Notice - 2021 Year-End BSCR Model Schedule V(e) Cyber Risk Stress Test Scenarios (2022-03-08)

Summary

This notice from the Bermuda Monetary Authority clarifies instructions for Schedule V(e) Cyber Risk Stress Test Scenarios within the 2021 Year-End Bermuda Solvency Capital Requirement (BSCR) Model. It applies to insurance groups and Class 4, Class 3B and Class 3A insurers, and refines which parts of the cyber risk schedule apply to which insurers based on their cyber underwriting activity and materiality thresholds.

• Part 1 (Cyber underwriting details): Applies only to insurers that write affirmative cyber risk policies during the reporting period; others proceed to Part 2.
• Part 2 (Non-cyber specific policies): Applies to all insurance groups and Class 4, Class 3B and Class 3A insurers, whether or not they write affirmative cyber.
• Part 3 (Prescribed cyber stress scenarios): Applies to insurers/groups meeting at least one materiality threshold: affirmative cyber gross premium 15% or more of total gross premium; gross estimated affirmative cyber loss at 10% of capital and surplus; gross estimated non-affirmative cyber loss at 5% of capital and surplus; or cyber-related loss events constituting 15% of total losses incurred for the most recent year-end.
• Part 3 clarification: The prescribed stress scenarios (cloud outage, ransomware, data breach) must be applied to the top 10 policyholders based on largest affirmative cyber net loss, not gross cyber limits/exposures as previously indicated.
• Part 4 (Insurer specific cyber stress scenarios): Applies only to affirmative cyber writers.

The Authority states that the new BMA-prescribed cyber-stress section is to be completed on a best-efforts basis for the 2021 year-end filing, and will become fully required for the 2022 year-end filing. The Authority has re-published the 2021 year-end Cyber Stress and Scenarios Instructions on its website, and questions should be directed to riskanalytics@bma.bm.

Key obligations

• Insurers writing affirmative cyber risk policies during the reporting period must complete Part 1 (Cyber underwriting details); others proceed to Part 2.
• All insurance groups and Class 4, Class 3B and Class 3A insurers must complete Part 2 (Non-cyber specific (re)insurance policies issued).
• Insurance groups and Class 4, Class 3B and Class 3A insurers meeting at least one specified materiality threshold must complete Part 3 (Prescribed cyber stress scenarios), applying required impacts to the top 10 policyholders based on largest affirmative cyber net loss.
• Affirmative cyber writers must complete Part 4 ((Re)insurer specific/own cyber stress scenarios).
• The new BMA-prescribed cyber-stress section must be completed on a best-efforts basis for the 2021 year-end filing and will be fully required for the 2022 year-end filing.

Applies to

insurance groups, Class 4 insurers, Class 3B insurers, Class 3A insurers

Deadlines

• 2021 year-end filing: BMA-prescribed cyber-stress section to be completed on a best-efforts basis
• 2022 year-end filing: BMA-prescribed cyber-stress section will be finalised and fully required