Cybersecurity Policy Report, Cyber Insurance Views Sought by Treasury for Report to Congress, (Mar 24, 2026)
Organizations Mentioned:Federal Insurance Office
The Treasury Department wants to know whether changes to its terrorism insurance program might spark demand for stand-alone cybersecurity insurance policies.
In a Federal Registernotice scheduled for publication tomorrow, Treasury’s Federal Insurance Office seeks input on “potential changes” to the federal Terrorism Risk Insurance Program (TRIP) “that would encourage the take up of insurance for cyber-related losses arising from acts of terrorism.”
Treasury is seeking input on TRIP for a mandatory biennial report to Congress on the effectiveness of the program. TRIP was authorized by the Terrorism Risk Insurance Act (TRIA) enacted after the Sept. 11, 2001, terrorist attacks on the U.S. TRIP, among other things, reimburses insurers that might face an extraordinary number of claims following a terrorist attack.
Treasury decided in 2021 that TRIP should cover losses from terrorism-related cyber attacks, but it also has been exploring ways to bolster the cybersecurity insurance market outside of TRIP (CPR, Sept. 28, 2022).
At a 2024 hearing, the House Homeland Security Committee’s cybersecurity and infrastructure protection subcommittee was told that a catastrophic cyber attack could cost between $15.6 billion and $33.4 billion, more than the existing cyber insurance market could absorb. TRIP or a similar cyber-specific program could provide a federal “backstop” to support cyber insurers, witnesses told the subcommittee (CPR, June 27, 2024).
Treasury’s report to Congress on TRIP’s effectiveness is due June 30 and will be the last such report before Congress considers TRIA’s reauthorization prior to its sunset on Dec. 31, 2027.
Treasury’s request for comment asks about “issues presented by cyber-related losses, and the impact of TRIP in connection with such exposures, including your views on cyber-related terrorism losses that are included within TRIP and those losses outside of TRIP.”
It also seeks views about “the potential modification of the lines of insurance covered by TRIP and revisions to any of the current sharing mechanisms for cyber-related losses, such as, for example, the individual insurer deductible or the federal share percentage.”
Responses to the request for comment are due May 8 and should be captioned “2026 TRIP Effectiveness Report” for filing in regulations.gov.
News: FederalLegislation DataSecurity