The NYDFS cyber insurance requirements for insurers are set out in Insurance Circular Letter No. 2 (2021), the Cyber Insurance Risk Framework, issued on 4 February 2021 to all authorized property and casualty insurers. It says that insurers writing cyber insurance "should employ" seven practices: a formal cyber insurance risk strategy approved by the board, and six practices under it covering silent risk, systemic risk, rigorous measurement of each insured's risk, education of insureds and producers, cybersecurity expertise, and a requirement that victims notify law enforcement (DFS Insurance Circular Letter No. 2, 2021). It is guidance, written as best practice, and it is still the clearest statement of what New York's supervisor expects of a cyber book. Botminds' Cyber Underwriting Risk Assessment addresses the practice an underwriting desk owns directly, measuring each insured's risk, by grading every control on every submission against evidence and keeping the result by control.
The insurer's own cybersecurity is a different rule, 23 NYCRR Part 500, covered at the end of this guide and in the Compliance guides it links to. Here the subject is the insurer as underwriter of other companies' cyber risk.
The seven NYDFS cyber insurance practices, each as a check
- Formal cyber insurance risk strategy
Check: a board-approved strategy with quantitative and qualitative goals, and progress reported to senior management and the board on a schedule. Keep: the approved strategy and each progress report.
- Manage and eliminate silent cyber risk
Check: every policy form that could meet a cyber claim says whether it covers or excludes cyber. Keep: the form review and the remaining exposure.
- Evaluate systemic risk
Check: critical third parties of insureds identified and catastrophic scenarios stress-tested. Keep: scenarios, results and the strategy changes they caused.
- Rigorously measure insured risk
Check: each insured assessed with a data-driven plan, external evidence used, and gaps compared with claims. Keep: a grade per control per submission, with its evidence.
- Educate insureds and producers
Check: guidance offered to insureds, pricing tied to control effectiveness, and producer training. Keep: what was offered and how price responds to controls.
- Obtain cybersecurity expertise
Check: underwriters and risk staff with cyber skills, trained, with specialists where needed. Keep: roles, training and outside support used.
- Require notice to law enforcement
Check: policy forms require the insured to notify law enforcement. Keep: the wording in each form.
What are the NYDFS cyber insurance requirements? Seven practices in one circular
The framework is one circular letter with a short preamble and seven practices. The preamble explains why DFS wrote it: ransomware. "A 2020 survey by DFS revealed that from early 2018 to late 2019, the number of insurance claims arising from ransomware increased by 180%, and the average cost of a ransomware claim rose by 150%." DFS also states that it "recommends against making ransom payments", and describes systemic and silent risk as the two challenges that set cyber apart from other lines.
It then sets out the practices. The first, a formal strategy, is the frame: insurers "should have a formal strategy for measuring cyber insurance risk that is directed and approved by senior management and the board of directors", with "clear qualitative and quantitative goals for risk", reported to the board on a regular basis, and incorporating the six practices that follow. The framework was built from what DFS heard: in 2020 it held a roundtable with five global insurance groups and collected survey data from 49 insurers.
What DFS found before writing its cyber insurance framework
180%
rise in ransomware insurance claims, early 2018 to late 2019
150%
rise in the average cost of a ransomware claim over the same period
49
insurers surveyed by DFS on cyber insurance and ransomware in 2020
36%
of those insurers required insureds to notify law enforcement of a cyber incident
Is the NYDFS cyber insurance framework mandatory?
It is written as guidance, not as a regulation with its own penalties. The circular calls the framework a set of "best practices for managing cyber insurance risk", says insurers writing cyber "should employ" them, and asks for a proportionate approach, since each insurer's risk "will vary based many factors, including the insurer's size, resources, geographic distribution, market share, and industries insured."
Guidance from the supervisor still sets the yardstick. A circular letter tells insurers what the Department will look for when it examines a cyber book, and an insurer that can show each practice in operation, with evidence, is in a better position than one that has to explain why it chose not to. That is the reason to turn the practices into checks.
Does the NYDFS framework apply to all insurers, or only cyber writers?
