The New York State Department of Financial Services (“DFS”) has released a report on cyber security in the insurance industry and a series of measures that the DFS said that it will take to help strengthen cyber hacking defenses at insurers.
As indicated in the report, in the coming weeks and months, the DFS will integrate regular, targeted assessments of cyber security preparedness at insurance companies as part of its examination process; put forward enhanced regulations requiring institutions to meet heightened standards for cyber security; and examine stronger measures related to the representations and warranties insurance companies receive from third-party vendors, among other measures.
DFS Superintendent Benjamin M. Lawsky said, “Recent cyber security breaches should serve as a stern wake-up call for insurers and other financial institutions to strengthen their cyber defenses. Those companies are entrusted with a virtual treasure trove of sensitive customer information that is an inviting target for hackers. Regulators and private sector companies must both redouble their efforts and move aggressively to help safeguard this consumer data.”
The DFS conducted a survey with respect to cyber security at a cross-section of its regulated insurance companies. A total of 43 entities, with combined assets of approximately $3.2 trillion, completed a survey seeking information about each participant's cyber security program, costs, and future plans.
The DFS's analysis of the insurers surveyed found that a wide array of factors – not just reported assets – affect the sophistication and comprehensiveness of the insurers' cyber security programs. In other words, although it may be expected that the largest insurers would have the most robust and sophisticated cyber defenses, the DFS did not necessarily find that to be the case.
Moreover, the DFS found that 95 percent of insurers already believe that they have adequate staffing levels for information security and only 14 percent of chief executive officers receive monthly briefings on information security. The DFS said, however, that recent cyber security breaches at financial institutions and other major corporations should serve as a wake-up call for insurers to strengthen their cyber defenses – particularly given the level of sensitive consumer information that insurers are entrusted with handling.