IT service outage cost : case study and implications for cyber insurance

Abstract

Today, almost all enterprises are highly dependent on IT services. Thus, high availability IT services and the cost of downtime have received a lot of attention in recent years. One increasingly used tool for cyber risk management and transfer is cyber insurance, which typically offers some form of business interruption coverage. However, cost structures of IT service outages are still poorly understood, as costs are often just reported as lump sums. This article contributes a multiple case study of IT service outage cost in three sectors in Sweden: transport companies (N= 11), food companies (N= 9) and government agencies (N= 19). The contribution is three-fold: (i) the measurement instrument itself, (ii) the insights into different cost structures gained, and (iii) the implications of different cost structures on availability investment strategies. Whereas some enterprises incur only a fixed outage cost, some incur (almost) only lost productivity or almost only lost revenue. In the public sector, lost revenue is often negligible. The results are further contextualised by a discussion of cyber insurance implications. ; Funding details: Myndigheten för Samhällsskydd och Beredskap, MSB, 2015-6986; Funding details: Myndigheten för Samhällsskydd och Beredskap, MSB; Funding text 1: Acknowledgements This work was supported by the Swedish Civil Contingencies Agency, MSB, agreement no. 2015-6986. Not only did MSB function as the funding agency, it was also instrumental in securing access to the public-private fora where many respondents were recruited. The author is grateful for this, in particular to Johan Turell, who facilitated these contacts. Thanks are also due to Professor Shaun S. Wang of the Nanyang Technological University in Singapore for discussions about availability investment allocation problems.