The seven practices apply to authorized property and casualty insurers that write cyber insurance. But one part reaches further: "property/casualty insurers that do not write cyber insurance should still evaluate their exposure to 'silent risk' and take appropriate steps to reduce that exposure." A commercial property or general liability writer with no cyber product is still expected to know whether its forms would pay for a cyber loss.
The circular is addressed to insurers authorized in New York. Surplus lines insurers are not authorized insurers, so the circular is not addressed to them, yet nationally most cyber premium is written on surplus lines paper; why that matters is in admitted vs non-admitted cyber insurance.
Rigorously measure insured risk: the NYDFS practice an underwriting desk owns
This is the practice that lands on the underwriting desk, and the one with the most operational detail. DFS expects a data-driven plan for assessing each insured that starts with information gathered by surveys and interviews, covers a named list of topics, uses external evaluations, and compares the result with claims. One sentence sets the standard of depth: "The information should be detailed enough for the insurer to make a rigorous assessment of potential gaps and vulnerabilities in the insured's cybersecurity."
Read as a check, that sentence asks three things of each submission: were the topics covered, were the gaps identified, and could the insurer show which gaps it found? A file with an application, a scan report and a premium shows the first. Only a grade per control, with the answer and the evidence beside it, shows the second and third, and only grades kept the same way across the book make the claims comparison possible. The questions and evidence behind that grading are set out in does cyber insurance require MFA, which works one control through end to end.
Measuring insured risk: what DFS asks, and what shows it was done
The practice on paper: Applications and supplements on file for each insured.
The practice as a check: Every answer extracted with its question number and page; blanks kept as not answered.
The practice on paper: An outside-in scan report attached to the file.
The practice as a check: Each scan finding mapped to the control and the signed answer it bears on.
The practice on paper: An underwriter’s note that controls were reviewed.
The practice as a check: A grade for each control (meets, partial, gap, contradicted, ask, watch) citing both sides.
The practice on paper: Claims reviewed when large losses arrive.
The practice as a check: Grades stored by control and industry across the book, so claims can be set against the controls that preceded them.
Without an effective ability to measure risk, cyber insurance can therefore have the perverse effect of increasing cyber risk – risk that will be borne by the insurer.
New York Department of Financial Services, 2021
What is silent cyber risk, in the NYDFS framework's words?
Silent, or non-affirmative, cyber risk is the chance that a policy that never mentions cyber pays for a cyber loss. DFS defines it as "risk that an insurer must cover loss from a cyber incident under a policy that does not explicitly mention cyber", and expects insurers ultimately to "eliminate silent risk by making clear in any policy that could be subject to a cyber claim whether that policy provides or excludes coverage for cyber-related losses."
The circular's example is the 2017 NotPetya incident, which DFS, citing the Carnegie Endowment for International Peace, says "led to $3 billion in insurance claims, of which $2.7 billion were made under property/casualty policies that were silent about cyber risks." Measuring silent exposure across a book, and the systemic scenarios that go with it, belong to accumulation management rather than to the underwriting of a single submission; the guide to affirmative vs non-affirmative cyber shows how Cyber Accumulation Management measures both.
Do cyber insurers need to stress test? What the systemic-risk practice asks
Yes, in DFS's view: the framework expects insurers writing cyber to evaluate systemic risk regularly, understand which critical third parties their insureds rely on, model a catastrophic event at such a provider, and run internal stress tests on unlikely but realistic scenarios, accounting for both silent and affirmative risk. It names self-propagating malware, supply chain attacks and an outage at a major cloud provider as examples.
The underwriting desk's contribution is data, not the model. A stress test needs to know which insureds depend on which providers and how their controls graded, and that information arrives in submissions. A process that reads every submission completely, rather than skimming for the price, is also the cheapest source of the dependency data an exposure manager needs; the cloud outage scenario analysis guide shows that data at work in the first hour of an outage.
Educating insureds and producers, and pricing on effectiveness
The fifth practice asks insurers to explain the value of security measures to insureds, to reward them in price, and to help producers understand what they sell. On producers DFS is specific: insurers "should also encourage and assist with the education of insurance producers who should have a better understanding of potential cyber exposures, types and scope of cyber coverage offered, and monetary limits in cyber insurance policies."
