Potential Federal Insurance Response to Catastrophic Cyber Incidents, 59161-59163 [2022-21133]

Download as PDF Federal Register / Vol. 87, No. 188 / Thursday, September 29, 2022 / Notices Notice and request for comments. ACTION: In accordance with the Paperwork Reduction Act of 1995, FAA invites public comments about our intention to request the Office of Management and Budget (OMB) approval to renew a previously approved information collection. The FAA’s Fuel Tank Flammability Safety rule requires manufacturers to report to the FAA every 6 months on the reliability of the fuel tank flammability reduction systems of their fleet. The data is needed to assure system performance meets that predicted at the time of certification. This collection of information supports the Department of Transportation’s strategic goal of safety. DATES: Written comments should be submitted by November 28, 2022. ADDRESSES: Please send written comments: By Electronic Docket: https:// www.regulations.gov (Enter docket number into search field). By mail: Monica Caldwell, FAA National Headquarters, 800 Independence Ave. SW, Washington, DC 20591–0001. By fax: 405–225–2350. FOR FURTHER INFORMATION CONTACT: Philip Dang by email at: Philip.M.Dang@ faa.gov; phone: 206–231–3442. SUPPLEMENTARY INFORMATION: Public Comments Invited: You are asked to comment on any aspect of this information collection, including (a) Whether the proposed collection of information is necessary for FAA’s performance; (b) the accuracy of the estimated burden; (c) ways for FAA to enhance the quality, utility and clarity of the information collection; and (d) ways that the burden could be minimized without reducing the quality of the collected information. The agency will summarize and/or include your comments in the request for OMB’s clearance of this information collection. OMB Control Number: 2120–0710. Title: Reduction of Fuel Tank Flammability on Transport Category Airplanes. Form Numbers: There are no FAA forms associated with this collection. Type of Review: Renewal of an information collection. Background: The Federal Register Notice with a 60-day comment period soliciting comments on the following collection of information was published on September 19, 2019 (84 FR 49174). There were no comments. Design approval holders use flammability analysis documentation to demonstrate to their FAA Oversight Office that they khammond on DSKJM1Z7X2PROD with NOTICES SUMMARY: VerDate Sep<11>2014 17:52 Sep 28, 2022 Jkt 256001 are compliant with the Fuel Tank Flammability Safety rule (73 FR 42443). Semi-annual reports submitted by design approval holders provide listings of component failures discovered during scheduled or unscheduled maintenance so that the reliability of the flammability reduction means can be verified by the FAA. Respondents: Approximately nine design approval holders. Frequency: Every three years. Estimated Average Burden per Response: Minutes/Hours 100 hours. Estimated Total Annual Burden: 1,800 hours. Issued in Kansas City, Missouri on September 26, 2022. Patrick R. Mullen, Technical Innovation Policy Branch Manager, Policy and Innovation, Aircraft Certification Service. [FR Doc. 2022–21166 Filed 9–28–22; 8:45 am] BILLING CODE 4910–13–P DEPARTMENT OF THE TREASURY Potential Federal Insurance Response to Catastrophic Cyber Incidents Departmental Offices, U.S. Department of the Treasury. ACTION: Request for comment. AGENCY: Over the past several years, the Federal Insurance Office (FIO) in the U.S. Department of the Treasury (Treasury) has continued its ongoing efforts with regard to both cyber insurance and insurer cybersecurity. Cyber insurance is a significant risktransfer mechanism, and the insurance industry has an important role to play in strengthening cyber hygiene and building resiliency. FIO has also increased its data collection in this area with regard to the Terrorism Risk Insurance Program (TRIP) and has supported the development of Treasury’s counter-ransomware strategy. The Government Accountability Office (GAO) released a report in June 2022 recommending that FIO and the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) conduct a joint assessment to determine ‘‘the extent to which risks to critical infrastructure from catastrophic cyber incidents and potential financial exposures warrant a federal insurance response.’’ Both FIO and CISA have agreed to conduct the recommended assessment. FIO is also coordinating with the White House Office of the National Cyber Director on these issues. In order to inform FIO’s future work and the joint assessment, FIO is seeking SUMMARY: PO 00000 Frm 00124 Fmt 4703 Sfmt 4703 59161 comments from the public on questions related to cyber insurance and catastrophic cyber incidents. DATES: Submit comments on or before. November 14, 2022. ADDRESSES: Submit comments electronically through the Federal eRulemaking Portal at https:// www.regulations.gov, in accordance with the instructions on that site, or by mail to the Federal Insurance Office, Attn: Richard Ifft, Room 1410 MT, Department of the Treasury, 1500 Pennsylvania Avenue NW, Washington, DC 20220. Because postal mail may be subject to processing delays, it is recommended that comments be submitted electronically. If submitting comments by mail, please submit an original version with two copies. Comments should be captioned with ‘‘Potential Federal Insurance Response to Catastrophic Cyber Incidents.’’ In general, Treasury will post all comments to www.regulations.gov without change, including any business or personal information provided such as names, addresses, email addresses, or telephone numbers. All comments, including attachments and other supporting materials, are part of the public record and subject to public disclosure. You should submit only information that you wish to make available publicly. Where appropriate, a comment should include a short Executive Summary (no more than five single-spaced pages). Additional Instructions. Responses should also include: (1) the data or rationale, including examples, supporting any opinions or conclusions; and (2) any specific legislative, administrative, or regulatory proposals for carrying out recommended approaches or options. FOR FURTHER INFORMATION CONTACT: Richard Ifft, Senior Insurance Regulatory Policy Analyst, Federal Insurance Office, (202) 622–2922, Richard.Ifft@treasury.gov, Jeremiah Pam, Senior Insurance Regulatory Policy Analyst, Federal Insurance Office, (202) 622–7009, Jeremiah.Pam2@ treasury.gov, or Philip Goodman, Senior Insurance Regulatory Policy Analyst (202) 622–1170, Philip.Goodman@ treasury.gov. Persons who have difficulty hearing or speaking may access these numbers via TTY by calling the toll-free Federal Relay Service at (800) 877–8339. SUPPLEMENTARY INFORMATION: I. Background Cyber insurance is an increasingly significant risk-transfer mechanism, and the insurance industry has an important E:\FR\FM\29SEN1.SGM 29SEN1 59162 Federal Register / Vol. 87, No. 188 / Thursday, September 29, 2022 / Notices khammond on DSKJM1Z7X2PROD with NOTICES role to play in strengthening cyber hygiene and building resiliency.1 Through underwriting and pricing, insurers can encourage or even require policyholders to implement strong cybersecurity standards and controls. More generally, cyber insurance ‘‘can help policyholders respond to lawsuits and loss, and provide associated mitigation services, arising in a variety of situations such as data loss, cloud outage, distributed denial-of-service attacks, malware, and associated ransomware extortion.’’ 2 Cyber insurance is a growing market, with approximately $4 billion in direct premiums written in 2020.3 On June 21, 2022, GAO issued a report, Cyber Insurance: Action Needed to Assess Potential Federal Response to Catastrophic Attacks (GAO Report).4 The GAO Report emphasizes three points about the catastrophic risk of cyber incidents. First, cyber incidents impacting critical infrastructure have increased in frequency and severity. The GAO Report cites a 2020 study by CISA that includes an analysis of scenariobased estimates of potential losses from severe cyber incidents that ranged from $2.8 billion to $1 trillion per event for the United States.5 Second, the GAO Report finds that recent attacks demonstrate the potential for systemic cyber incidents, citing recent cyber attacks that ‘‘illustrate that the effects of cyber incidents can spill over from the initial target to economically linked firms—thereby magnifying the damage to the economy.’’ 6 Third, the GAO Report evaluates some of the issues regarding potential risks presented by cyber incidents to critical infrastructure in the United States.7 (Market participants, including insurers and reinsurers, have similarly highlighted the risks presented by catastrophic and/ 1 See, e.g., FIO, Annual Report on the Insurance Industry (September 2021), 74–78, https:// home.treasury.gov/system/files/311/FIO-2021Annual-Report-Insurance-Industry.pdf (2021 Annual Report). 2 FIO, 2021 Annual Report, 74. 3 FIO, Effectiveness of the Terrorism Risk Insurance Program (June 2022), 62, https:// home.treasury.gov/system/files/311/2022 %20Program%20Effectiveness%20Report %20%28FINAL%29.pdf. 4 GAO, Cyber Insurance: Action Needed to Assess Potential Federal Response to Catastrophic Attacks (2022), https://www.gao.gov/products/gao-22104256. 5 See GAO Report, 25 (citing CISA, Cost of a Cyber Incident: Systematic Review and Cross Validation (2020), 14, https://www.cisa.gov/sites/ default/files/publications/CISA-OCE_Cost_of_ Cyber_Incidents_Study-FINAL_508.pdf). 6 See GAO Report, 16 (identifying the May 2021 attack on the Colonial Pipeline Company, the July 2021 attack on Kaseya, and the February 2022 attack on Viasat, Inc.). 7 See GAO Report, 9–12. VerDate Sep<11>2014 17:52 Sep 28, 2022 Jkt 256001 or systemic cyber incidents with regard to the cyber insurance market.8) The GAO Report also identified potential issues in creating a federal insurance cyber backstop within the scope of the Terrorism Risk Insurance Program (TRIP).9 The GAO Report concludes that a full evaluation of whether there should be a federal insurance response in connection with catastrophic cyber risks would be best addressed by FIO (given its statutory authorities, including monitoring of the insurance sector and assisting the Secretary of the Treasury with administration of TRIP) and CISA (given its expertise in connection with cyber and physical risks to U.S. infrastructure) in a joint assessment to be provided to Congress.10 Both FIO and CISA accepted the GAO recommendation to conduct such a joint assessment, as reflected in letters attached to the GAO Report. As a threshold matter, ‘‘insurance responses’’ can take many forms. Most insurance in the United States is provided through private insurance companies that are regulated at the state level. However, there are a large number of programs and mechanisms, both at 8 See, e.g., Chubb, Catastrophic Cyber Risks—A Growing Concern (2021), 6, https:// www.chubb.com/content/dam/chubb-sites/chubbcom/us-0en/global/global/documents/pdf/202110.21_17-01-0286_Cyber_Systemic_Risks_ whitepaper.pdf; Carnegie Endowment for International Peace, Systemic Cyber Risk: A Primer (March 7, 2022), https://carnegieendowment.org/ 2022/03/07/systemic-cyber-risk-primer-pub-86531; Geneva Association and the International Forum of Terrorism Risk (Re)Insurance Pools, Insuring Hostile Cyber Activity: In search of