Evaluate. Collaborate. Elevate.

Program Overview

In today’s rapidly evolving landscape, the world is constantly threatened by cyber-attacks. These attacks are becoming increasingly sophisticated, posing risks not only to individuals but also to entire nations and their critical infrastructure.

Even though the United States government has been strengthening its approach to protecting our nation’s critical infrastructure, they cannot do it alone. We all play critical roles in helping ensure our nation’s long-term security. This is especially true for critical infrastructure organizations, such as those in the defense supply chain. Some of these organizations are already investing heavily to improve their own cyber programs.

At Charter Partners, we believe these security-forward organizations deserve to be rewarded for their efforts. That is why we are building a “captive” insurance company just for them. Captives are community-based insurance companies inspired by the age-old mutual insurance model.

The Cyber Risk Collaborative elevates the captive concept by leveraging, and even strengthening, the interdependence of our members. We do this through not only traditional risk sharing, but also by creating a culture of shared resources and information sharing. This minimizes the cost of risk, allows more rapid responses to incidents, unleashes a more resilient critical infrastructure supply chain, and contributes to a more secure future for every American.

Shared Risk

Operating as a subsidiary of a group of businesses, the captive insurance company collaborates within a shared risk model. The captive provides insurance coverage exclusively to its parent companies. In this arrangement, the businesses pool their resources to form the captive, which then assumes the risks of its parent companies.

With a captive insurance company, the collaborating businesses can effectively manage and control their own insurance coverage. This allows the captive to tailor its policies to fit the specific needs and risks of its member companies.

The shared risk model allows businesses to have more control over their insurance costs, claims process, and risk management strategies. This leads to potential cost savings and improved risk mitigation.

High Standards

The impact of a single cyber incident to an individual company can be crippling. An October 2020 study from the United States Cybersecurity and Infrastructure Security Agency (CISA), entitled “Cost of a Cyber Incident: Systematic Review and Cross-Validation,” indicates that the average per-incident cost to small businesses of less than 250 employees and medium-sized businesses of at least 250 employees, but less than 1,000 employees, could range from $5,000 to $226,000. For large businesses of 1,000 or more employees, that cost jumps to $102,000 to $40 million.

As a first line of defense, only organizations holding a current Cybersecurity Maturity Model Certification (CMMC) certification, or those holding a Joint Surveillance Voluntary Assessment (JSVA)-validated Supplier Performance Risk System (SPRS) score of 110, are permitted to participate in the Cyber Risk Collaborative. One of the Cyber Risk Collaborative founders, Jim Goepel, co-created the ecosystem surrounding the CMMC program.

Although CMMC certifications were created to ensure that defense contractors are properly handling and protecting the government’s sensitive information, CMMC certifications are also an objective measure of an organization’s cyber maturity and resiliency. This means that Cyber Risk Collaborative members can be confident that the other members of the captive have also embraced the security-forward culture necessary to stay safe in today’s challenging world.

Shared Information

Our adversaries are smart. They share information and resources with each other, understanding that this makes them much more powerful than if they work independently. We need to beat them at their own game. Rather than leaving members to work in isolation, the Cyber Risk Collaborative creates an information sharing community.

To ensure confidentiality and attorney/client privilege, members sign appropriate nondisclosure and common interest agreements. The common interest doctrine is an extension of attorney-client privilege that protects the confidentiality of communications that are part of a joint defense strategy, such as in an insurance relationship. This approach allows real-time dissemination of indicators of compromise and other sanitized threat and event information to the members. Combined with expert-curated threat intelligence from trusted sources like InfraGard, law enforcement, and ISACs/ISAOs, Cyber Risk Collaborative members have the information and resources they need to stay ahead of our adversaries. This means members can better protect themselves, reducing their individual risk, the overall risk the captive, and ultimately reducing the insurance costs to members of the captive.

As an optional component, the captive can also make the Rapid Response Defensive Network available to members. RRDN is a combination of carefully curated resources, including incident response teams, legal teams, crisis management teams, consultants, managed service providers, cloud services, software, and much more. All at discounted rates, and some at no cost to members as part of an incident response.

Comprehensive Coverage & Financial Transparency

1. General Liability: Covers third-party claims related to bodily injury, property damage, or personal injury. This essential coverage minimizes financial loss and liabilities associated with everyday operations.
2. Workers Compensation: Provides employees with benefits for job-related injuries or illnesses. It ensures compliance with legal standards and supports workplace safety initiatives.
3. Auto: Covers company-owned vehicles for liabilities resulting from accidents, injuries, or property damage. This is especially relevant for businesses with fleets or vehicles as part of their daily operations.
4. Cyber Insurance: The core of Cyber Risk Collaborative, this coverage addresses cyber risks and incidents that could impact critical operations. With a focus on businesses holding certifications like CMMC or JSVA, the program supports a high standard of cybersecurity. Cyber insurance under Cyber Risk Collaborative includes access to incident response resources, discounted rates for cybersecurity services, and real-time threat intelligence sharing.

Potential Carrier

Cyber Risk Collaborative is currently in discussions with potential insurance carriers to provide underwritten support for the captive’s offerings.

Customer Target Demographic

The Cyber Risk Collaborative focuses on businesses that are:

• Defense Contractors: Organizations involved in the defense supply chain, often holding sensitive information and critical security requirements.
• Manufacturing Sector: Companies in this sector face unique operational risks and are highly susceptible to cyber threats due to the integration of technology in manufacturing processes.
• Revenue Range: Targeted businesses with annual revenue between $10 million and $500 million, benefiting from customized risk management strategies for medium-sized operations.
• Location: Primarily based in the region between New London, CT and Norfolk, VA.