Capital Requirements for Cyber Risk and Cyber Risk Insurance: An Analysis of Solvency II, the U.S. Risk-Based Capital Standards, and the Swiss Solvency Test

REFERENCES

• Aas, K., L. R. Neef, L. Williams, and D. Raabe. 2017. Interest rate model comparisons for participating products under Solvency II. Scandinavian Actuarial Journal 2017:1–22.
   Google Scholar
• Advisen. 2015. Cyber liability insurance market trends: Survey. http://www.partnerre.com/assets/uploads/docs/PartnerRe_Cyber_Liability_Trends_Survey_2015.pdf.
   Google Scholar
• Alm, J. 2015. A simulation model for calculating solvency capital requirements for non-life insurance risk. Scandinavian Actuarial Journal 2015 (2):107–23.
   Web of Science ®Google Scholar
• American Academy of Actuaries. 2007. An update to P/C risk-based capital underwriting factors: September 2007 Report to the National Association of Insurance Commissioners P/C Risk-Based Capital Working Group. http://www.actuary.org/files/publications/CPC_Report_on_RBC_Underwriting_Factors_to_NAIC_Property_RBC_Working_Group_092507.pdf.
   Google Scholar
• Amin, Z. 2016. Quantification of operational risk: A scenario-based approach. North American Actuarial Journal 20 (3):286–97.
   Web of Science ®Google Scholar
• Baer, W. S. and A. Parkinson. 2007. Cyberinsurance in IT Security Management. IEEE Security and Privacy 5 (3):50–56.
   Web of Science ®Google Scholar
• Bashan, A., Y. Berezin, S. V. Buldyrev, and S. Havlin. 2013. The extreme vulnerability of interdependent spatially embedded networks. Nature Physics 9 (10):667–72.
   Web of Science ®Google Scholar
• Berliner, B. 1982. Limits of insurability of risks. Englewood Cliffs, NJ: Prentice Hall.
   Google Scholar
• Betterley. 2015. The Betterley Report—Cyber/privacy insurance market survey 2015. http://betterley.com/samples/EPLI15_nt.pdf.
   Google Scholar
• Biener, C., M. Eling, A. Matt, and J. H. Wirfs. 2015b. Cyber risk: Risikomanagement und Versicherbarkeit. St. Gallen, Sweden: Institut für Versicherungswirtschaft der Universität St. Gallen.
   Google Scholar
• Biener, C., M. Eling, and J. H. Wirfs. 2015a. Insurability of cyber risk: An empirical analysis. Geneva Papers 40 (1):131–58.
   Web of Science ®Google Scholar
• Böhme, R., and G. Kataria. 2006. Models and measures for correlation in cyber-insurance. Working paper. Fifth Workshop on the Economics of Information Security, University of Cambridge, Cambridge, UK.
   Google Scholar
• Born, P., and R. W. Klein. 2016. Catastrophe risk and the regulation of property insurance markets. Journal of Insurance Regulation 35 (5):105–40.
   Google Scholar
• Braun, A., H. Schmeiser, and F. Schreiber. 2015. Portfolio optimization under Solvency II: Implicit constraints imposed by the market risk standard formula. Journal of Risk and Insurance 84 (1):177–207.
   Web of Science ®Google Scholar
• Bundesamt für Privatversicherungen. 2006. Technisches Dokument zum Swiss Solvency Test. https://www.finma.ch/FinmaArchiv/bpv/download/d/SST_technischesDokument_061002.pdf.
   Google Scholar
• Cebula, J. J., and L. R. Young. 2010. A taxonomy of operational cyber security risks. http://www.sei.cmu.edu/reports/10tn028.pdf.
   Google Scholar
• Christiansen, M. C., and M. A. Fahrenwaldt. 2016. Dynamics of solvency risk in life insurance liabilities. Scandinavian Actuarial Journal 2016 (9):763–92.
   Web of Science ®Google Scholar
• Christiansen, M. C., L. F. B. Henriksen, K. J. Schomacker, and M. Steffensen. 2016. Stress scenario generation for solvency and risk management. Scandinavian Actuarial Journal 2016 (6):502–29.
   Web of Science ®Google Scholar
• D’Arcy, S. P. 2016. Casualty catastrophe analytics: Where we are now and where we should be on this critical risk. Variance 10 (2):292–311.
   Google Scholar
• De Giorgi, E. 2005. Reward–risk portfolio selection and stochastic dominance. Journal of Banking and Finance 29 (4):895–926.
   Web of Science ®Google Scholar
• Edwards, B., S. Hofmeyr, and S. Forrest. 2016. Hype and heavy tails: A closer look at data breaches. Journal of Cybersecurity 2 (1):3–14.
