Skip to content

FRM Exam Part II · Digital Resilience and Financial Stability: The Quest for Policy Tools in the Financial Sector

Information Sharing, Crisis Coordination and Cyber Insurance

Updated 11 October 2026 · Fact-checked

Information sharing, crisis coordination and insurance are three policy tools for digital resilience. Sharing spreads early threat data across firms. Simulation exercises and cross-border coordination prepare authorities for a systemic cyber event. Cyber insurance transfers some loss, but correlated losses, silent cover and capacity limits mean it cannot remove systemic risk.

Understand Information Sharing, Crisis Coordination and Insurance

Cyber risk differs from most risks because one event can hit many firms at once. Firms share the same cloud providers, software and payment networks. A failure in one place spreads fast and across borders. So policy tools must work beyond a single firm.

Information sharing means firms and authorities exchange data on threats, such as attack indicators, methods and vulnerabilities. The gain is speed: one firm's detection becomes another's warning. The barriers are real. Firms fear legal liability, reputational damage and leaking confidential client data. Trust, clear legal safe harbours, anonymisation and agreed formats help. Sharing is stronger when it includes both private firms and public authorities.

Crisis coordination covers how authorities and firms act together in a major incident. Cross-border coordination matters because financial groups and infrastructures operate in many jurisdictions, while regulators have national mandates. Gaps in contacts, communication channels and decision rights slow the response. Crisis simulation exercises test these arrangements before a real event. They expose unclear roles, weak communication and dependence on a few providers. Their value lies in the lessons fixed afterwards, not in passing the exercise.

Cyber insurance is risk transfer: the insurer pays defined losses, such as response costs, business interruption and liability, for a premium. It can encourage better controls, since insurers may ask for minimum standards. But it has limits. Losses are correlated, so many policyholders claim together, which strains insurers. Cyber loss data are short and change fast, so pricing is uncertain. Policies carry exclusions (for example war or state-backed attacks), sub-limits and caps. Unclear wording can leave silent cyber exposure in policies not designed for it. Insurance moves cost from a firm to an insurer; it does not stop the attack or the wider disruption. Systemic damage to payments and confidence is not insured away.

Key formulas to remember

Net retained loss after insurance
Retained loss = Gross loss − Insurance recovery, where Recovery = min(max(Gross loss − Deductible, 0), Policy limit)
Check sub-limits and exclusions first. Apply deductible, then cap at the limit. The firm bears the deductible plus any excess over the limit.
Insurability test (rule of thumb)
Risk is more insurable when losses are measurable, accidental and not highly correlated across policyholders
Cyber scores poorly on correlation and measurability. This is a guide, not a strict law.
Aggregate exposure check
Insurer aggregate exposure = Σ policy limits for policyholders exposed to the same event
Used to see whether one common event, such as a cloud outage, could exceed insurer capital.

How to solve Information Sharing, Crisis Coordination and Insurance questions

Use the same sequence for any question on sharing, coordination or insurance. It keeps you from picking an answer that sounds good but ignores the systemic angle.

  1. 1Identify the tool in the question: information sharing, crisis simulation, cross-border coordination or insurance.
  2. 2Identify the problem it addresses: speed of detection, unclear roles, cross-border gaps or loss transfer.
  3. 3Ask whether the risk is firm-level or systemic. Insurance helps firm-level loss; it does not fix systemic spread.
  4. 4Look for the key limitation: correlation, exclusions, caps, silent cyber, legal or trust barriers to sharing.
  5. 5If numbers appear, apply deductible, then limit, then exclusions. Compute the retained loss.
  6. 6Match the answer to the policy goal: resilience and recovery, not only loss payment.
  7. 7Eliminate options that overstate: words like 'eliminates', 'fully covers' or 'always' are usually wrong.

Quickest way: Tool, limit, systemic test

When to use it: Use when you have about a minute for a conceptual multiple-choice question.

  1. Name the tool in the stem.
  2. Recall its one main strength and one main limit.
  3. Pick the option that states both fairly, and reject absolute wording.
  4. For insurance maths: subtract deductible, cap at limit, then add back the excess.

