Skip to main content
Kent Academic Repository

Mapping the Coverage of Security Controls in Cyber Insurance Proposal Forms

Woods, Daniel, Agrafiotis, Ioannis, Nurse, Jason R. C., Creese, Sadie (2017) Mapping the Coverage of Security Controls in Cyber Insurance Proposal Forms. Journal of Internet Services and Applications, 8 (8). ISSN 1867-4828. (doi:10.1186/s13174-017-0059-y) (KAR id:67473)


Policy discussions often assume that wider adoption of cyber insurance will promote information security best practice. However, this depends on the process that applicants need to go through to apply for cyber insurance. A typical process would require an applicant to fill out a proposal form, which is a self-assessed questionnaire. In this paper, we examine 24 proposal forms, offered by insurers based in the UK and the US, to determine which security controls are present in the forms. Our aim is to establish whether the collection of security controls mentioned in the analysed forms corresponds to the controls defined in ISO/IEC 27002 and the CIS Critical Security Controls; these two control sets are generally held to be best practice. This work contains a novel research direction as we are the first to systematically analyse cyber insurance proposal forms. Our contributions include evidence regarding the assumption that the insurance industry will promote security best practice. To address the problem of adverse selection, we suggest the number of controls that proposal forms should include to be in alignment with the two information security frameworks. Finally, we discuss the incentives that could lead to this disparity between insurance practice and information security best practice, emphasising the importance of information security economics in studying cyber insurance.

Item Type: Article
DOI/Identification number: 10.1186/s13174-017-0059-y
Uncontrolled keywords: Business security, Security controls, Cyber insurance, SANS20 controls, ISO/IEC 27000 series
Subjects: H Social Sciences > HG Finance
Q Science
T Technology
Divisions: Divisions > Division of Computing, Engineering and Mathematical Sciences > School of Computing
Divisions > Kent Business School - Division > Kent Business School (do not use)
Depositing User: Jason Nurse
Date Deposited: 03 Jul 2018 15:47 UTC
Last Modified: 04 Mar 2024 19:29 UTC
Resource URI: (The current URI for this page, for reference purposes)

University of Kent Author Information

  • Depositors only (login required):

Total unique views for this document in KAR since July 2020. For more details click on the image.