Somerville and PSC Insurance create cyber checklist

Atturra-acquired and 2022 CRN Australia Impact Awards finalist, IT solutions provider Somerville has partnered with insurance services broker PSC Group to provide organisations with a checklist in support of their requirements for tailored protection against cyber mishaps.

These policies cover a range of areas including the loss of data, ransomware attacks and the reputational damage caused by an attack. 

Some policies extend further and provide assistance with privacy liability, media liability, regulatory proceedings, and fallout from supply-chain attacks.

Through the partnership with PSC, Somerville aims to address the challenges of purchasing cyber insurance, a topic that was covered at CRN Channel Meets last week.

The two companies have constructed an IT cybersecurity checklist which advises companies to consider the specific security factors in support of their cyber insurance policies.

These include:

• Encryption: Ensure that all sensitive data is encrypted at rest and in transit, to reduce the chances of it being misused following an attack.
• MFA: Multi-factor authentication is usually a requirement of many insurers, as it can reduce the chances of unauthorised parties gaining access to resources.
• Endpoint protection: All endpoints on an organisation’s network should be protected by firewalls and antimalware software, which should be regularly updated.
• Data backups: Regular backups of critical data will ensure recovery is possible if an attack occurs. Backups should also be stored off-site, separate from the main corporate environment.
• Backup testing: Data backups should also be regularly tested to ensure their integrity and confirm that they are capable of restoring all core systems within the organisation.
• Email scanning:  All incoming emails should be automatically scanned for malicious links and attachments.
• User training: Regular security awareness training should be conducted for all staff, describing potential risks and the steps staff can take to avoid attacks.
• Admin checks: Organisations should have procedures to verify requests for changes in customer and partner details to ensure only legitimate requests are actioned.
• Financial checks: Rigorous checks should occur when authorising any financial transactions., such as requiring two parties to authorise all transactions over a certain amount.
• Patch management: A patch management policy should be in place to ensure all critical patches are installed as quickly as possible after their release.

“Today, organisations are unlikely to get any insurance cover unless their existing cybersecurity is deemed to be sufficient by the insurer," Somerville chief executive Craig Somerville said.

“This checklist helps to ensure that companies have appropriate tools in place that are constantly managed and regularly updated," Somerville said.

They can demonstrate evidence of staff education as well as the implementation of policies that reduce the chance of attacks occurring in the first place,” he added.

“At the end of the day, cyber insurance only works as a top-up to existing effective security measures - it is not a replacement and should not be regarded as an easy alternative,” Somervile said.

PSC Insurance account executive Tom Salter explained that staying ahead of constantly evolving cyber threats is one of the major challenges facing Australian businesses today.

“To mitigate this risk, it’s crucial that businesses consistently develop, evolve, and improve their cybersecurity posture in today's fast-paced environment,” Salter said.

“Effectively managing cyber risks enhances an organisation’s ability to avoid, respond to, and recover from cyber-attacks."

"However, it is also imperative to demonstrate to insurers that your business has a robust risk management system in place to secure the most appropriate coverage that meets the needs of your business."

"With cyber-attacks becoming increasingly sophisticated, insurers now demand increasing levels of risk management from businesses seeking coverage,” Salter said.

“PSC is thrilled to have partnered with Somerville to provide a checklist, not only to further protect organisations, but also open them up to the added support of an insurance policy,” he concluded.

In February, Somerville partnered with data protection company Veeam to offer offsite and offline immutable backups for cyber insurance and regulatory compliance.

Last year in August, Somerville celebrated its 40th anniversary as a business after a strong year of growth.

During February last year, Somerville launched a trans-Tasman network based on Cisco technology following a $1.2 million investment.