Companies that wanted to renew their cyber policies at the turn of the year had to dig deep into their pockets. A significant increase in premiums with a simultaneous doubling of deductibles and reduction of limits is a reality for cyber insurance. Meanwhile, the claims situation continues to worsen. Most of these are ransomware attacks, which are becoming more and more professional and frequent. The "Ransomware-as-a-Service" business model is constantly evolving: On the one hand, the attackers encrypt active systems and, if possible, backups as well. On the other hand, they steal confidential data or personal data worthy of protection in order to exert additional pressure (double extortion). In this way, attacked companies are brought to their knees and the decision-makers are persuaded to pay the ransom. The individual ransom demand is adjusted to the financial possibilities of the attacked company, but experience shows that it can be negotiated down.

Cyber security requirements for insurance coverage

In response to the significant increase in losses, insurers are now formulating specific cyber security requirements. Companies must meet these requirements if they want to take out a serious cyber policy. The essential requirements for cyber security are:

1. Transparency across all assets (IT systems and processed data)
2. Multi-factor authentication for any remote access (e.g. from home office) to IT systems
3. Strong passwords (length and complexity requirements)
4. Annual employee awareness training on information security and cyber risks, combined with a simulated phishing attack
5. Strict network segmentation of operational technology and/or legacy systems and by geography or organization
6. Continuous and responsive patch management (monitoring vulnerabilities, installing critical patches within 72 hours)
7. Solid backup strategy (following the 3-2-1 rule as well as an offline or stand-alone cloud backup for ransomware incidents).
8. Documented and annually practiced disaster recovery plan (including backup recoveries).
9. For large and internationally oriented companies: Uniform cybersecurity standards at all subsidiaries

Coverage restrictions

An important development in the transfer of cyber risks is that more and more insurers are massively limiting the scope of coverage in connection with damage caused by ransomware. This can be attributed to the high frequency of ransomware incidents. Consequently, some insurers do not offer any coverage at all for this attack tactic or malware. Others limit their benefits to a maximum of 50% from the sum insured or additionally involve the policyholder in such incidents. Sporadically, damage caused by critical vulnerabilities that have become known, such as Microsoft Exchange or Log4Shell, is also excluded from the scope of coverage when taking out insurance.

Increase in insurance premiums

Cyber insurance premiums have undergone a correction in recent years due to the ever-increasing threat and claims situation. When renewing a cyber insurance policy, premium surcharges of 50-100% are common. After major claims, a quadrupling of the premium may also apply. In addition, select insurers have implemented minimum premiums to better control frequency claims on their books. Insurance companies have also announced strategy adjustments for cyber insurance in 2022. So stabilization of the market does not seem to be within reach.

Author

Max Keller is Head of the Funk Risk Lab at Funk Insurance Brokers AG
> www.funk-gruppe.ch

A 10-point plan for managing a cyber emergency

A cyberattack is more likely today than ever before. Studies by the IT security service provider Sophos, such as "The State of Ransomware 2021", show that internationally 37 percent of the companies surveyed are affected by ransomware alone. While ransomware probably caused the most devastating damage within the last few years, it is far from the only type of malware that can lead to serious problems for companies. A well-prepared and thought-out incident response plan that all affected parties in the organization can implement immediately can significantly mitigate the consequences of a cyberattack. Accordingly, experts at Sophos Labs have drawn on their experience to develop the following 10-point plan for dealing with a cyber incident:

1. Determine all parties involved and affected
2. Identify critical resources
3. Practicing and acting out emergency scenarios
4. Deploy security tools
5. Ensure maximum transparency
6. Implement access control
7. Invest in analytics tools
8. Define response measures for the cyber emergency
9. Conduct awareness training
10. Take advantage of managed security services

>Source: www.sophos.com

Companies that have systematic occupational health management (OHM) have advantages when it comes to the health-promoting management of learners. This also applies to Hörmann Schweiz AG. Following the motto "A healthy company needs healthy employees", the company started to build up a systematic occupational health management system in 2013. Two years later, the company was certified with the "Friendly Work Space" label. After successful reassessments in 2018 and 2021, Hörmann Schweiz AG has now been the proud bearer of the "Friendly Work Space" label from Health Promotion Switzerland for almost 7 years.

Healthy employees and learners - a question of culture

Systematic occupational health management has long been firmly anchored in the culture of Europe's leading supplier of doors and gates. The 160 or so employees of Hörmann Schweiz AG, who include an average of around 10 apprentices in logistics and business administration each year, benefit from a wide range of occupational health management measures. These are aimed at promoting both physical and mental health. The spectrum ranges, for example, from monthly chair massages, a company relaxation room, brain food and bike-to-work campaigns, to a BGM mailbox that employees can use to contact the internal BGM group anonymously. In addition, Hörmann offers its employees the option of anonymously contacting an external cooperation partner for advice and support in the event of mental beresp. overload. To ensure that such cases remain the exception, the company informs and sensitizes its managers in regular training sessions on the early detection of increased mental stress among employees. Special attention is paid to apprentices. The level of psychological stress among them had already increased significantly before the pandemic.

