Cyber insurance: the prerequisites

How the seal comes about

• Cyber insurance is an add-on to the human audit. It is ordered with the audit, the details are requested afterwards and checked separately.
• The proof names the declared measures and the measured state with date. Internal details such as the emergency contact stay internal.
• The price depends on the scope of the website; the quote is in the order.

What the seal tells an insurer

It documents, as of a date, that the website is maintained and that the operator has declared the organisational basics: backups, access protection, updates, training. The procedure reads the website like a visitor; security scans, vulnerability and load tests belong to other procedures. The order log records every run and every judgement so that the activity proof holds over time.

Ongoing monitoring as a prerequisite

• The cyber certificate requires active monitoring with the Cyber category for the domain. Without it, it is not issued.
• Monitoring measures the Cyber category daily, the other categories monthly; each run produces a state with scores per audit area and the change from the previous month.
• The monthly price is reserved once per month on the first run; further runs that month cost nothing. If credit is missing, the next day tries again.
• Measured are software currency (libraries past end of maintenance, visible versions, server signature), security headers, data protection and loading behaviour, each run with evidence in the case folder.

Read-only access: probed, never used

• Access to FTP, SFTP, SSH, PostgreSQL and MySQL is stored by the organisation in its vault; host and port are part of the entry's purpose.
• Every cyber run probes all stored accesses: open the connection, read the greeting, disconnect. The service never logs in. Unreachable accesses appear as a finding in the state.
• The login itself is done by the authorised auditing person, with purpose and deadline in the log.

The organisation's vault

• Every secret has a kind: audit (read only by the measurement core, for protected areas behind login or basic auth), external system (read only by the service) or safekeeping (plain text for owners and auditors released per entry).
• Every access is recorded with its purpose in the vault log and in the organisation's activity log, without the value. Audit and external-system secrets are never shown in plain text, not even to the owner.
• Before each run the measurement core reads the access to the protected area from the vault of the order or the organisation; if the login fails, it measures without it and says so in the run.

Beratung und Angebot

Deckung, Versicherbarkeit, Marktvergleich und Angebot über unseren Versicherungspartner Cyberverantwortung. Angemeldete Kunden bekommen das Formular unter „Cyberversicherung“ im Zahnrad ihrer Organisation mit ihren Stammdaten vorbelegt.