary tools and techniques to keep operations running.

For financial companies and commercial businesses looking to keep pace with today’s risks and better understand their own exposures, finding the right insurer need not feel like an added weight.

Below are several qualities to look for in a partner that has the experience and insights to help mitigate and navigate their insureds’ unique exposures, giving leaders the space to focus on their core operations.

Sustainability in All Markets

David Guild, Head of Financial Lines, MSIG USA

When looking for a financial lines insurance partner, sustainability should be top of mind. Knowing that an insurer can provide solutions in a hard market alongside the soft will not only provide peace of mind but also help build resilience.

“Leaders should have the room to concentrate on their vision for the company and what it can achieve — not be burdened by potential risks that keep them awake at night. “Your insurance partners should be able to understand the trials and tribulations of running a business, to respect that there is no single right answer to most challenges, and be prepared to assist wherever, whenever issues may arise,” Guild said.

Sustainability is proven in an insurer’s ability to come through on the promises it makes. For example, MSIG USA’s approach has earned it an A+ rating, proof that its team can back the promises it makes and see them through to completion. “We are confident in our ability to serve your insurance needs, on a global scale,” Guild added.

“Everything we speak of revolves around the credibility of our platform, which is reflected in our A+ rating, a 350-year legacy within our family of companies, and our experienced team here in the U.S.”

An Emphasis on Company and Culture

Successful partnerships are built on a solid relationship between insurer and client.

At MSIG USA, “we aim to be a stable and sustainable presence for our clients,” Guild said. “The value of long-term relationships is at the core of what MSIG USA is all about. Our underwriters deeply appreciate the importance of these connections.

“We believe that building and maintaining strong, long-lasting relationships with our customers is essential to navigating the inevitable fluctuations of the insurance market. We are confident in our abilities, and in yours.” he added.

Company culture, as Guild mentioned, is more than an internal commitment; it’s something that can also drive business relationships.

For insurance partners, analyzing and aligning with their clients’ culture helps to solidify partnerships, as well as open the lines of communication and understanding.

“Variables will change, oftentimes rapidly. From our view, what matters is the culture of that company when responding to change. It’s about trusting their character rather than just the policies and procedures in place,” Guild said.

A Source of Truth and Clear Communication

Effective communication goes a long way in clearly understanding an insured’s business and future potential. This allows for sustainable partners to develop coverage that fits and to work closely with their Claims team to understand the partnership in context.

With the amount of data available today, and the number of ways information can quickly be disseminated through different medium, a good insurance partner knows that companies must be the single source of truth for their stakeholders.

“Quarterly and annual earnings calls provide a platform to discuss financial results and respond to investor questions. Investor presentations offer a more comprehensive overview of the company’s strategy, performance and outlook,” Guild explained.

We will look at what analysts and other third parties think about the information provided to try to glean what the investor base will think and how they will act. But ultimately, it is what the company says, and the way they say it, that we will assist in defending, if need be, and so we make sure to listen and learn from the company leadership.

Bringing These Qualities Under One Roof

Leaders want to know that, at the end of the day, their business is a priority for their partners.

Clear communication, a strong relationship and emphasis on sustainability are just the start. Their insurance partners should strive to understand their business, identify areas of concern and craft coverage customized to meet their needs.

With an impressive 350-year legacy, MSIG USA is doing just that for its clients, utilizing its global presence to further its clients’ goals.

“The key elements of our approach are an intellectual pursuit of information, a well-honed practice of underwriting that identifies material aspects for risk assessment, and clear communication of our insights to our clients: brokers and buyers alike. We aim to provide a transparent and informed perspective on the risks we underwrite,” Guild said.

“We bring sustainable, predictable insurance capital and what we believe is best in class service philosophy, honed by working with some of the most sophisticated brokers and buyers of insurance in the world.”

To learn more, visit: https://www.msigusa.com/financial-lines/.

This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with MSIG USA. The editorial staff of Risk & Insurance had no role in its preparation.

MSIG North America is a member of MS&AD Insurance Group Holdings, Inc. which is the 8th largest non-life insurance group in the world by revenue. Based in Tokyo, Japan, we operate in 48 countries/regions and generated $46B in 2021 with approximately 40,000 employees globally. MSIG North America is the marketing name used to refer to MSIG Holdings (U.S.A.), Inc. (“MSIGH”), and its subsidiary companies.