A Cyber Insurance Backstop

This article analyzes the concept of a federal cyber insurance backstop to cover catastrophic, state-backed cyber incidents, using Merck’s NotPetya-related litigation as a case study and comparing potential models to TRIA/TRIP, NFIP, and the UK’s Pool Re. It details insurers’ expanding exclusions (e.g., Lloyd’s, Chubb), the difficulties of attribution and defining trigger thresholds, and the risk of moral hazard without baseline security requirements. The piece reviews ongoing U.S. policy efforts (Treasury FIO RFC, National Cybersecurity Strategy) and argues that any backstop should be informed by robust empirical evidence on effective security controls, potentially derived from insurer claims data, CIRCIA-driven reporting, or a Bureau for Cyber Statistics, before implementation.