New SEC Rules Add Challenges in Uncertain Cyber Insurance Market

Chair of Olshan’s Insurance Coverage Practice Jeremy King published an article in Bloomberg Law (subscription required) entitled “New SEC Rules Add Challenges in Uncertain Cyber Insurance Market.” Firms must review their cybersecurity practices and policies, Jeremy writes, in the wake of new SEC rules that apply to incident reporting, management oversight and overarching risk mitigation strategies. These new rules will affect cyber insurance requirements and costs. “The incident reporting rule mandates Form 8-K disclosure within four business days of determining that a company experienced a material cybersecurity incident, with limited exceptions,” he explains. “This requires an in-place cyber threat analysis-and-response plan that incorporates obligations the company may have under its insurance policies.” Jeremy writes that the cyber insurance marketplace has rapidly expanded to over $7 billion in 2022 alone. Individual plans should cover liability for privacy violations, fraudulent transfer of monies and direct loss due to ransomware payments. “Underwriting sophisticated coverage programs likely will become more complex as the cyber insurance market matures to address changing regulatory environments,” he says. “Compliance with increasingly complex disclosure requirements and insurance policy obligations requires a considered risk management plan and timely advice from experienced counsel to maximize available benefits and reduce the impact of a cyber incident.”