US Treasury Weighs Cyber Insurance Backstop

The U.S. federal government is reigniting a long-running debate over whether catastrophic cyber risk requires a public backstop.

See Also: Akamai Study Shows Microsegmentation Boosts Security

A Federal Register notice published this week seeks public comment on how cyber incidents are currently treated under the Terrorism Risk Insurance Program, a post-9/11 framework designed to ensure insurers can cover large-scale attacks without facing systemic collapse. The move signals renewed interest in a question that has lingered for years across both U.S. and U.K. policy circles: whether cyber risk has reached a scale and level of unpredictability that private insurers alone cannot absorb.

TRIP – created in 2002 – was initially designed to stabilize insurance markets after terrorist attacks triggered massive losses and widespread uncertainty. The program provides a federal backstop for insured losses tied to certified acts of terrorism, stepping in when industry losses exceed a certain threshold.

Cyber incidents have long occupied a gray area within the framework. Some cyberattacks may theoretically qualify as terrorism but questions and ambiguity around attribution, intent and scale have complicated how insurers model and price that risk (see: US Government to Study Cyber Insurance Backstop).

Department of the Treasury officials are now asking whether that ambiguity is creating gaps in coverage that could leave critical infrastructure operators exposed in the event of a major cyber disruption.

The request for comment, published in coordination with the Cybersecurity and Infrastructure Security Agency, asks industry stakeholders to weigh in on whether cyber risks are adequately covered under existing law – and whether changes to TRIP are warranted. For now, analysts told Information Security Media Group that the effort appears to remain in an exploratory phase rather than signaling an imminent policy shift.

“I don’t think there’s a huge amount of momentum for a backstop right now,” said Josephine Wolff, an associate professor at the Fletcher School at Tufts University who studies cyber insurance. “The fact that they’re issuing yet another request for comment, rather than any policy proposal, suggests they’re still in the fairly early, exploratory stages of thinking about this.”

That view is echoed by other researchers tracking the issue. Tyler Moore, a professor at the University of Tulsa who studies cybersecurity economics, said momentum for a federal backstop has stalled even as the underlying risk continues to grow.

“Discussions of a backstop remain exploratory in nature, but they are still important,” Moore said. “The industry is not prepared to deal with a widespread catastrophic cyber event.”

Cyber incidents continue to increase in frequency and severity, with ransomware, supply-chain compromises and nation-state attacks raising concerns about the potential for systemic economic disruption. Industry experts have warned for years that a truly catastrophic cyber event – such as a widespread cloud outage or coordinated attack on critical infrastructure – could trigger losses far beyond what insurers are currently prepared to handle.

Wolff said the most significant gaps in the current market are tied to the cost and scope of major incidents, particularly those involving nation-state activity or critical infrastructure.

“Most cyberinsurance coverage is capped significantly lower than many companies would like,” she said. Attacks on power grids, water systems or transportation networks would likely exceed what private insurers can realistically cover.

Moore said insurers have structured policies specifically to avoid those types of correlated, systemic losses.

“Cyber insurance policies today are written in such a way to eliminate correlated risk wherever possible,” he said, pointing to events like SolarWinds where economic damage outpaced insured losses. “The hit to the economy can be much bigger, as firms are not adequately insured.”

That dynamic has fueled periodic calls for a federal cyber insurance backstop, modeled loosely on TRIP or other public-private risk-sharing frameworks used in areas such as terrorism and flood insurance. Previous efforts in the United States have stopped short of establishing a backstop, with policymakers instead focusing on broader cyber risk management reforms and regulatory approaches tied to national cybersecurity strategy (see: Lawmakers Weigh Laws Proposed in Biden’s Cyber Strategy).

The U.K. under the Conservative government of Rishi Sunak explored similar questions but ultimately declined to pursue a government-backed cyber reinsurance scheme, citing concerns that intervention could distort competition even as ransomware activity surged and strained the insurance market (see:UK Conservatives Say ‘No’ to Cyber Insurance Backstop).