2

How can you assess and protect your business from third-party cyber risks?

Key claims data insight

Read more about what this means for your business

What this means for your business

Don’t underestimate your potential exposure to third‑party vendor breaches and failures. Your exposures aren’t confined to technology vendors, but extend to administration and support services. Major third-party system outages can impact your revenues and create longer-term liabilities and financial and reputational damage, even if it isn’t your fault.

Given the increasing interconnectivity between businesses, tightening your oversight and monitoring of third-party vendors, including understanding your IT vendors’ vendors, could be one of the most financially impactful elements of your cyber risk and insurance strategy.

“Major third-party system outages can impact your revenues and create longer-term liabilities and financial and reputational damage, even if it isn’t your fault."

Priority actions to better prepare, respond and recover from third-party vendor risks

1

Identify your most critical third-party vendors and check they’re included in your insurance cover

You should regularly identify and monitor any business-critical third-party vendors. Cyber insurance can provide cover for a range of third-party vendor issues, but to ensure you’re getting the coverage you need means regularly reviewing the included parties and checking the extent of the cover provided.

Don’t assume your contract will protect you

2

This should be a routine part of your selection and contracting processes. It enables you to align your own coverage to fill the gaps and offers assurance your vendors are ready to manage incidents and respond effectively with appropriate limits.

3

Check your third-party vendors’ cyber insurance

While contractual terms normally provide some protection from cyber risk, you should clarify the specifics. To avoid unwelcome surprises in the event of an incident, confirm the following: Where does the liability sit for cyber events; how would a third-party vendor respond to a cyber incident; to what extent would they reimburse you post incident?

Case study: Transportation provider used cyber insurance to close contractual gaps

…the organization’s cyber insurance cover wrapped around the contract so it picked up where the contract stopped, lowering the upfront costs and covering most of the damage.

A major international transportation provider was impacted by a cyber issue at a key third-party service provider. While the contract provided some protection, the loss exceeded the contractual indemnity provisions. Willis Cyber specialists worked to ensure the organization’s cyber insurance cover wrapped around the contract so it picked up where the contract stopped, lowering the upfront costs and covering most of the damage.

Industry spotlight: Healthcare

Our dataset shows the healthcare industry drives the highest number of cyber notifications to insurers (20%).

Data breaches are the most frequently reported losses for the healthcare sector, accounting for 45% of notifications. The number of records compromised is often small, with 52% of data breach claims impacting fewer than 1,500 records. Such incidents still drive legal and defence costs around dealing with regulators and the settlement of claims.

The healthcare sector has also been impacted by ransomware with an increase in events in recent years. Ransomware incidents now account for 18% of healthcare notifications overall, with costs being driven by business interruption and increased costs of working.

Case study: Ransomware impacts mitigated by cyber insurance

A company providing telecare remote monitoring was hit by a ransomware attack that saw its critical systems encrypted and panic buttons provided to elderly and vulnerable people deactivated. With the support of ransom negotiators provided through the organization’s cyber insurance policy, once the threat actor understood the impact on vulnerable people, they released the decryption key without the need for any payment. The insurer covered the incident response costs.