Prepare for cyber insurance
Short label: INSURANCE
Meaning
Cyber insurance covers specified losses and services under the conditions of the policy.
Why it matters
An insurer may ask how you manage access, device protection, backups and response. Cover and claim decisions depend on the policy.
What you can do
Read the questions carefully, keep supporting records and check unclear answers with the insurer or broker.
Services that can help
Device Shield reports and the agreed evidence pack can support your answers. Workshops help explain the controls; insurer acceptance is not guaranteed by a product.
Official reference — NIS2 Art. 21(2)(a)
2. The measures referred to in paragraph 1 shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least the following:
— Directive (EU) 2022/2555 (NIS2), Art. 21(2)
(a) policies on risk analysis and information system security;
— Directive (EU) 2022/2555 (NIS2), Art. 21(2)(a)
You must know your risks and write down how you protect your systems: a risk analysis and a security policy, kept up to date.
Read the article on EUR-Lex → · Official text, quoted from the Official Journal of the EU
Acronyms used here: NIS2, GDPR, DORA, CRA
- NIS2 — Network and Information Systems Directive 2
- An EU cybersecurity directive with requirements for organisations covered by its scope.
- GDPR — General Data Protection Regulation
- The EU regulation on personal-data protection. RGPD is the French name and AVG the Dutch name.
- DORA — Digital Operational Resilience Act
- EU rules on digital operational resilience in the financial sector.
- CRA — Cyber Resilience Act
- EU cybersecurity rules for products with digital elements, including certain software and connected devices.