Cyber Insurance and OT Segmentation: What Canadian Insurers Now Expect
Cyber insurance in Canada has changed. A few years ago, an operator could obtain coverage with relatively light scrutiny of its actual security controls. That era is over. As claims from industrial and ransomware incidents have mounted, insurers have tightened what they require before they will write or renew a policy, and for organizations with connected operational technology, segmentation between IT and OT environments has become one of the controls underwriters ask about most directly.
This article explains why insurers now focus on OT segmentation, what they look for as evidence, and how operators can demonstrate the high-assurance isolation that satisfies the most demanding coverage requirements.
Why Insurers Care About OT Segmentation
Insurers price risk, and the risk of an OT-related cyber loss has proven to be severe. When an attack reaches operational technology, the consequences extend far beyond data loss to production downtime, equipment damage, environmental incidents, and in the worst cases physical harm. These are expensive claims, and several high-profile industrial ransomware events demonstrated that the path to OT frequently runs through an insufficiently segmented connection to IT.
From an underwriter's perspective, segmentation between IT and OT is one of the single most effective controls for limiting the scale of a loss. An attacker who compromises the corporate network but cannot reach operational systems causes a far smaller claim than one who crosses into production. That is why segmentation has moved from a technical detail to a coverage condition.
What Underwriters Look For
When assessing an operator with connected OT, insurers increasingly ask for evidence of specific controls rather than general assurances. Common areas of focus include:
- Documented segmentation. Clear evidence that IT and OT networks are separated, with defined boundaries rather than a flat, interconnected network.
- Control of the IT to OT path. How traffic between the two environments is controlled, and whether inbound access to OT is limited or eliminated.
- Remote access controls. How vendors and staff access OT remotely, and whether that access is monitored and multi-factor protected.
- Monitoring and incident response. Whether the operator can detect and respond to an incident affecting OT.
The operators who secure the best terms are those who can produce documented, verifiable evidence for each of these, not just describe their intentions.
|
Evidence beats assurance An underwriter treats a control you can document and prove very differently from one you simply assert. The strongest position is one where your segmentation can be evidenced by design, not just by policy. This is where the type of control you deploy makes a real difference to your coverage terms. |
The Segmentation Assurance Spectrum
Not all segmentation is equal in an underwriter's eyes. A firewall between IT and OT provides segmentation, but its effectiveness depends on rules that must be maintained and can be misconfigured, and the inbound path, while filtered, still exists. A data diode sits at the top of the assurance spectrum. It enforces one-way flow in hardware, so for the boundary it protects, the inbound path is not merely filtered but physically removed. Our comparison of data diodes and firewalls explains the difference in detail.
For an insurer, a data diode provides documented, certifiable proof of one-way isolation. Where a firewall rule set has to be explained and continually re-evidenced at each renewal, a diode demonstrates isolation by its physical construction. For operators seeking the highest assurance tier of coverage, or the best available terms, this distinction can matter.
How to Demonstrate Segmentation to an Insurer
Improving your position with an underwriter is a matter of building and documenting the right controls. Practical steps include:
- Map your actual IT and OT data flows so you know where the boundaries are and where they are missing
- Strengthen segmentation at the most critical boundaries first, prioritising by consequence
- Deploy high-assurance isolation, such as a data diode, where the data flow is genuinely one-way
- Document each control in a form you can present to an underwriter
- Ensure remote access to OT is controlled, monitored, and multi-factor protected
- Maintain the evidence so renewal is a matter of updating documentation, not rebuilding the case each year
The Regulatory Connection
Segmentation is not only an insurance question. The same controls that satisfy underwriters also support regulatory readiness. With Bill C-8 and the Critical Cyber Systems Protection Act now law in Canada, designated operators will need to demonstrate exactly the kind of documented OT protection that insurers already ask for. Building strong segmentation now serves both purposes at once, which improves the return on the investment.
Next Steps
If your insurer is asking harder questions about OT segmentation, or you want to improve your coverage terms, the answer is documented, high-assurance isolation. Arista Cyber helps Canadian operators design and deploy segmentation that satisfies underwriters and regulators alike. Explore our OWA data diode appliances and our OT cybersecurity services to learn more.
|
Facing tougher cyber insurance requirements? Talk to Arista Cyber about demonstrating high-assurance OT segmentation. |
Share via