Overcoming challenges together

Background: In the phase of growing up, young people per se go through intensive development steps in almost all areas of life. The start of a career means additional uncharted territory. Both of these factors combine to place increased stress on mental health in this age group. According to Health Promotion Switzerland's Job Stress Index 2020 (see chart), 42% of young workers between the ages of 16 and 24 have too few resources to meet the demands of the workplace, 30% are emotionally exhausted and their risk of occupational accidents is twice as high. The economic consequence is health-related productivity losses in this age group of a good 21% 1).

Nadine Zürcher, HR specialist and BGM and vocational training manager at Hörmann Schweiz AG, has also observed the effects of this development: "For some time now, we have repeatedly noticed significant mood swings, a sudden drop in motivation or performance, and increased absences among our apprentices. Although these are isolated cases, their number has increased overall. Our practical trainers are therefore very attentive in their dealings with learners and regularly conduct personal interviews to identify the first signs of increased psychological stress at an early stage. This is a demanding task, as addressing psychological issues requires a great deal of sensitivity. At the same time, dialogue is one of the most effective preventive measures."
This is also confirmed by Monika Monhart, head of vocational training at the Buechberg retirement center. There, too, great importance is attached to being in continuous contact with the young employees, for example, in order to deal with crises due to stress at an early stage.

Increasing need for support services

This insight into practice as well as the figures mentioned clearly point to the urgency of specifically promoting the mental health of learners. At the same time, this increases the demands on those responsible for vocational training. Targeted support offers for the health-promoting management of young employees are therefore welcome. A good contact point for this are, for example, industry associations, the Association of Vocational Trainers or the Apprentice" offer from Health Promotion Switzerland, which focuses on targeted mental health support for learners.

"Difficult situations with learners are often a challenge for us vocational training managers. Even with a lot of experience, the right solution is not always obvious. The 'Apprentice' service, with its comprehensive information material, high practical relevance through a wide range of good practice examples, and training courses, offers sound support and is actively used by us. It is also available quickly and at any time, not least thanks to the 'Experts App' for vocational educators," explains Nadine Zürcher.

And this is how health-promoting leadership of learners succeeds. Essentially, three dimensions are decisive here2):

1. Self-direction: The vocational trainers promote their own health. They are role models.
2. Contact with learners: Vocational trainers promote the health of learners through direct, communicative exchange (behavioral perspective).
3. Design of working conditions: VET instructors design the learners' tasks, their goals and their working environment in such a way that they have a health-promoting effect on the learners (condition-related or relationship-oriented perspective).

Working Paper 55 "Young workers - working conditions and health" by Health Promotion Switzerland presents, among other things, well-founded basic work as well as concrete cross-industry prevention offers (download with search term "Working Paper 55" at: https://gesundheitsfoerderung.ch/grundlagen/publikationen/alle-publikationen.html).

List of sources:

1) Source: Health Promotion Switzerland - Job Stress Index Monitoring 2018 according to Galliker et al. 2018b

2) Source: Franke, Vincent & Felfe, 2011

Good resolutions are usually forgotten as quickly as they are made. So here are some tips on how you can increase the likelihood of achieving them - for more fun in life.

1. Develop a vision of your future life that encompasses the four areas of life "work/profession", "family/contact", "body/health" and "meaning/culture".
2. Based on your vision of life and in relation to all areas of life, define what a fulfilled life means to you. (Is it that you live in a villa and have a Porsche or Tesla on your doorstep? Or in the fact that you have a lot of time for your hobbies? Or in the fact that your life partner goes through thick and thin with you?)
3. Then formulate goals for the four areas of your life that you would like to achieve. But be careful: This involves decisions. And everything has its price. When you say "yes" to a top career, there are also many "no's" associated with it.
4. Think about which people are important to you and give you emotional support.
5. Ask yourself which of your (life) goals conflict with the goals of the people you care about and what compromises you are willing to make to make the relationship mutually satisfying.
6. Analyze the roles you play in your life - for example, treasurer at the golf club, "soul comforter in times of need," encourager, and "gymnast. Consider which roles you would like to continue playing and which you would like to say goodbye to in order to create space for yourself.
7. Based on your life goals, define subgoals for the next five years/next year.
8. Derive an action plan for the coming months from the subgoals.
9. Implement this action plan using the classic methods of time and self-management. Among other things, analyze what are important and urgent tasks. But don't forget: what you consider important reflects your value system. Other things may be important to your partner.
10. Take time out regularly to check whether your vision of a fulfilled life has changed and to analyze whether there are signals that the balance in your life could be threatened in the future. These signals can be many and varied. For example: There is an increasing silence between you and your life partner. Important friends no longer contact you. At work, the top priority is "save money" because sales are falling. You feel a twinge in your heart from time to time. Your check should be correspondingly comprehensive.
11. If such signals appear, check whether your life plan is still suitable for achieving your professional and private life goals. Make course corrections if necessary.
12. Talk to your most important caregivers, about your (and their) life goals, because: As a "lonely heroe" you will - probably - never be happy.

Author:
Joachim Simon from Braunschweig is an executive trainer and coach as well as a speaker specializing in the topic of (self-)leadership (www.joachimsimon.info). He is the author of the book "Self-responsibility in the company" and co-founder of the (self-)leadership coaching app Mindshine (www.mindshine.app).