Government and insurance industry publish joint statement on helping UK businesses manage cyber risk

The joint statement highlights the risk posed by cyber-attacks on UK business and recognises the role insurers can play in driving improvements in cyber security risk management. The statement marks an important collaboration between the Government and the insurance industry, to support the growth of a cyber-insurance market in the UK and establish working groups to focus on key issues around cyber security.

The benefits of the Government working with leaders in the insurance industry are obvious. Insurers, at the forefront of risk analysis, are able to ask the right questions of customers in respect of security breaches and assess the level of security protection required. The 2014 Information Security Breaches Survey, prepared for the Department for Business, Innovation & Skills, showed that whilst cyber security breaches had, on the whole, decreased from last year, the level of breaches were still high, with 81% of large businesses and 60% of small businesses experiencing security breaches. Interestingly, the report also revealed that 73% of large businesses had suffered from infection by viruses or malicious software in the past year, which is a rise of 14% from the previous year.

The Government’s long-term commitment to making the UK a safe place to do business in cyberspace is reassuring, but it will be interesting to see if developments in the UK’s cyber-insurance market will be effective in reducing the number of security threats and breaches. Even with improvements in the cyber-insurance market, if businesses want to safely embrace opportunities for digital growth then they should still seek to manage the risks of security breaches by investing in resilient IT security and adequately training staff on potential security threats and breaches. Understanding the threats, and being practical about them, is key.

Having a comprehensive, joined-up approach to cyber risk is essential, ranging from understanding your practical exposure and how to reduce that, to recognising and mitigating the legal risks and consequences of a cyber-attack. Prevention is better than cure, certainly, but the ability to react quickly and decisively to the almost inevitable threats is crucial.

Tim Ryan
Shereen Elkins

Information contained in this post does not constitute legal advice and is provided for informational purposes only. Recipients should not act upon it, but should seek legal advice relevant to their own situation.