The most direct education an underwriter gives is a precise subjectivity. A letter that tells the broker the insured must close remote desktop on a named address, with a rescan to confirm, teaches more than a brochure, and a pricing rule that ties credits to evidenced controls is the incentive the practice describes. How the credits work is in how cyber insurance premium is calculated.
Cyber expertise and notice to law enforcement: the last two NYDFS practices
The expertise practice asks insurers to recruit and train people with cybersecurity skills, and to use consultants or vendors where they need more. The check is a list of roles and training, and a way to show that the people grading controls could read the evidence they graded.
The last practice is a policy wording requirement: "Cyber insurance policies should include a requirement that victims notify law enforcement." DFS gives the reasons: law enforcement can sometimes block or reverse a wire stolen through business email compromise if told promptly, and may hold information private sources lack. When DFS surveyed insurers, 36% required it. The check is mechanical: does each form carry the requirement?
What applications get wrong, by control and industry, across a quarter
What is 23 NYCRR 500, and how is it different from the cyber insurance framework?
23 NYCRR Part 500 is New York's cybersecurity regulation for the companies DFS licenses, insurers included; it governs the insurer's own systems, not the risks it insures. The framework's footnote makes the distinction: all DFS-regulated insurers "also must address their own cybersecurity and comply with the cybersecurity regulations set forth in 23 NYCRR 500." Part 500 is a regulation with enforcement behind it, and its notification rules and the fines DFS has imposed are set out in New York's cybersecurity notification requirements, read from the fines.
Outside New York, the comparable obligation for insurers' own security is the NAIC's Insurance Data Security Model Law, explained in the Insurance Data Security Model Law guide. Neither rule tells an insurer how to underwrite cyber; the 2021 framework is the document that does.
How Cyber Underwriting Risk Assessment supports New York's measurement practice
The solution supplies the evidence for the fourth practice on every submission. It reads the application, supplement, outside-in scan, penetration test and loss history; grades fifteen controls against the carrier's own minimum-controls guide; cites the question and page of each answer and the finding and date of each piece of evidence; and keeps those grades by control and industry across the book. Each quarter the head of cyber sees which controls applications get wrong, in which industries, and which conditions remain open after binding.
It does not write the board strategy, review policy forms for silent cyber, or run stress tests, and it never decides appetite. The underwriting note it drafts, with every statement cited and signed by the underwriter, is the file-level evidence that the insured's risk was measured, not assumed.
The note that shows an insured's risk was measured, control by control
Questions people ask
What is the NYDFS Cyber Insurance Risk Framework?
It is DFS Insurance Circular Letter No. 2 of 4 February 2021, setting out best practices for authorized property and casualty insurers that write cyber insurance: a formal strategy and six practices on silent risk, systemic risk, measuring insured risk, education, expertise and notice to law enforcement.
What does NYDFS expect from cyber insurers?
A board-approved strategy with measurable goals, and evidence that each practice is in operation, in proportion to the insurer's size and book. For underwriting, that means a data-driven assessment of each insured detailed enough to identify gaps, with external sources and a comparison with claims.
Does NYDFS require cyber insurers to discourage ransom payments?
The framework states that DFS recommends against paying ransoms and cites OFAC's warning that paying a sanctioned party can breach sanctions; it does not prohibit payment. Its practices focus on measuring risk and requiring notice to law enforcement.
Is the 2021 NYDFS framework still current?
It is still published among the Department's circular letters, and its practices are not superseded by later DFS guidance on other subjects, such as the 2024 circular on AI in underwriting or the 2023 amendments to Part 500. Check the Department's circular letter list for anything newer before relying on it.
Do brokers have obligations under the NYDFS cyber framework?
The circular is addressed to insurers, but it asks them to help educate producers about cyber exposures, coverage scope and limits. Producers licensed by DFS can themselves be held to Part 500 for their own systems, as the Department's actions against licensed producers show.