News / 09-04-2019 / BaFin increases insurance supervisory requirements for Insurance Undertakings

A Critical Infrastructure nbspwithin the terms of the regulation is a facility or system which is of great importance to the functioning of general society and the economy The areas of energy, information technology, telecommunications, transportation and traffic, health, water supply, nutrition, finance and the insurance industry make up the key critical infrastructures A breakdown or impairment of any of these infrastructures could lead to significant supply shortages or threats to public safety The IT systems of these infrastructures require special security measures, as frequent attacks on corporate IT systems show that critical infrastructures are extremely vulnerableThe recent amendment specifically addresses those insurance companies which are considered to be part of the critical infrastructures These are insurance companies which see a total of 500,000 PC or life insurance claims per year, or a total of 2 million health insurance claims per year The amendment supplements the VAIT by nbsprequiring affected insurance companies to provide evidence of the effective implementation of special measures to protect their IT systemsComment These German supervisory requirements relate to the EU Directive on the Security of Network and Information Systems (Directive 20161148EC) This Directive required member states to develop their own strategy on the security of network and information systems and identify services which are essential for maintaining the state's critical social or economic activities and which depend on network and information systems (and an incident relating to those systems would have significant disruptive effects on that sector's activities) The Network and Information Systems Regulations 2018 came into force in the UK on 10 May 2018, however, the insurance sector was not designated as one of the relevant sectors caught by these Regulations In a Government's response to public consultation on the Regulations, it explained that while it took into account the requirements of the Directive, its priority was to maintain the Directive's scope in terms of sectors to which it relates, and not to gold-plate implementation by adding additional sectors A decision to extend the applicability of the Regulations to other sectors will be considered when a post-implementation review is conducted in 2021nbsp