Discussion on:

Corporate cyberinsurance coverage rare, but shouldn't be

Cyber insurance is an odd product. It is not that expensive for what you get, but all insurance companies that sell it have extensive screening processes to ensure a companies IT infrastructure is well protected before they will cover you.

Such standards are good for the IT industry, but many IT experts are offended by being required to go through more such testing after they have been through ePCI , HIPA, Sar-Ox and other industry, government mandated certification processes.

While each process is great for its focused scope, cyber insurance screening can get into the nuts and bolts of a network in ways the others have not.

Another set of eyes is always good when the insurance company has potentially huge pay outs on the line.

You are very correct when you say "perform stringent due diligence" and " a more secure IT environment is likely to result in a lower premium."

Chubbs review made ePCI compliance look like childs play.

We were told they would not secure a weak network because companies could not afford the premiums.

It is a much more comprehensive security standard you must meet.