Most larger companies follow a framework or standard, such as ISO 27001, for risk management. When companies follow a framework, they are naturally developing more mature security architecture and policies, making them easier to insure.

“If a company does not follow a framework, they may be required by the insurer to implement additional protection and respond to any concerns the insurer highlights,” ESET’s Anscombe says.

CISO liability becomes a factor

Recent US federal legislation and regulatory enforcement from the SEC has put CISOs in the firing line, facing the threat of legal action if their organizations’ actual security posture fails to match the assurances reported to investors.

“This has increased jeopardy, and cyber insurance is evolving to encompass individuals as well as their employers,” according to Panaseer’s Povey. “Many CISOs are now considering personal indemnity insurance and asking for it as part of their contract so they’re covered in the event of a lawsuit”.