sustainable solutions (January 2022), 16–20, https:// www.genevaassociation.org/sites/default/files/ research-topics-document-type/pdf_public/ cybersolutions_web.pdf. 9 The GAO Report was originally mandated in the 2019 reauthorization of the Terrorism Risk Insurance Program, which was enacted as part of the Further Consolidated Appropriations Act, 2020, Public Law 116–94, section 502, 133 Stat. 2534, 3027 (2019). See GAO, Cyber Insurance (2022), 3. Specifically, the Terrorism Risk Insurance Program Reauthorization Act of 2019 directed GAO to provide Congress with a study and report that shall: (1) analyze and address— (A) overall vulnerabilities and potential costs of cyber attacks to the United States public and private infrastructure that could result in physical or digital damage; (B) whether State-defined cyber liability under a property and casualty line of insurance is adequate coverage for an act of cyber terrorism; (C) whether such risks can be adequately priced by the private market; and (D) whether the current risk-share system under the Terrorism Risk Insurance Act of 2002 (15 U.S.C. 6701 note) is appropriate for a cyber terrorism event; and (2) set forth recommendations on how Congress could amend the Terrorism Risk Insurance Act of 2002 (15 U.S.C. 6701 note) to meet the next generation of cyber threats. Public Law 116–94 at sec. 502(d). 10 GAO Report, 33. PO 00000 Frm 00125 Fmt 4703 Sfmt 4703 the state and federal level, where insurance coverage may be provided or mandated by state or federal requirements. These arrangements have typically been put into place when the private market has failed to make available affordable insurance to policyholders. At the state level, many states have created residual market funds that ensure all policyholders can obtain coverage (with those obligations spread across the industry as a whole in some fashion) in areas such as workers’ compensation, automobile, and property insurance.11 There are also several federal programs in this area, including TRIP,12 the National Flood Insurance Program,13 the Federal Crop Insurance Program,14 and others. FIO, in association with CISA, seeks public comments as to whether a federal insurance response to ‘‘catastrophic’’ 15 cyber incidents may be warranted, as well as how such an insurance response should be structured and other related issues. FIO intends to assess potential federal insurance responses that are outside of TRIP, but will also consider how potential responses could interact with, or be part of, TRIP. State and federal governments have responded in a variety of ways to situations in which the private market is unable to provide sufficient or affordable insurance, and FIO seeks input on a wide range of options and potential response structures. Among other things, FIO is seeking comment on issues concerning the risks of catastrophic cyber incidents to critical infrastructure,16 the potential 11 See FIO, Annual Report on the Insurance Industry (2021), 66–67, https://home.treasury.gov/ system/files/311/FIO-2021-Annual-ReportInsurance-Industry.pdf. 12 Terrorism Risk Insurance Act of 2002, Public Law 107–297, 116 Stat. 2322 (2002), as amended, 15 U.S.C. 6701 note. The operation of TRIP is described in FIO’s most recent report addressing the effectiveness of the Program. See FIO, The Effectiveness of the Terrorism Risk Insurance Program (June 2022), 5–8, https:// home.treasury.gov/system/files/311/ 2022%20Program%20Effectiveness%20Report %20%28FINAL%29.pdf. 13 See generally ‘‘Flood Insurance,’’ FEMA, last updated March 9, 2022, https://www.fema.gov/ flood-insurance. 14 See generally ‘‘Crop Insurance: Keeps America Growing,’’ National Crop Insurance Services, https://cropinsuranceinamerica.org/. 15 FIO also seeks information on possible definitions of what constitutes a ‘‘catastrophic’’ cyber incident, but in this context the term is generally related to the magnitude of the loss, its dispersion among multiple entities, and the degree of critical services affected. 16 As noted above, the GAO Report recommends a joint assessment on the extent to which the risks to the nation’s critical infrastructure from catastrophic cyber attacks, and the potential financial exposures resulting from these risks, warrant a federal insurance response. CISA has E:\FR\FM\29SEN1.SGM 29SEN1 Federal Register / Vol. 87, No. 188 / Thursday, September 29, 2022 / Notices quantification of such risks, the extent of existing private market insurance protection for such risks, whether a federal insurance response is warranted, and how such a federal insurance response, if warranted, should be structured. II. Solicitation for Comments FIO seeks comments on each of the following topics: Catastrophic Cyber Incidents 1. Nature of Event. What type of cyber incidents could have a catastrophic effect on U.S. critical infrastructure? How likely are such incidents? Are particular sectors of U.S. critical infrastructure more susceptible to such incidents? How should the federal government and/or the insurance industry address the potential for cascading, cross-sector impacts from a cyber incident? What type of potential ‘‘catastrophic’’ cyber incident could justify the creation of a federal insurance response? 2. Measuring Financial and Insured Losses. What data and methodologies could the federal government and/or the insurance industry use to predict, measure and assess the financial impact of catastrophic cyber incidents? What amount of financial losses should be deemed ‘‘catastrophic’’ for purposes of any potential federal insurance response? How should FIO measure and assess potential insured loss from catastrophic cyber incidents? 