As with credit scores, standards will be important. As part of our work with the U.S. Chamber of Commerce, we participated in the establishment of some principles for cyber security risk ratings:

Transparency: Rating companies shall provide sufficient transparency into the methodologies and types of data used to determine their ratings, including information on data origination as requested and when feasible, for customers and rated organizations to understand how ratings are derived.
Dispute, Correction and Appeal: Rated organizations shall have the right to challenge their rating and provide corrected or clarifying data.
Accuracy and Validation: Ratings should be empirical, data-driven, or notated as expert opinion.
Model Governance: Prior to making changes to their methodologies and/or data sets, rating companies shall provide reasonable notice to their customers and clearly communicate how announced changes may impact existing ratings.
Independence: Commercial agreements, or the lack thereof, with rating companies shall not have direct impact on an organization's rating.
Confidentiality: Information disclosed by a rated organization during the course of a challenged rating or dispute shall be appropriately protected.

Where credit scores have driven broad access to consumer credit to grow our economy, widespread adoption of breach insurance will help protect businesses and consumers from the ill effects of intentional or unintentional data breaches and security incidents. Taking a quantitative approach can transform this into another financial trend integral to economic stability. Luckily, emerging empirical scoring solutions can play a big role in enabling the kind of transparency and predictability required to make such a major shift in business risk management both safe and successful.

Instant Insights /

Applying Scores to Cyber Insurance Underwriting

Related Stories

Recommended For You