Our cyber consulting team was recently engaged to carry out an in-depth cyber risk assessment for a major US holding company, which provides professional and technical services for over 10 US-based entities across food, sport and entertainment industry verticals.

Due to the relative size and complexity of the company, underwriters required a comprehensive overview of the organisation and its approach to cyber governance, as well insight into the risk and exposure of its critical data stores, supply chain and any potential interdependencies across different areas of the business.

The process

Working with the client over a period of 3 months, we developed a highly detailed understanding of the client from an information security perspective, with a specific focus on how each entity is governed (whether centrally or autonomous) and how the business maintained and secured its various critical systems and service offerings.

Following an initial scoping workshop with the client, a consultant deployed to the US for a week long engagement to collect data and complete a detailed controls assessment with various internal stakeholders.

Previous engagement with underwriters and the insurance market had been limited in scope, meaning the client had minimal opportunity to present and explain its cyber security posture and risk management processes holistically across the business.

It was felt, from a broker perspective, that the client’s risk was likely misunderstood and this had likely contributed to an inflated insurance premium.

The result

Using the information obtained throughout our engagement, we produced a highly detailed cyber risk report which enabled underwriters to better understand the client’s exposure, and provided supporting narrative around specific nuances and control gaps which are traditionally omitted (and therefore often misunderstood) in a traditional underwriting engagement.

The final report, which included a detailed list of recommendations, demonstrated fantastic return on investment by reducing the client’s cyber insurance premium by a significant amount.