3. Cybersecurity Measures. What cybersecurity measures would most effectively reduce the likelihood or magnitude of catastrophic cyber incidents? What steps could the federal government take to potentially incentivize or require policyholders to adopt these measures? Potential Federal Insurance Response for Catastrophic Cyber Incidents khammond on DSKJM1Z7X2PROD with NOTICES 4. Insurance Coverage Availability. What insurance coverage is currently available for catastrophic cyber incidents? What are the current limitations on coverage for catastrophic cyber incidents? What rationales have been (or likely would be) used to deny previously identified those critical infrastructure sectors whose ‘‘assets, systems, and networks, whether physical or virtual, are considered so vital to the United States that their incapacitation or destruction would have a debilitating effect on security, national economic security, national public health or safety, or any combination thereof.’’ CISA, ‘‘Critical Infrastructure Sectors,’’ https://www.cisa.gov/critical-infrastructure-sectors. FIO also seeks comment (see Question 8, below) about the potential effects of a federal insurance response that distinguishes between risks to critical infrastructure and non-critical infrastructure. VerDate Sep<11>2014 17:52 Sep 28, 2022 Jkt 256001 coverage for catastrophic cyber incidents? Is the private market currently making available insurance for catastrophic cyber incidents that is desired by policyholders, in terms of the limits, the scope of coverage, and the type and size of businesses seeking coverage? 5. Data and Research. What data do you collect that you would be willing to share with FIO and/or CISA to consider in their assessment of catastrophic cyber incidents and cyber insurance? What other information regarding catastrophic cyber incidents and cyber insurance should FIO and CISA consider? What data should FIO and/or CISA consider collecting to help inform this assessment and their ongoing work? 6. Federal Insurance Response. Is a federal insurance response for catastrophic cyber incidents warranted? Why or why not? 7. Potential Structures for Federal Insurance Response. What structures should be considered by FIO and CISA for a potential federal insurance response for catastrophic cyber incidents? In your answer, please address: • Potential Models. Should an existing federal insurance program (e.g., NFIP or TRIP) or other U.S. or international public-private insurance mechanism serve as a model for, or be modified to address, catastrophic cyber incidents? • Participation. If there were a federal insurance response, should all cyber insurers be required to participate? Should there be other conditions surrounding participation, whether for cyber insurance or policyholders? • Scope of Coverage. What should be included in the scope of coverage? For example, should it be limited to certain critical infrastructure sectors, size(s) of policyholder permitted to participate, policyholder retentions or deductibles, any required coverages, limits, deductibles, etc.? Should coverage be limited to or differentiate whether a firm is U.S.-based or the infrastructure is located within the U.S.? • Cybersecurity Measures. Should cybersecurity and/or cyber hygiene measures be required of policyholders under the structure? If so, which measures should be required? • Moral Hazard. What measures should be included to minimize potential moral hazard risks (e.g., the possibility that either insurers or policyholders might take undue risks in reliance upon a federal insurance response or fail to implement cybersecurity controls)? • Risk Sharing. How should any structure involving private insurance PO 00000 Frm 00126 Fmt 4703 Sfmt 4703 59163 address risk sharing with the government and the private insurance sector? • Reinsurance/Capital Markets. To what extent should reinsurance arrangements, including capital markets participation, be included in any potential insurance response? How would a potential federal insurance response affect the reinsurance and capital markets? • Funding. How should the structure be funded (e.g., should it be pre- or postfunded)? What might the costs be to the federal government and thus the potential impact on taxpayers? • Evaluation/Data Collection. How should any structure and its program administration be evaluated on an ongoing basis, whether by policymakers and/or administrators, including whether there should be reporting requirements to Congress or other authorities (and on what topics) and data collection (and which information to collect)? • Limitations. What catastrophic risk exposures might insurers be unwilling to insure even if a federal insurance response supporting such coverage were adopted? Should limitations exist between cyber and physical incidents (e.g., causes or impacts)? 8. Effects on Cyber Insurance Market. How might a federal insurance response affect the availability and affordability of cyber insurance across the entire insurance market? What would be the effect on any part of the cyber insurance market that would remain outside the parameters of a federal insurance response? Other 9. Please provide any additional comments or information on any other issues or topics relating to cyber insurance and catastrophic cyber incidents. Steven E. Seitz, Director, Federal Insurance Office. [FR Doc. 2022–21133 Filed 9–28–22; 8:45 am] BILLING CODE 4810–AK–P DEPARTMENT OF THE TREASURY Agency Information Collection Activities; Submission for OMB Review; Comment Request; Multiple Internal Revenue Service (IRS) Information Collection Requests Departmental Offices, U.S. Department of the Treasury. ACTION: Notice. AGENCY: The Department of the Treasury will submit the following SUMMARY: E:\FR\FM\29SEN1.SGM 29SEN1

