Do cyber insurers require round-the-clock security monitoring?
Some ask about it and a few make it a condition, but many only ask whether monitoring exists and who responds. Read the exact question: “24/7 monitoring” in an insurer’s form usually means that alerts are reviewed by a person at any hour, often through a security operations centre (SOCSOC: security operations centre. A team, often working around the clock, whose job is to watch for and respond to attacks.) or a managed provider, not merely that software runs all the time. Attacks are often timed for nights, weekends and holidays, when nobody is looking, which is why insurers care. If you cannot staff every hour, say so honestly and describe what you do: alerts sent to a phone, a rota, an MSPMSP: managed service provider. A company that runs IT for other companies. contract or a response time you can actually meet. NetSenX analyses traffic continuously on the segments it watches and raises alerts at any hour, and from the Pro plan it can send them to Slack or a webhook. A person still has to read and act on them; NetSenX does not provide staffed monitoring.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- Does automated alerting count as 24/7 monitoring for an insurer?
- Can our managed service provider run NetSenX so we can answer yes on 24/7 monitoring?
- What should a monitoring contract say if our insurer asks about a SOC or response times?
- What does an insurer mean when it asks whether we monitor our network?
- What proof of network monitoring can we show an insurer?
Terms used here
- SOC (security operations centre)
- A team, often working around the clock, whose job is to watch for and respond to attacks.
- MSP (managed service provider)
- A company that runs IT for other companies.