   Web of Science ®Google Scholar
• Eling, M., H. Schmeiser, and J. T. Schmit. 2007. The Solvency II process: Overview and critical analysis. Risk Management and Insurance Review 10 (1):69–85.
   Google Scholar
• Eling, M., and J. H. Wirfs. 2016. Cyber risk: Too big to insure?—Risk transfer options for a mercurial risk class. I.VW Schriftenreihe 59. St. Gallen, Sweden.
   Google Scholar
• Eling, M., and J. H. Wirfs. 2019. What are the actual costs of cyber risk events? European Journal of Operational Research 272 (3):1109–19.
   Web of Science ®Google Scholar
• European Commission. 2010. QIS5 technical specifications. https://eiopa.europa.eu/Publications/QIS/QIS5-technical_specifications_20100706.pdf.
   Google Scholar
• European Commission. 2015. Commission Delegated Regulation (EU): Supplementing Directive 2009/138/EC of the European Parliament and of the Council on the Taking-up and Pursuit of the Business of Insurance and Reinsurance (Solvency II). Official Journal of the European Union 58:1–804.
   Google Scholar
• European Insurance and Occupational Pensions Authority. 2014. The underlying assumptions in the standard equation for the Solvency capital requirement calculation. https://eiopa.europa.eu/Publications/Standards/EIOPA-14-322_Underlying_Assumptions.pdf.
   Google Scholar
• European Insurance and Occupational Pensions Authority. 2017. EIOPA statistics—Accompanying note. https://eiopa.europa.eu/Publications/Insurance%20Statistics/SQ_Accompanying%20note.pdf.
   Google Scholar
• Evan, T., E. Leverett, S. J. Ruffle, A. W. Coburn, J. Bourdeau, R. Gunaratna, and D. Ralph. 2017. Cyber terrorism: Assessment of the threat to insurance. Cambridge Risk Framework Series, Centre for Risk Studies, University of Cambridge, Cambridge, UK.
   Google Scholar
• Frezal, S. 2018. Solvency II is not risk-based—Could it be? Evidence from non-life calibrations. North American Actuarial Journal 22 (3):365–79.
   Web of Science ®Google Scholar
• Haas, A., and A. Hofmann. 2014. Risiken aus Cloud-Computing-Diensten: Fragen des Risikomanagements und Aspekte der Versicherbarkeit. ZVersWiss 103 (4):377–407.
   Google Scholar
• Hess, C. 2011. The impact of the financial crisis on operational risk in the financial services industry: Empirical evidence. Journal of Operational Risk 6 (1):23–35.
   Web of Science ®Google Scholar
• Holzmüller, I. 2009. The United States RBC Standards, Solvency II and the Swiss Solvency Test: A comparative assessment. Geneva Papers on Risk and Insurance-Issues and Practice 34 (1):56–77.
   Web of Science ®Google Scholar
• Ibragimov, R. 2009. Portfolio diversification and value at risk under thick-tailedness. Quantitative Finance 9 (5):565–80.
   Web of Science ®Google Scholar
• Ibragimov, R., D. Jaffee, and J. Walden. 2008. Nondiversification traps in catastrophe insurance markets. Review of Financials Studies 22 (3):959–93.
   Web of Science ®Google Scholar
• Ibragimov, R., and A. Prokhorov. 2016. Heavy tails and copulas: Limits of diversification revisited. Economics Letters 149:102–7.
   Web of Science ®Google Scholar
• Ibragimov, R., and J. Walden. 2007. The limits of diversification when losses may be large. Journal of Banking and Finance 31 (8):2551–69.
   Web of Science ®Google Scholar
• Insurance Information Institute. 2017. Cybersecurity and identity theft coverage: The state of the industry. http://www.iii.org/article/cybersecurity-and-identity-theft-coverage-the-state-of-the-industry.
   Google Scholar
• Jacobs, J. 2014. Analyzing Ponemon cost of data breach. http://datadrivensecurity.info/blog/posts/2014/Dec/ponemon.
   Google Scholar
• Kelly, S., E. Leverett, E. J. Oughton, J. Copic, S. Thacker, R. Pant, L. Pryor, G. Kassara, T. Evan, S. J. Ruffle, M. Tuveson, A. W. Coburn, D. Ralph, and J. W. Hall. 2016. Integrated infrastructure: Cyber resiliency in society, mapping the consequences of an interconnected digital economy. Cambridge Risk Framework Series, Centre for Risk Studies, University of Cambridge, Cambridge, UK.