Common mistakes in Information Sharing, Crisis Coordination and Insurance

  • Saying cyber insurance removes systemic cyber risk.

    Students treat risk transfer as risk removal.

    Fix: Remember insurance shifts financial loss only. Correlated claims and disruption to critical services remain.

  • Ignoring exclusions and sub-limits in loss calculations.

    Students apply only the headline policy limit.

    Fix: Read for excluded events and sub-limits first, then deductible, then the overall limit.

  • Treating information sharing as purely a technology problem.

    Threat feeds sound technical.

    Fix: Include legal, confidentiality and trust barriers. Safe harbours and anonymisation are part of the answer.

  • Viewing simulation exercises as a pass/fail compliance test.

    Students confuse them with audits.

    Fix: Their purpose is to reveal gaps in roles, communication and dependencies so they can be corrected.

  • Assuming national regulators can manage a global incident alone.

    Mandates are national, so students overlook spillovers.

    Fix: Stress cross-border contact points, shared communication channels and agreed decision rights.

  • Confusing silent cyber with excluded cyber.

    Both sound like gaps in cover.

    Fix: Silent cyber is unintended coverage in policies that neither include nor exclude cyber explicitly. Exclusions are explicit.

Worked examples

Example 1

A bank has a cyber policy with a deductible of USD 2 million and a policy limit of USD 20 million. An attack causes a gross loss of USD 26 million, all covered. What loss does the bank retain?

Show the solution
  1. Subtract the deductible from the gross loss: 26 − 2 = 24 million.
  2. Cap at the policy limit: min(24, 20) = 20 million recovery.
  3. Retained loss = 26 − 20 = 6 million.
  4. Check: deductible 2 million plus excess over limit (24 − 20 = 4 million) = 6 million.

Answer: The bank retains USD 6 million.

Example 2

A regulator notes that most insured banks use the same cloud provider. Why does this limit cyber insurance as a tool for financial stability, and what complementary tool helps?

Show the solution
  1. Identify the issue: a single provider outage can cause claims from many policyholders at once.
  2. This is correlation. The insurer's aggregate exposure is the sum of limits tied to that provider, which may exceed its capacity.
  3. Insurers may respond with exclusions, sub-limits or higher premiums, so cover shrinks when it is most needed.
  4. Insurance also does not restore payments or services, only pays money.
  5. A complementary tool is a crisis simulation exercise and cross-border coordination, which test the response to provider failure and fix gaps in roles and communication.

Answer: Concentration on one provider creates correlated losses that insurers cannot easily absorb and that insurance cannot prevent. Simulation exercises and coordination between authorities improve resilience and recovery.

Exam tips

  • Expect stems that ask for the main limit of cyber insurance. Correlation and aggregation are usually the best answers.
  • Reject options with absolute words such as 'eliminates' or 'guarantees'.
  • In numeric questions, apply deductible, then limit, and check exclusions before calculating.
  • For information sharing, look for the barrier: legal liability, confidentiality or trust.
  • Link simulations to learning and fixing gaps, not to compliance scoring.

Practice questions from Digital Resilience and Financial Stability: The Quest for Policy Tools in the Financial Sector

Information Sharing, Crisis Coordination and Insurance: frequently asked questions

Why can't cyber insurance remove systemic risk?

Cyber losses are correlated, so many insureds can claim after one event. Insurers face aggregation, uncertain pricing and exclusions. Insurance pays money but does not stop disruption to critical services.

Why do firms hesitate to share cyber threat information?

They worry about legal liability, reputational damage and exposing client data. Safe harbours, anonymisation and trusted forums reduce these barriers.

What is the purpose of a cyber crisis simulation exercise?

It tests how firms and authorities communicate and decide during a major incident. It exposes gaps in roles, contacts and dependencies so they can be fixed before a real crisis.

What is silent cyber?

It is cyber loss that falls under a policy not designed for it, because the wording neither covers nor excludes cyber clearly. It creates uncertain exposure for insurers.