TRIP 2022 Data Call Changes Cyber Insurance Information Request

Today the Treasury Department’s Federal Insurance Office (FIO) published a notice in the Federal Register (86 FR 64600-64603) concerning proposed changes to the Terrorism Risk Insurance Program’s (TRIP) 2022 Data Call. The revised data collection would include changes to the data templates used to collect information about cyber insurance.

The notice reports that:

“The cyber insurance market continues to grow and evolve, and cyber-related losses (particularly with regard to ransomware) have increased significantly over the past few years.[14] In view of recent market developments and the important role of cyber insurance in the Program, Treasury would like to obtain more detailed information relating to the availability and affordability of such coverage in the market.”

The changes in the cyber question include:

Premium and limits information for cyber coverages written in non-TRIP-eligible lines of insurance,

Premium and policy count information broken out by size of policyholder,

Specific information on the cyber extortion [ransomware] coverages provided under cyber insurance policies, and

Loss information regarding these ransomware exposures.

The FOI is requesting public comments about the proposed changes in the 2022 data call. Comments may be submitted via the Federal eRulemaking Portal (www.regulations.gov; docket # OMB Control Number 1505-0257. Comments should be submitted by January 18^th, 2022.

Treasury Publishes Cyber Insurance TRIA Guidance

The Treasury Department published a guidance notice in tomorrow’s Federal Register (81 FR 95312-95313) concerning the application of the Terrorism Risk Insurance Program (TRIP) to certain forms of stand-alone cyber liability insurance policies under provisions of Terrorism Risk

Insurance Act (TRIA) of 2002, as amended.

There have been concerns about whether or not cyber liability insurance policies are covered under the TRIP. In general, as of January 1^st, 2017 “policies reported for state regulatory purposes under the Cyber Liability sub-line on Line 17—Other Liability of the NAIC's Exhibit of Premiums and Losses (commonly known as Statutory Page 14) are considered “property and casualty insurance” under TRIA.”

As expected with anything deal with insurance, there are some caveats to that general guidance. For existing policies, those cyber liability policies are covered so long as:

• The insurer offered coverage for insured losses subject to the required disclosures under 31 CFR 50 Subpart B; or

• The insurer demonstrates that the appropriate disclosures were provided to the policyholder before the date of any certification of an act of terrorism.

As of April 1^st, 2017, any new cyber liability policies will have to include those required disclosures when issued for the insurance to be covered under TRIP.

Commentary

Having sold insurance for a short while a large number of years ago (which makes me as qualified to advise about insurance as I am about legal matters – NOT), I know that details make a great deal of difference. If you want to ensure that your cyber liability insurance is covered under TRIP, get something in writing from the insurance company stating that your policy conforms to the guidance provided in tomorrow’s Federal Register. And then, get it reviewed by an insurance lawyer.