Agencies

[Federal Register Volume 87, Number 188 (Thursday, September 29, 2022)]
[Notices]
[Pages 59161-59163]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2022-21133]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF THE TREASURY


Potential Federal Insurance Response to Catastrophic Cyber 
Incidents

AGENCY: Departmental Offices, U.S. Department of the Treasury.

ACTION: Request for comment.

-----------------------------------------------------------------------

SUMMARY: Over the past several years, the Federal Insurance Office 
(FIO) in the U.S. Department of the Treasury (Treasury) has continued 
its ongoing efforts with regard to both cyber insurance and insurer 
cybersecurity. Cyber insurance is a significant risk-transfer 
mechanism, and the insurance industry has an important role to play in 
strengthening cyber hygiene and building resiliency. FIO has also 
increased its data collection in this area with regard to the Terrorism 
Risk Insurance Program (TRIP) and has supported the development of 
Treasury's counter-ransomware strategy. The Government Accountability 
Office (GAO) released a report in June 2022 recommending that FIO and 
the Department of Homeland Security's Cybersecurity and Infrastructure 
Security Agency (CISA) conduct a joint assessment to determine ``the 
extent to which risks to critical infrastructure from catastrophic 
cyber incidents and potential financial exposures warrant a federal 
insurance response.'' Both FIO and CISA have agreed to conduct the 
recommended assessment. FIO is also coordinating with the White House 
Office of the National Cyber Director on these issues.
    In order to inform FIO's future work and the joint assessment, FIO 
is seeking comments from the public on questions related to cyber 
insurance and catastrophic cyber incidents.

DATES: Submit comments on or before. November 14, 2022.

ADDRESSES: Submit comments electronically through the Federal 
eRulemaking Portal at https://www.regulations.gov, in accordance with 
the instructions on that site, or by mail to the Federal Insurance 
Office, Attn: Richard Ifft, Room 1410 MT, Department of the Treasury, 
1500 Pennsylvania Avenue NW, Washington, DC 20220. Because postal mail 
may be subject to processing delays, it is recommended that comments be 
submitted electronically. If submitting comments by mail, please submit 
an original version with two copies. Comments should be captioned with 
``Potential Federal Insurance Response to Catastrophic Cyber 
Incidents.'' In general, Treasury will post all comments to 
www.regulations.gov without change, including any business or personal 
information provided such as names, addresses, email addresses, or 
telephone numbers. All comments, including attachments and other 
supporting materials, are part of the public record and subject to 
public disclosure. You should submit only information that you wish to 
make available publicly. Where appropriate, a comment should include a 
short Executive Summary (no more than five single-spaced pages).
    Additional Instructions. Responses should also include: (1) the 
data or rationale, including examples, supporting any opinions or 
conclusions; and (2) any specific legislative, administrative, or 
regulatory proposals for carrying out recommended approaches or 
options.

FOR FURTHER INFORMATION CONTACT: Richard Ifft, Senior Insurance 
Regulatory Policy Analyst, Federal Insurance Office, (202) 622-2922, 
[email protected], Jeremiah Pam, Senior Insurance Regulatory 
Policy Analyst, Federal Insurance Office, (202) 622-7009, 
[email protected], or Philip Goodman, Senior Insurance 
Regulatory Policy Analyst (202) 622-1170, [email protected]. 
Persons who have difficulty hearing or speaking may access these 
numbers via TTY by calling the toll-free Federal Relay Service at (800) 
877-8339.