   Google Scholar
• KPMG. 2017. Neues Denken, neues Handeln—Insurance Thinking Ahead: Versicherungen im Zeitalter von Digitalisierung und Cyber. https://home.kpmg.com/de/de/home/themen/2017/02/cyber-versicherungen-werden-zum-must-have.html.
   Google Scholar
• Kunreuther, H. 2015. The role of insurance in reducing losses from extreme events: The need for public–private partnerships. Geneva Papers on Risk and Insurance Issues and Practice 40 (4):741–62.
   Web of Science ®Google Scholar
• Li, Y., N. Tang, and X. Jiang. 2016. Bayesian approaches for analyzing earthquake catastrophic risk. Insurance: Mathematics and Economics 68 (2016):110–19.
   Google Scholar
• Lloyd's. 2015. Business blackout—The insurance implications of a cyber attack on the US power grid. http://cambridgeriskframework.com/downloads.
   Google Scholar
• Louaas, A., and P. Picard. 2017. Optimal insurance for catastrophic risk: Theory and application to nuclear corporate liability. Working paper. https://ideas.repec.org/p/hal/wpaper/hal-01527478.html.
   Google Scholar
• Maillart, T., and D. Sornette. 2010. Heavy-tailed distribution of cyber-risks. European Physical Journal B 75 (3):357–64.
   Web of Science ®Google Scholar
• Marsh. 2016. Continental European Cyber Risk Survey: 2016 Report. https://www.marsh.com/de/de/insights/research-briefings/continental-european-cyber-risk-survey-2016-report.html.
   Google Scholar
• McAfee. 2014. Net losses: Estimating the global cost of cybercrime. http://www.mcafee.com/us/resources/reports/rp-economic-impact-cybercrime2.pdf.
   Google Scholar
• McNeil, A. J., P. Embrechts, and R. Frey. 2015. Quantitative risk management: Concepts, techniques and tools. Princeton, NJ: Princeton University Press.
   Google Scholar
• Moscadelli, M. 2004. The modelling of operational risk: Experience with the analysis of the data collected by the Basel Committee. Technical Report 517, Banca d’Italia, Rome, Italy.
   Google Scholar
• Mukhopadhyay, A., S. Chatterjee, D. Saha, A. Mahanti, and S. K. Sadhukan. 2013. Cyber-risk decision models: To insure it or not? Decision Support Systems 56 (1):11–26.
   Google Scholar
• National Association of Insurance Commissioners. 2009. Risk-based capital, forecasting and instructions 2009: Property/casualty. http://codes.ohio.gov/pdf/oh/admin/2016/3901-3-15_ph_em_ne_app1_20091228_1156.pdf.
   Google Scholar
• National Association of Insurance Commissioners. 2016a. Operational risk. http://www.naic.org/cipr_topics/topic_op_risk.htm.
   Google Scholar
• National Association of Insurance Commissioners. 2016b. Cybersecurity. http://www.naic.org/cipr_topics/topic_cyber_risk.htm.
   Google Scholar
• National Association of Insurance Commissioners. 2016c. Catastrophe risk (E) subgroup. http://www.naic.org/cmte_e_cat_risk_sg.htm.
   Google Scholar
• National Association of Insurance Commissioners. 2016d. Report on the Cybersecurity Insurance Coverage Supplement. http://www.naic.org/documents/committees_ex_cybersecurity_tf_report_cyber_supplement.pdf.
   Google Scholar
• National Association of Insurance Commissioners. 2017. Property and Casualty Risk-Based Capital Newsletter 21.1. http://www.naic.org/documents/cmte_e_prbc_newsltr_1708.pdf.
   Google Scholar
• Neslehová, J., P. Embrechts, and V. Chavez-Demoulin. 2006. Infinite mean models and the LDA for operational risk. Journal of Operational Risk 1 (1):3–25.
   Web of Science ®Google Scholar
• Oak Ridge National Laboratory. 2010. Electromagnetic pulse: Effects on the U.S. power grid. http://survive-emp.com/fileadmin/White-Papers/Solar-Storms/ferc_Executive_Summary_EMP_Impact_on_grid_jan_2010.pdf.
   Google Scholar
• Oughton, E., J. Copic, A. Skelton, V. Kesaite, Z. Y. Yeo, S. J. Ruffle, M. Tuveson, A. W. Coburn, and D. Ralph. 2016. Helios solar storm scenario. Cambridge Risk Framework Series, Centre for Risk Studies, University of Cambridge, Cambridge, UK.
   Google Scholar
• Panjer, H. H. 1981. Recursive evaluation of a family of compound distributions. Astin Bulletin 12 (1):22–26.
