BaFin has identified a number of IT deficiencies, some of them serious, since the publication in summer 2018 of its VAIT, the Insurance Supervisory Requirements for IT (see info box). Since then, the supervisory authority has inspected 16 undertakings, including large and smaller primary insurers, pension funds and reinsurers. None of these undertakings fully complied with the VAIT at the time of the inspection. The good news is that the undertakings are using the IT inspections as an opportunity to further implement the VAIT.

BaFin identified severe findings regarding information risk management and information security management in most of the insurance undertakings inspected. The classification “serious” is the highest category in BaFin’s assessment scale, following “minor”, “moderate” and “substantial”. In some cases, BaFin did not find any internal processes within the undertakings that were sufficient to identify and assess information risks. Added to this, the undertakings often did not determine the level of protection required for the information. They were therefore limited in their ability to appropriately manage information risks.

Detecting IT security incidents more quickly

In information security management, there was often a lack of automated processes aimed at detecting IT security incidents quickly to allow countermeasures to be taken in a timely manner. For example, BaFin noted that although insurance undertakings automatically monitored operating systems and network activities, they often did not include other important software applications and hardware components. This resulted in a security risk for the undertakings’ entire IT systems.

In user access management, BaFin identified “substantial” findings in more than half of the undertakings inspected. In numerous cases, the undertakings had no requirements in place regarding the granting of access rights. In other cases, the undertakings did not regularly review the access rights that had already been granted. As a result, these undertakings were unable to adequately monitor and manage user and access rights for software applications, databases and network access. They therefore ran the risk of being unable to prevent, or at least subsequently detect, unauthorised access to confidential information.

Improving monitoring of external IT service providers

The inspections revealed deficiencies in many insurance undertakings with regard to their monitoring of external IT service providers. Since insurers often rely on external service providers to perform many different kinds of IT services, it is essential that they are aware of the risks involved. In particular, in the case of IT services not covered by the concept of outsourcing under supervisory law, such as the procurement of hardware and software, insurers often failed to conduct a prior risk analysis and therefore did not comply with their obligation to identify and manage risks.

BaFin’s inspections also showed that, up to now, a small number of insurance companies have transferred extensive portions of their business processes to cloud service providers. Nonetheless, the clear tendency towards outsourcing more data storage and processing power to cloud providers can also be seen in the insurance industry. BaFin will pay closer attention to this aspect in future inspections.

BaFin requested the undertakings to address the deficiencies and close IT security gaps. In addition, it expects all undertakings to seize the opportunity to further improve their IT security with the aid of the VAIT. A panel of experts set up by BaFin, consisting of supervisors alongside representatives of insurance undertakings and of their industry associations, provides a platform for close professional cooperation. The panel supports the industry in implementing the VAIT and addresses relevant issues in the field of IT and cyber security. BaFin plans to conduct the next round of inspections in 2021 and 2022.