SUPPLEMENTARY INFORMATION:

I. Background

    Cyber insurance is an increasingly significant risk-transfer 
mechanism, and the insurance industry has an important

[[Page 59162]]

role to play in strengthening cyber hygiene and building resiliency.\1\ 
Through underwriting and pricing, insurers can encourage or even 
require policyholders to implement strong cybersecurity standards and 
controls. More generally, cyber insurance ``can help policyholders 
respond to lawsuits and loss, and provide associated mitigation 
services, arising in a variety of situations such as data loss, cloud 
outage, distributed denial-of-service attacks, malware, and associated 
ransomware extortion.'' \2\ Cyber insurance is a growing market, with 
approximately $4 billion in direct premiums written in 2020.\3\
---------------------------------------------------------------------------

    \1\ See, e.g., FIO, Annual Report on the Insurance Industry 
(September 2021), 74-78, https://home.treasury.gov/system/files/311/FIO-2021-Annual-Report-Insurance-Industry.pdf (2021 Annual Report).
    \2\ FIO, 2021 Annual Report, 74.
    \3\ FIO, Effectiveness of the Terrorism Risk Insurance Program 
(June 2022), 62, https://home.treasury.gov/system/files/311/2022%20Program%20Effectiveness%20Report%20%28FINAL%29.pdf.
---------------------------------------------------------------------------

    On June 21, 2022, GAO issued a report, Cyber Insurance: Action 
Needed to Assess Potential Federal Response to Catastrophic Attacks 
(GAO Report).\4\ The GAO Report emphasizes three points about the 
catastrophic risk of cyber incidents. First, cyber incidents impacting 
critical infrastructure have increased in frequency and severity. The 
GAO Report cites a 2020 study by CISA that includes an analysis of 
scenario-based estimates of potential losses from severe cyber 
incidents that ranged from $2.8 billion to $1 trillion per event for 
the United States.\5\ Second, the GAO Report finds that recent attacks 
demonstrate the potential for systemic cyber incidents, citing recent 
cyber attacks that ``illustrate that the effects of cyber incidents can 
spill over from the initial target to economically linked firms--
thereby magnifying the damage to the economy.'' \6\ Third, the GAO 
Report evaluates some of the issues regarding potential risks presented 
by cyber incidents to critical infrastructure in the United States.\7\ 
(Market participants, including insurers and reinsurers, have similarly 
highlighted the risks presented by catastrophic and/or systemic cyber 
incidents with regard to the cyber insurance market.\8\) The GAO Report 
also identified potential issues in creating a federal insurance cyber 
backstop within the scope of the Terrorism Risk Insurance Program 
(TRIP).\9\
---------------------------------------------------------------------------

    \4\ GAO, Cyber Insurance: Action Needed to Assess Potential 
Federal Response to Catastrophic Attacks (2022), https://www.gao.gov/products/gao-22-104256.
    \5\ See GAO Report, 25 (citing CISA, Cost of a Cyber Incident: 
Systematic Review and Cross Validation (2020), 14, https://www.cisa.gov/sites/default/files/publications/CISA-OCE_Cost_of_Cyber_Incidents_Study-FINAL_508.pdf).
    \6\ See GAO Report, 16 (identifying the May 2021 attack on the 
Colonial Pipeline Company, the July 2021 attack on Kaseya, and the 
February 2022 attack on Viasat, Inc.).
    \7\ See GAO Report, 9-12.
    \8\ See, e.g., Chubb, Catastrophic Cyber Risks--A Growing 
Concern (2021), 6, https://www.chubb.com/content/dam/chubb-sites/chubb-com/us-0en/global/global/documents/pdf/2021-10.21_17-01-
0286_Cyber_Systemic_Risks_whitepaper.pdf; Carnegie Endowment for 
International Peace, Systemic Cyber Risk: A Primer (March 7, 2022), 
https://carnegieendowment.org/2022/03/07/systemic-cyber-risk-primer-pub-86531; Geneva Association and the International Forum of 
Terrorism Risk (Re)Insurance Pools, Insuring Hostile Cyber Activity: 
In search of sustainable solutions (January 2022), 16-20, https://www.genevaassociation.org/sites/default/files/research-topics-document-type/pdf_public/cybersolutions_web.pdf.
    \9\ The GAO Report was originally mandated in the 2019 
reauthorization of the Terrorism Risk Insurance Program, which was 
enacted as part of the Further Consolidated Appropriations Act, 
2020, Public Law 116-94, section 502, 133 Stat. 2534, 3027 (2019). 
See GAO, Cyber Insurance (2022), 3. Specifically, the Terrorism Risk 
Insurance Program Reauthorization Act of 2019 directed GAO to 
provide Congress with a study and report that shall:
    (1) analyze and address--
    (A) overall vulnerabilities and potential costs of cyber attacks 
to the United States public and private infrastructure that could 
result in physical or digital damage;
    (B) whether State-defined cyber liability under a property and 
casualty line of insurance is adequate coverage for an act of cyber 
terrorism;
    (C) whether such risks can be adequately priced by the private 
market; and
    (D) whether the current risk-share system under the Terrorism 
Risk Insurance Act of 2002 (15 U.S.C. 6701 note) is appropriate for 
a cyber terrorism event; and
    (2) set forth recommendations on how Congress could amend the 
Terrorism Risk Insurance Act of 2002 (15 U.S.C. 6701 note) to meet 
the next generation of cyber threats.
    Public Law 116-94 at sec. 502(d).
---------------------------------------------------------------------------

