How Cyber/Tech E&O Insurance is Priced/Underwritten
Written by: Brian Mahon, CIC
Published first on Nov 18
https://www.insuranceformsps.com/post/how-cyber-tech-e-o-insurance-is-priced-underwritten
It's often a mystery to business insurance buyers how insurance carrier underwriters determine premiums.
It really is five simple items when it comes to cyber liability and technology errors & omissions insurance:
1. What you do.
This is often your company's industry, SIC code or NAICS code. Underwriters browse your company website to put you in a box. Note, if you promise everything under the sun on your company website but you really derive 80%+ percent of your revenue from one type of service, expect scrutiny.
2. How big you are.
This is often the "rating basis" or the figure that underwriters multiply by their rates to determine your premium, often this is gross annul estimated sales/revenue.
3. Have you had a data breach before?
No, great! Yes, well okay, how big, what did it cost, how did the bad guys get in, what was done to prevent this further, what did you learn, tell a story about how your company is a better risk despite having had a breach in the past. Think of this step as your loss history/claims experience.
4. How much data do you have?
Usually underwriters are intrested in number of records of PHI personal Health information, PII, personally identifiable information, PFI personal financial information. It's often difficult to figure out exactly the number of records so usually a ball park estimate is okay less than 100K, between 100K and 500K, 1M+ etc.
5. IT Controls
The last but most important factor is IT Controls. This is where the good risks become the best risks and often where the premium swing can be the greatest. Take the top four items and make them identical across company A and B, but company B has better controls, underwriters can swing premiums upwards of 30% in savings/discounts.
See the chart below for a breakdown:
What underwriters look at.
