Despite being focused on post-breach activities, cyber incident response planning has emerged as a key cybersecurity control in reducing an organization’s likelihood of experiencing a breach-related claim, according to a new report from the Cyber Risk Intelligence Center (CRIC) of Marsh McLennan.
The report, ‘Cybersecurity signals: Connecting controls and incident outcomes’, found that organizations that regularly engage in tabletop exercises and scenario-based breach response drills are 13% less likely to experience a material cyber event than those that do not.
Since launching its 2023 research into the correlation between the 12 cybersecurity controls tracked by the cyber insurance industry and the likelihood of a cyber claim, the CRIC has continued to analyse organizations’ cyber control implementation information from Marsh’s Cyber Self-Assessment against claims. This year, cyber incident response planning ranked as the fifth most effective control in decreasing an organization’s probability of experiencing a breach-based claim, behind network hardening techniques, endpoint detection and response (EDR), logging and monitoring, and cybersecurity awareness training and phishing testing.
