While every business or organization should strive to reduce their risk, we live in a world where it’s impossible to eliminate risk entirely. For example, cyber attacks have become an enormous threat, yet a modern-day business will not survive without joining the digital world in some capacity. Your clients need to be ready to proactively review their risk appetite and ensure they’re not taking on more risk than they can reasonably handle.

PwC defines risk appetite as “the amount of risk an organization is willing to accept in pursuit of strategic objectives.” As participants in the digital world, it’s imperative that businesses and organizations define their cyber risk appetite in a meaningful and specific manner. The only constant you can rely on in cyber is change and businesses need to be prepared to face new, more serious cyber risks every day.

While building a cyber risk appetite statement, your clients should review their own cyber posture to ensure they’re facing the appropriate amount of risk in order to achieve their overall ambitions, while staying in line with the latest in cyber security best practices.

Get the Guide: Creating a Comprehensive Cyber Risk Management Plan

---

Download our free eBook to learn how to limit your exposure and implement an information security risk management plan.

Key Principles That Build a Strong Cyber Risk Appetite Statement

A cyber risk appetite statement specifically defines what an organization has deemed to be an acceptable risk and every organization’s risk tolerance will be different. This statement should be unambiguous and measurable to allow for cohesive and strategic decision making across the board.

A vague cyber risk appetite statement is of little to no use. It’s important that this statement provides clear-cut goals and objectives to help organizations keep their risk profile on track.

As outlined by Marsh & McLennon Companies, these principles should be considered the building blocks of an effective risk appetite statement.

• Risk-focused
• Strategic
• Cascaded
• Leading
• Actionable
• Tailored
• Measurable

As there will always be operational risks for an organization, defining which risks are expected and manageable vs. risks that may be unforeseen and uncontrollable will help your clients remain stable financial institutions well into the future.

Cyber Risk Management: Protecting Your Clients With Cyber Insurance

In our digital world, our reliance on technology is greater than ever before. This means that organizations have to work within the digital space and define the cyber risk appetite that their company will be comfortable with.

In addition to a cyber risk appetite statement, a cyber insurance policy is one of the most important steps your clients can take to protect themselves from the damages of a cyber attack. This type of policy provides both first-party and third-party coverages for companies of all sizes:

First-Party Coverages

• IT Forensics
• Notification Costs
• Credit Protection Costs
• Crisis Management Costs
• Crime and Social Engineering Costs

Third-Party Coverages

• Costs related to a breach of Personally Identifiable Information (PII)
• Potential third-party claims, including breach of contract, negligent protection of data, the transmission of software viruses, and more

Additional Coverages

• Multimedia coverage
• Cyber extortion
• Cyber business interruption
• Hacker damage or digital asset damage

This type of insurance policy not only provides much-needed coverage, but will also improve your client’s cyber posture overall as your clients will need to submit an assessment of their cyber readiness to the insurance carrier, who will conduct a thorough exam of their security practices.

There will always be certain risks that face more potential claims than others. For example, social engineering and ransomware claims make risks more difficult to place as carriers may decide not to write the risk or not to renew because of prior claims.

Additional Steps for Cyber Risk Management

While a cyber insurance policy is an important step in protecting your client’s data integrity, there are a number of additional steps your clients should take to make sure they’re managing their cyber risk appetite:

1. Implement an incident response plan:
   This predetermined arrangement sets out how an organization will respond, should they fall victim to a cyber attack, allowing everyone involved to understand their role in the response and act immediately.
2. Create a culture of cyber threat awareness:
   While your clients may have updated their employees on the latest threats, cyber criminals have already moved on to their next method of attack. It’s important that your clients encourage a constant stream of cyber education to help employees identify risks before they can cause significant damage.
3. Keep software up to date:
   Because cyber attacks are ever-evolving, technology and software have to keep up as well. While software updates can be pesky, they’re happening for a reason. Every glitch repair and patch will help keep your employees’ network out of the hands of a hacker.

For more information on how you can educate and protect your clients from cyber threats, download our FREE infographic, Cyber Risk Management 101. Here, we break down cyber risk management into five steps so your clients can identify and complete potential cyber risk appetite statements for their own organizations.

To speak with a ProWriters expert with any questions, contact us or call us at (484) 321-2335.