MS ISO/IEC 27102:2019 Information security management — Guidelines for cyber-insurance

Scope:
This document provides guidelines when considering purchasing cyber-insurance as a risk treatment option to manage the impact of a cyber-incident within the organization’s information security risk management framework.

This document gives guidelines for:

a) considering the purchase of cyber-insurance as a risk treatment option to share cyber-risks;

b) leveraging cyber-insurance to assist manage the impact of a cyber-incident;

c) sharing of data and information between the insured and an insurer to support underwriting, monitoring and claims activities associated with a cyber-insurance policy;

d) leveraging an information security management system when sharing relevant data and information with an insurer.