The Association of British Insurers (ABI), the British Insurance Brokers’ Association (BIBA), and the International Underwriting Association (IUA) have jointly released new best practice guidance, in conjunction with the NCSC. The objective of this guidance is to reduce the frequency of ransom payments made by UK victims of cyber-extortion.

“It’s really encouraging to see all corners of the insurance industry unite to support victim organisations with guidance that will help them to better understand their options and reduce harm and disruption to their businesses,” said NCSC CEO Felicity Oswald.

This cross-sector coalition’s initiative is founded on recommendations derived from a research paper sponsored by the NCSC and conducted by the Royal United Services Institute (RUSI), which was published in 2023. 

The guidance emphasises prudent steps that organisations should take when confronted with ransomware incidents, aiming to dissuade knee-jerk reactions towards making payments.

Key considerations outlined in the NCSC’s guidance include conducting a comprehensive assessment of the business impact, establishing robust reporting protocols, and accessing sources of support. By adhering to these guidelines, organisations can make informed decisions and bolster their resilience against ransomware attacks.

Despite the issuance of new guidance and the cautionary advice from the NCSC and its partners, the decision whether to pay ransom ultimately rests with the victimised organisations. As the global cyber insurance market continues to expand, organisations are urged to prioritise cybersecurity measures to mitigate the risk of falling prey to ransomware attacks.

However, IUA director of public policy Helen Dalziel added: “The payment of ransoms in response to cyber attacks is on a downward trend globally.”

“Businesses are realising that there are alternative options and this guidance further illustrates how firms can improve their operational resilience to resist criminal demands.”