Polk County rejects cyber insurance following review

Polk County won't be adopting a special cyber insurance plan out of concern that doing so could increase risks of being hacked, county administrator John Norris told supervisors in a memo this month.

Why it matters: The decision underscores a growing debate about whether cyber insurance can cause more harm than good, Doug Jacobson, a professor in Iowa State University's cyber security engineering program, told Axios.

• It also comes in the wake of several ransomware attacks against metro-area schools or businesses in the last five years, which have cost tens of thousands of dollars and forced some to close for days.

Catch up fast: Norris asked the county's risk management team to review the government's cyber insurance needs after officials raised questions about it during a bond rating review last month.

• County officials concluded that existing umbrella coverage is best because of the increased risks a cyber-specific plan can bring, according to Norris' memo.

Yes, but: James Remington, Des Moines' deputy finance director, told Axios this week that rejecting coverage to avoid being a target can be an easily misguided decision.

• Des Moines conducts an annual value analysis and continues to have a cyber policy, Remington said.

The other side: Cybersecurity insurance costs are soaring and some plans no longer carry the level of protection offered a few years ago, Jacobson said.

• Spending money to improve safeguards against hacks is increasingly being viewed as a better option, he said.

Of note: Des Moines anticipates its annual cyber insurance costs to increase as much as 40% in the fiscal year that begins in July, up to around $100,000, according to Remington.

The bottom line: Cyber insurance shouldn't be viewed as a bailout.

• The best approach is to reduce cybersecurity risks, which can help to shrink premiums, according to an article published this week by State Tech Magazine.