Cyber insurance backstop: where the federal assessment stands in 2026

There is no federal cyber insurance backstop in the United States as of October 2026. The only federal program that can share cyber losses with insurers is the Terrorism Risk Insurance Program, and it pays only after Treasury certifies an attack as an act of terrorism, which many catastrophic cyber events would not meet. GAO recommended in June 2022 that Treasury's Federal Insurance Office and CISA jointly assess whether a federal insurance response to catastrophic cyber incidents is warranted; both agreed, and both recommendations were still open in April 2026. Treasury has since added a cyber-hybrid scenario to its annual data call and asked for comments on cyber and the terrorism program, while Congress works on extending that program past its 31 December 2027 expiry. Until something changes, a cyber book's tail is carried by its own accumulation limits and its reinsurance. Botminds' Cyber Accumulation Management is built for that work: it keeps the limit per shared vendor against the board's tolerance, and runs an outage from gross through the quota share to the event excess of loss cover.

Product screens on this page show a fictional sample book (Thistlebrook Specialty) and fictional reinsurers; every company in them is invented. Public facts come from GAO, Treasury, the Federal Register, Congress and the IAIS, linked where they appear.

Is there a federal backstop for cyber insurance?

Not for cyber as such. GAO's 2022 finding still describes the position: "Cyber insurance and the Terrorism Risk Insurance Program (TRIP)—the government backstop for losses from terrorism—are both limited in their ability to cover potentially catastrophic losses from systemic cyberattacks" (GAO-22-104256, June 2022). GAO's conclusion about private cover was blunter: cyber insurance "is a tool that has been calibrated for non-catastrophic events."

The protection that does exist runs through terrorism insurance. Treasury issued guidance in December 2016 confirming that standalone cyber cover written in a TRIP-eligible line falls within the program, and codified it in a 2021 rule, GAO records. Treasury's June 2026 report to Congress repeats that "The Program can respond to cyber losses arising from a certified act of terrorism. However, cyber losses can arise in a variety of circumstances, from attritional to catastrophic losses (which may be subject to exclusions), which can complicate the potential application of Program coverage" (U.S. Treasury, Report on the Effectiveness of the Terrorism Risk Insurance Program, June 2026).

Does TRIP cover cyber attacks?

Only those Treasury certifies as acts of terrorism, and only above several thresholds. GAO set out why certification is hard for cyber: attacks "may not meet TRIA’s requirement that attacks be violent or dangerous to human life, property, or infrastructure"; many, "such as ransomware apparently may be motivated only by financial gain" rather than coercion; and damage may fall outside the United States, as with "a cyberattack affecting a U.S. company with a server in an overseas location." As of GAO's report, Treasury had never certified any event under the act.

The order matters for accumulation. A shared-vendor outage of the kind that dominates cyber accumulation (a cloud region failing, a defective update) is not terrorism at all. TRIP is relevant to a narrow class of events: deliberate, coercive, damaging attacks on U.S. soil, large enough to pass the trigger.

What did GAO recommend on cyber insurance?

Two recommendations, one each to CISA and the Federal Insurance Office: jointly assess "the extent to which the risks to the nation’s critical infrastructure from catastrophic cyberattacks, and the potential financial exposures resulting from these risks, warrant a federal insurance response", and report to Congress. Both agencies agreed. GAO also set out what any response should contain: "clear criteria for coverage, specific cybersecurity requirements, and a dedicated funding mechanism with concessions from all market participants."

Both recommendations were open when GAO last updated their status. Treasury's request for information in September 2022 drew 55 responses; in March 2024 Treasury said it had completed its initial assessment and would explore the form a response should take. GAO's latest note ends: "As of April 2026, Treasury had not provided us an update as to when it plans to conclude its overall assessment or communicate its results to Congress" (GAO recommendation status, GAO-22-104256).

What is the FIO cyber insurance assessment?

It is Treasury's response to GAO's recommendation, run by the Federal Insurance Office with CISA and the Office of the National Cyber Director. In February 2024 FIO told its advisory committee it had "completed the initial phase of its work on the assessment of a potential federal insurance response to catastrophic cyber incidents, finding that further exploration of the appropriate form of a federal insurance response is warranted" (FIO, update to the Advisory Committee on Risk-Sharing Mechanisms, 1 February 2024).

a well-designed federal insurance response could address the risks of tail events while incentivizing healthy private sector practices. Conversely, a poorly designed program could shift too much risk to the government and reduce firms’ incentives to guard against certain forms of low probability, but nonetheless foreseeable, risks.

Treasury Assistant Secretary Graham Steele, closing remarks to the FIO conference on catastrophic cyber risk, November 2023, as quoted by FIO

Since then the work has moved into the terrorism program's own machinery. FIO's September 2026 annual report says it "included a new modeled-loss scenario in the 2026 TRIP Data Call to support analyses of potential TRIP exposure arising from certain hypothetical cyber-hybrid terrorism loss events", and that it "continues to assess the cyber insurance market and evolving cyber threats that may create insurance protection gaps or affect insurance market capacity" (FIO Annual Report on the Insurance Industry, September 2026).