   Google Scholar
• Ponemon Institute. 2015. 2015 Cost of cyber crime study: Global. http://informationsecurity.report/Resources/Whitepapers/5fe1dd7e-b46d-49f6-833a-d192cecb29e3_2015-cost-cyber-crime-study-global-pdf-10-w-2093.pdf.
   Google Scholar
• Privacy Rights Clearinghouse. 2016. Data breaches. https://www.privacyrights.org/data-breaches.
   Google Scholar
• Prudential Regulation Authority. 2016. Cyber insurance underwriting risk. Consultation Paper CP39/16, November.
   Google Scholar
• Ruffle, S. J., G. Bowman, F. Caccioli, A. W. Coburn, S. Kelly, B. Leslie, and D. Ralph. 2014. Stress test scenario: Sybil logic bomb cyber catastrophe. Cambridge Risk Framework Series, Centre for Risk Studies, University of Cambridge, Cambridge, UK.
   Google Scholar
• Sandström, A. 2007. Solvency II: Calibration for skewness. Scandinavian Actuarial Journal 2007 (2):126–34.
   Google Scholar
• Scarrott, C., and A. MacDonald. 2012. A review of extreme value threshold estimation and uncertainty quantification. Statistical Journal 10 (1):33–60.
   Web of Science ®Google Scholar
• Seeley, A. 2012. Implementation of a catastrophe risk charge in risk-based capital. http://www.casact.org/education/infocus/2012/handouts/Paper_1271_handout_647_0.pdf.
   Google Scholar
• Shao, A. W., M. Sherris, and J. H. Fong. 2017. Product pricing and solvency capital requirements for long-term care insurance. Scandinavian Actuarial Journal 2017 (2):175–208.
   Web of Science ®Google Scholar
• Sharara, I., M. Hardy, and D. Saunders. 2010. Regulatory capital standards for property and casualty insurers under the US, Canadian and proposed Solvency II (standard) formulas. https://www.soa.org/Files/Research/research-2010-08-regulatory-cap.pdf.
   Google Scholar
• Smack, L. 2016. Catastrophe bonds—Regulating a growing asset class. Risk Management and Insurance Review 19 (1):105–25.
   Google Scholar
• Statista. 2017a. Underwriting expense ratio of property/casualty insurance in the United States from 2009 to 2015 (in billion U.S. dollars). http://www.statista.com/statistics/437137/underwriting-expense-ratio-pc-insurance-usa.
   Google Scholar
• Statista. 2017b. Loss ratio of property/casualty insurance in the United States from 2009 to 2015. https://www.statista.com/statistics/437126/loss-ratio-pc-insurance-usa.
   Google Scholar
• Statista. 2017c. Life and non-life insurance direct premiums written globally from 2013 to 2015 (in trillion U.S. dollars). https://www.statista.com/statistics/217278/world-life-and-nonlife-insurance-premiums-written.
   Google Scholar
• Swiss Re. 2015. Investors’ Day—Rüschlikon, December 8. http://media.swissre.com/documents/id2015_full_slide_package.pdf.
   Google Scholar
• Villaseñor-Alva, J. A., and E. González-Estrada. 2009. A bootstrap goodness of fit test for the generalized Pareto distribution. Computational Statistics and Data Analysis 53 (11):3835–41.
   Web of Science ®Google Scholar
• Wang, S. 1998. Aggregation of correlated risk portfolios: Models and algorithms. Proceedings of the Casualty Actuarial Society 85 (163):848–939.
   Google Scholar
• Wheatley, S., T. Maillart, and D. Sornette. 2016. The extreme risk of personal data breaches and the erosion of privacy. European Physical Journal B 89 (1):7.
   Web of Science ®Google Scholar
• Wirfs, J. H. 2016. How to organize cyber risk transfer? Working paper. https://www.alexandria.unisg.ch/248635.
   Google Scholar
• Wisconsin School of Business. 2018. Regression modeling with actuarial and financial applications. http://instruction.bus.wisc.edu/jfrees/jfreesbooks/Regression%20Modeling/BookWebDec2010/data.html.
   Google Scholar
• World Economic Forum. 2014. Global risks 2014: Ninth edition. http://www3.weforum.org/docs/WEF_GlobalRisks_Report_2014.pdf.
   Google Scholar
• Wu, Y. C. 2015. Reexamining the feasibility of diversification and transfer instruments on smoothing catastrophe risk. Insurance: Mathematics and Economics 64:54–66.
   Web of Science ®Google Scholar
• Wüthrich, M. V. 2015. From Ruin Theory to Solvency in non-life insurance. Scandinavian Actuarial Journal 2015 (6):516–26.
   Web of Science ®Google Scholar