    The GAO Report concludes that a full evaluation of whether there 
should be a federal insurance response in connection with catastrophic 
cyber risks would be best addressed by FIO (given its statutory 
authorities, including monitoring of the insurance sector and assisting 
the Secretary of the Treasury with administration of TRIP) and CISA 
(given its expertise in connection with cyber and physical risks to 
U.S. infrastructure) in a joint assessment to be provided to 
Congress.\10\ Both FIO and CISA accepted the GAO recommendation to 
conduct such a joint assessment, as reflected in letters attached to 
the GAO Report.
---------------------------------------------------------------------------

    \10\ GAO Report, 33.
---------------------------------------------------------------------------

    As a threshold matter, ``insurance responses'' can take many forms. 
Most insurance in the United States is provided through private 
insurance companies that are regulated at the state level. However, 
there are a large number of programs and mechanisms, both at the state 
and federal level, where insurance coverage may be provided or mandated 
by state or federal requirements. These arrangements have typically 
been put into place when the private market has failed to make 
available affordable insurance to policyholders. At the state level, 
many states have created residual market funds that ensure all 
policyholders can obtain coverage (with those obligations spread across 
the industry as a whole in some fashion) in areas such as workers' 
compensation, automobile, and property insurance.\11\ There are also 
several federal programs in this area, including TRIP,\12\ the National 
Flood Insurance Program,\13\ the Federal Crop Insurance Program,\14\ 
and others.
---------------------------------------------------------------------------

    \11\ See FIO, Annual Report on the Insurance Industry (2021), 
66-67, https://home.treasury.gov/system/files/311/FIO-2021-Annual-Report-Insurance-Industry.pdf.
    \12\ Terrorism Risk Insurance Act of 2002, Public Law 107-297, 
116 Stat. 2322 (2002), as amended, 15 U.S.C. 6701 note. The 
operation of TRIP is described in FIO's most recent report 
addressing the effectiveness of the Program. See FIO, The 
Effectiveness of the Terrorism Risk Insurance Program (June 2022), 
5-8, https://home.treasury.gov/system/files/311/2022%20Program%20Effectiveness%20Report%20%28FINAL%29.pdf.
    \13\ See generally ``Flood Insurance,'' FEMA, last updated March 
9, 2022, https://www.fema.gov/flood-insurance.
    \14\ See generally ``Crop Insurance: Keeps America Growing,'' 
National Crop Insurance Services, https://cropinsuranceinamerica.org/.
---------------------------------------------------------------------------

    FIO, in association with CISA, seeks public comments as to whether 
a federal insurance response to ``catastrophic'' \15\ cyber incidents 
may be warranted, as well as how such an insurance response should be 
structured and other related issues. FIO intends to assess potential 
federal insurance responses that are outside of TRIP, but will also 
consider how potential responses could interact with, or be part of, 
TRIP. State and federal governments have responded in a variety of ways 
to situations in which the private market is unable to provide 
sufficient or affordable insurance, and FIO seeks input on a wide range 
of options and potential response structures.
---------------------------------------------------------------------------

    \15\ FIO also seeks information on possible definitions of what 
constitutes a ``catastrophic'' cyber incident, but in this context 
the term is generally related to the magnitude of the loss, its 
dispersion among multiple entities, and the degree of critical 
services affected.
---------------------------------------------------------------------------

    Among other things, FIO is seeking comment on issues concerning the 
risks of catastrophic cyber incidents to critical infrastructure,\16\ 
the potential

[[Page 59163]]

quantification of such risks, the extent of existing private market 
insurance protection for such risks, whether a federal insurance 
response is warranted, and how such a federal insurance response, if 
warranted, should be structured.
---------------------------------------------------------------------------

    \16\ As noted above, the GAO Report recommends a joint 
assessment on the extent to which the risks to the nation's critical 
infrastructure from catastrophic cyber attacks, and the potential 
financial exposures resulting from these risks, warrant a federal 
insurance response. CISA has previously identified those critical 
infrastructure sectors whose ``assets, systems, and networks, 
whether physical or virtual, are considered so vital to the United 
States that their incapacitation or destruction would have a 
debilitating effect on security, national economic security, 
national public health or safety, or any combination thereof.'' 
CISA, ``Critical Infrastructure Sectors,'' https://www.cisa.gov/critical-infrastructure-sectors. FIO also seeks comment (see 
Question 8, below) about the potential effects of a federal 
insurance response that distinguishes between risks to critical 
infrastructure and non-critical infrastructure.
---------------------------------------------------------------------------

II. Solicitation for Comments

    FIO seeks comments on each of the following topics:

