<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-cyber-insurance-assessment
description: >-
  Evaluate organizational cyber insurance readiness through control gap analysis, risk quantification using FAIR methodology, policy coverage mapping, and underwriter questionnaire preparation. Covers premium optimization, exclusion analysis, and incident response retainer alignment.
domain: cybersecurity
subdomain: governance-risk-compliance
tags:
  - cyber-insurance
  - risk-quantification
  - FAIR
  - underwriting
  - coverage-analysis
  - premium-optimization
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  nist-csf:
  - "ID.RA-1"
  - "ID.RA-2"
  - "ID.RA-3"
  - "ID.RA-4"
  - "ID.RA-5"
  frameworks:
  - "FAIR"
  - "NIST CSF"
  - "CIS Controls v8"
  - "ISO 27001"
  mitre-attack: []
---

# Performing Cyber Insurance Assessment

## Overview

Cyber insurance assessment bridges security posture with financial risk transfer.
It quantifies residual risk using FAIR methodology, maps control maturity to
underwriter expectations, identifies policy exclusions and sublimits, and
optimizes premium costs through demonstrable security investments.

## Workflow

1. **Coverage Analysis** — Review existing policy for exclusions, sublimits, retroactive dates, and waiting periods
2. **Control Maturity Assessment** — Evaluate security controls against common underwriter questionnaire domains
3. **Risk Quantification** — Apply FAIR methodology to estimate annualized loss expectancy for key scenarios
4. **Gap Identification** — Map control gaps to underwriter red flags that trigger premium increases or denials
5. **Questionnaire Preparation** — Draft accurate responses to underwriter security questionnaires
6. **Premium Optimization** — Recommend control investments with highest premium reduction ROI
7. **Incident Response Alignment** — Ensure IR retainer and breach counsel meet policy notification requirements
8. **Policy Negotiation Support** — Identify negotiable terms, sublimit increases, and endorsement opportunities

## Key Concepts

### FAIR Risk Quantification Model

| Component | Description | Inputs |
|-----------|-------------|--------|
| Loss Event Frequency (LEF) | How often losses occur | Threat event frequency × vulnerability |
| Loss Magnitude (LM) | Financial impact per event | Primary + secondary loss factors |
| Annualized Loss Expectancy | LEF × LM | Combined risk in dollar terms |
| Primary Loss | Direct costs | Response, replacement, productivity |
| Secondary Loss | Indirect costs | Fines, reputation, litigation |

### Underwriter Control Domains

| Domain | Weight | Key Controls |
|--------|--------|-------------|
| MFA Enforcement | Critical | MFA on all remote access, email, privileged accounts |
| EDR Deployment | Critical | EDR on all endpoints with 24/7 monitoring |
| Backup Strategy | High | 3-2-1 backups with offline/immutable copy |
| Patch Management | High | Critical patches within 30 days, zero-days within 72 hours |
| Email Security | High | DMARC enforce, anti-phish, attachment sandboxing |
| Network Segmentation | Medium | IT/OT separation, microsegmentation for crown jewels |
| Privileged Access | Medium | PAM solution, just-in-time access, session recording |

### Common Policy Exclusions

| Exclusion | Risk | Mitigation |
|-----------|------|------------|
| Acts of War/Nation-State | High | Negotiate carve-out for collateral damage |
| Unpatched Known Vulns | Critical | Demonstrate patch SLAs and exception process |
| Social Engineering Sublimit | Medium | Negotiate higher sublimit, add crime policy |
| Regulatory Fines | Variable | Confirm insurable in jurisdiction |
| Prior Knowledge | Critical | Conduct pre-binding assessment |

## Detection Opportunities

### Insurance Readiness Red Flags

- **No MFA on remote access**: automatic denial or 300%+ premium increase from most carriers
- **No EDR deployment**: triggers manual underwriting review and potential exclusion
- **Backup gaps**: no immutable/offline backups leads to ransomware sublimit reduction
- **Stale incident response plan**: untested IR plan signals unpreparedness to adjusters
- **MITRE mapping**: T1078 (Valid Accounts), T1486 (Data Encrypted for Impact), T1566 (Phishing)


## Quick Reference

```bash
node scripts/agent.js analyze --target <scope>
```