What changed in the 2026 TRIP data call?

Treasury asked insurers to model a hybrid attack. The 2026 data call "posed a hypothetical hybrid attack (kinetic and cyber) upon data centers in Ashburn, Virginia, with associated cyber impacts upon the cloud operations supported by those data centers", and insurers reported the losses they would expect and how they would be shared (Treasury TRIP Effectiveness Report, June 2026). Cyber losses were the bulk of the result.

Treasury's request for comments on its 2026 effectiveness report, published in the Federal Register alongside the data call notice, asked about cyber directly, including "Any potential changes to TRIA or TRIP that would encourage the take up of insurance for cyber-related losses arising from acts of terrorism as defined under TRIA", such as changes to "the individual insurer deductible or the federal share percentage" (Federal Register notice 2026-05795, 25 March 2026). Comments closed on 8 May 2026. Note what the question is about: terrorism, not catastrophic cyber in general.

TRIA reauthorization in 2026: what Congress has passed

Both chambers have passed a bill, but not the same bill, and neither is law as of 27 October 2026. The program expires on 31 December 2027 under the 2019 reauthorization. The House passed H.R. 7128, the TRIA Program Reauthorization Act of 2026, on 29 June 2026 by 373 to 15; it was referred to the Senate Banking Committee on 13 July (Congress.gov, H.R. 7128). The Senate passed S. 4395 by unanimous consent on 28 September 2026, and it was held at the desk in the House on 5 October (Congress.gov, S. 4395).

Treasury's June report described both as extending the program to 31 December 2034, the House bill "with certain changes to the certification process" and the Senate bill "without any other changes". Neither, as described, creates a separate cyber backstop. For a cyber book the practical reading is that TRIP's terms, including its certification tests, are likely to continue, and that a catastrophic non-terrorism cyber event remains a private-market loss.

How other countries backstop cyber terrorism

A handful of terrorism pools now extend to cyber, mostly for physical damage. The BIS's Financial Stability Institute and the IAIS listed them in 2026, noting that "Pool Re, established in 1993 to cover terrorism risk, was extended in 2018 to include physical damage to properties in Great Britain from cyber terrorism acts certified by Pool Re and the British government" (FSI Insights No 75, 2026).

None of them covers a non-malicious outage, and most stop at physical damage, which is rarely where a cloud or software outage costs money. The FSI and IAIS conclude that "Governments may need to step in to address the protection gap in cyber insurance by providing backstops for catastrophic accumulation losses from systemic events", while warning that this "could create moral hazard" unless governments "ensure private insurers retain some risk exposure and tie backstop access to strong cyber security standards."

What this means for private accumulation limits

It means the tail is yours. With no federal backstop for non-terrorism catastrophes, and a terrorism program that a vendor outage cannot trigger, the controls that limit a cyber book's worst day are its own: a tolerance per shared vendor, reinsurance bought against a realistic estimate, and data good enough to show both. GAO observed that insurers have already been "limiting their exposures to systemic losses from cyber incidents" through lower limits, exclusions and higher prices; the alternative to blunt limits is better measurement.

The private backstop that exists: gross to quota share to net to event cover

The sample shows the arithmetic. The event cover is $20 million excess of $10 million on the net after a 30% quota share, so it attaches at $14.3 million gross, about 14.5 hours into the outage, and is exhausted before 48 hours. Past that point the insurer keeps every further dollar. Whether the board accepts that shape is a question for the accumulation program; whether the state-backed version of the same event would be covered at all is the subject of cyber insurance war exclusion.

Questions people ask

Is the government creating cyber reinsurance?

Not as of October 2026. Treasury's assessment found in 2024 that a federal response deserved further exploration, and in 2026 it gathered comments and modelled a cyber-hybrid terrorism scenario, but no proposal has been sent to Congress. GAO's recommendations remain open.

What is a catastrophic cyber event?

There is no statutory definition. GAO describes systemic cyber incidents as the possibility that a single incident ripples across critical infrastructure with catastrophic consequences, and cites CISA's description of failures in one component having system-wide consequences. For a cyber book, it is any single cause that reaches many insureds at once.

Would TRIP have paid for the CrowdStrike outage?

No. CISA confirmed on 19 July 2024 that the outage was due to a content update and not malicious activity, so it could not be certified as terrorism. Losses fell to whatever private policies responded to a provider's system failure.

When does TRIA expire?

On 31 December 2027 under the 2019 reauthorization. The House passed H.R. 7128 in June 2026 and the Senate passed S. 4395 in September 2026; Treasury described both as extending the program to 2034, but neither had become law as of 27 October 2026.

How much does TRIP pay after a certified attack?

Once industry losses pass the $200 million trigger and an insurer's losses pass its deductible (20% of its prior-year TRIP-eligible direct earned premium), the government pays 80% of the excess, within a $100 billion annual cap. Federal payments are recouped later through policyholder surcharges.

Does any public pool cover a cloud outage?

None of the pools the FSI and IAIS list covers a non-malicious outage; they respond to certified terrorism, and most only to physical damage. A cloud outage is a private-market risk everywhere they looked.