Catastrophic Cyber Incidents

    1. Nature of Event. What type of cyber incidents could have a 
catastrophic effect on U.S. critical infrastructure? How likely are 
such incidents? Are particular sectors of U.S. critical infrastructure 
more susceptible to such incidents? How should the federal government 
and/or the insurance industry address the potential for cascading, 
cross-sector impacts from a cyber incident? What type of potential 
``catastrophic'' cyber incident could justify the creation of a federal 
insurance response?
    2. Measuring Financial and Insured Losses. What data and 
methodologies could the federal government and/or the insurance 
industry use to predict, measure and assess the financial impact of 
catastrophic cyber incidents? What amount of financial losses should be 
deemed ``catastrophic'' for purposes of any potential federal insurance 
response? How should FIO measure and assess potential insured loss from 
catastrophic cyber incidents?
    3. Cybersecurity Measures. What cybersecurity measures would most 
effectively reduce the likelihood or magnitude of catastrophic cyber 
incidents? What steps could the federal government take to potentially 
incentivize or require policyholders to adopt these measures?

Potential Federal Insurance Response for Catastrophic Cyber Incidents

    4. Insurance Coverage Availability. What insurance coverage is 
currently available for catastrophic cyber incidents? What are the 
current limitations on coverage for catastrophic cyber incidents? What 
rationales have been (or likely would be) used to deny coverage for 
catastrophic cyber incidents? Is the private market currently making 
available insurance for catastrophic cyber incidents that is desired by 
policyholders, in terms of the limits, the scope of coverage, and the 
type and size of businesses seeking coverage?
    5. Data and Research. What data do you collect that you would be 
willing to share with FIO and/or CISA to consider in their assessment 
of catastrophic cyber incidents and cyber insurance? What other 
information regarding catastrophic cyber incidents and cyber insurance 
should FIO and CISA consider? What data should FIO and/or CISA consider 
collecting to help inform this assessment and their ongoing work?
    6. Federal Insurance Response. Is a federal insurance response for 
catastrophic cyber incidents warranted? Why or why not?
    7. Potential Structures for Federal Insurance Response. What 
structures should be considered by FIO and CISA for a potential federal 
insurance response for catastrophic cyber incidents? In your answer, 
please address:
     Potential Models. Should an existing federal insurance 
program (e.g., NFIP or TRIP) or other U.S. or international public-
private insurance mechanism serve as a model for, or be modified to 
address, catastrophic cyber incidents?
     Participation. If there were a federal insurance response, 
should all cyber insurers be required to participate? Should there be 
other conditions surrounding participation, whether for cyber insurance 
or policyholders?
     Scope of Coverage. What should be included in the scope of 
coverage? For example, should it be limited to certain critical 
infrastructure sectors, size(s) of policyholder permitted to 
participate, policyholder retentions or deductibles, any required 
coverages, limits, deductibles, etc.? Should coverage be limited to or 
differentiate whether a firm is U.S.-based or the infrastructure is 
located within the U.S.?
     Cybersecurity Measures. Should cybersecurity and/or cyber 
hygiene measures be required of policyholders under the structure? If 
so, which measures should be required?
     Moral Hazard. What measures should be included to minimize 
potential moral hazard risks (e.g., the possibility that either 
insurers or policyholders might take undue risks in reliance upon a 
federal insurance response or fail to implement cybersecurity 
controls)?
     Risk Sharing. How should any structure involving private 
insurance address risk sharing with the government and the private 
insurance sector?
     Reinsurance/Capital Markets. To what extent should 
reinsurance arrangements, including capital markets participation, be 
included in any potential insurance response? How would a potential 
federal insurance response affect the reinsurance and capital markets?
     Funding. How should the structure be funded (e.g., should 
it be pre- or post-funded)? What might the costs be to the federal 
government and thus the potential impact on taxpayers?
     Evaluation/Data Collection. How should any structure and 
its program administration be evaluated on an ongoing basis, whether by 
policymakers and/or administrators, including whether there should be 
reporting requirements to Congress or other authorities (and on what 
topics) and data collection (and which information to collect)?
     Limitations. What catastrophic risk exposures might 
insurers be unwilling to insure even if a federal insurance response 
supporting such coverage were adopted? Should limitations exist between 
cyber and physical incidents (e.g., causes or impacts)?
    8. Effects on Cyber Insurance Market. How might a federal insurance 
response affect the availability and affordability of cyber insurance 
across the entire insurance market? What would be the effect on any 
part of the cyber insurance market that would remain outside the 
parameters of a federal insurance response?

Other

    9. Please provide any additional comments or information on any 
other issues or topics relating to cyber insurance and catastrophic 
cyber incidents.

Steven E. Seitz,
Director, Federal Insurance Office.
[FR Doc. 2022-21133 Filed 9-28-22; 8:45 am]
BILLING CODE 4810-AK-P
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.