Feds Support Insurers Seeking Protection From Cyber Attacks

The federal government has the backs of insurers and their clients as they seek to protect themselves from, and adapt to, the fast-evolving threat of cyber attacks, Federal Insurance Office Director Michael McRaith assured an industry crowd on March 17.

“We want to support the insurance industry as it seeks to protect itself from cyber incidents,” McRaith said during the Networks Financial Institute 11th Annual Public Policy Summit in Washington, D.C. “Cyber protection should be as strong as it is for any other financial institution.”

McRaith’s spoke to an audience that included property/casualty insurance, reinsurance, mutual insurance and life insurance lobbyists and other professionals. The FIO is part of the U.S. Department of Treasury, and he assured his audience that the Treasury Department (led by Treasury Secretary Jacob Lew and Deputy U.S. Treasury Secretary Sarah Bloom Raskin) has been actively collaborating with “regular law enforcement communities … state government agencies” and others in developing a cyber strategy.

In the wake of cyber attacks on Target, Home Depot, J.P. Morgan Chase, Anthem and others, McRaith said that Lew, Raskin and ultimately President Barack Obama have been paying attention. Among other initiatives: Obama announced plans in February to create the Cyber Threat Intelligent Integration Center, a new agency designed to fight cyber attackers by boosting information sharing between government and industry.

Cyber attacks “create challenges for financial institutions spanning the sector. For the American public, cyber risk can not only be confusion but also overwhelming,” McRaith said. “Because cyber threats transcend the boundaries of financial institutions, [Obama] has established a unified approach to strengthen and maintain critical function amidst cyber threats in 16 sectors, including financial services.”

McRaith also outlined a number of ways the federal government hopes to aid the insurance industry in face of the cyber attack onslaught.

Among them: the push for adoption of voluntary protection standards.

“This provides a risk-based approach to manage cyber security that can help manage insurers or policyholders’ risk profile,” McRaith said. “This framework does not replace existing approaches to enterprise risk management but instead can better inform those approaches when risk is cyber-related.”

McRaith said the Department of Treasury and FIO are eager to work with regulators at the state level on the matter. As well, he said, officials want to see more cyber risk policies added to underwriting in a bid to boost awareness and increase consumer transparency as to the risks involved.

While some in the domestic insurance world are wary about the U.S. interacting too much with its international regulatory counterparts, McRaith said that the effort makes sense for cyber risks. He noted that work continues, in part, through participation in the International Insurance Society, or IIS.

“Through the IIS we look to work with our counterparts around the world to establish international standards in the insurance sector relative to cyber security,” McRaith said.

He added that the FIO is interacting with the IIS financial crime task force, with a goal to “improve awareness response and recovery in the broader insurance business community.”