Cyber risks have become one of the most significant business risks worldwide. At the same time, organizations are finding it increasingly difficult to determine how resilient they truly are in the face of complex digital supply chains, growing interdependencies, and a rapidly evolving threat landscape in Operational Technology (OT) and Information Technology (IT).

New regulatory requirements are adding further pressure on senior management to continuously strengthen cyber resilience by identifying, mitigating, and transferring cyber risks where appropriate. Against this backdrop, the ability to objectively assess an organization's cybersecurity posture is becoming increasingly important.

An opportunity to bring risk management and insurance closer together

Many companies already possess valuable information from established security programmes, regular audits, and extensive governance structures. At the same time, cyber insurers assess insured risks through structured underwriting processes, detailed risk dialogues, and data gathered from clients across a broad range of industries and geographies.

These assessments are informed not only by information provided by policyholders, but also by insurers' experience with cyber incidents and claims.

While the resulting insights play a key role in underwriting and pricing decisions, the recommendations derived from them are often only partially integrated into the policyholder's broader cyber risk management and resilience strategy.

Cyber resilience has become a board-level issue

For multinational organizations in particular, cyber resilience is no longer solely an IT or security matter. Risks must be managed consistently across business units, countries, technologies, and regulatory environments. Boards, supervisory bodies, and regulators increasingly expect organizations to demonstrate how resilient they are and where potential vulnerabilities remain.

As a result, organizations are looking for approaches that not only support compliance with cybersecurity regulations and standards but also provide transparency on the actual maturity and effectiveness of existing security measures.

The central question is no longer whether security controls are in place. Instead, organizations need to understand how effective those controls are, where residual risks remain, and which areas require further improvement.

From self-assessment to independent evidence

To address this challenge, Munich Re and TÜV SÜD have developed an approach that combines independent cyber assessments with cyber insurance underwriting.

As an independent party, TÜV SÜD conducts a structured inspection of an organization's cyber resilience capabilities. The findings provide a basis for targeted prevention and improvement measures while also contributing to a more informed cyber risk evaluation for insurance purposes.

The inspection aligns with recognized standards and frameworks for IT and OT, including NIS2, ISO 27001, the NIST Cybersecurity Framework  and relevant data protection requirements under the GDPR.

The objective is to establish an evidence-based view of an organization's current cybersecurity maturity, identify existing vulnerabilities, and highlight opportunities for improvement.

By complementing traditional underwriting approaches with an independent assessment, including an evaluation of supply chain and third-party risks, insurers gain a more comprehensive understanding of risk exposures. This can support the development of broader insurance solutions, including coverage concepts for contingent losses arising from third-party incidents.

A holistic view of cyber resilience

The inspection extends significantly beyond a traditional questionnaire-based review.

As part of a structured multi-stage process, TÜV SÜD evaluates a range of cybersecurity and resilience capabilities, including:

• Governance, policies, and accountability structures
• Cyber risk management and security organisation
• Asset management and visibility of critical systems
• Vulnerability and patch management
• Identity, access, and remote access controls
• Threat detection and incident response capabilities
• Crisis management and business continuity planning
• Supply chain and third-party risk management
• Data protection and regulatory compliance

In addition, the inspection examines the resilience of supply chains and evaluates the effectiveness of existing business continuity, recovery, and response plans.

The outcome is an evidence-based assessment of both cyber resilience and cybersecurity maturity, providing management with greater transparency over their risk landscape.

More than an additional service

The significance of this approach extends beyond the collaboration itself.

At its core, it creates a closer link between continuous improvement and risk transfer. Organizations receive an independent inspection of their cyber maturity together with actionable insights into areas where resilience can be strengthened. Insurers, in turn, benefit from a more robust understanding of cyber risk based on objective evidence rather than relying primarily on self-reported information.

This creates a shared basis for risk assessment that benefits both policyholders and insurers. Greater transparency can support more informed decision-making and encourage the continuous improvement of cyber resilience over time.

A potential next step in the evolution of cyber insurance

Over the past two decades, cyber insurance has evolved alongside the risks and exposures of an increasingly digital economy.

The next stage of development may see cyber risks assessed more systematically through independent evidence and measurable maturity indicators. Such an approach can help organizations better understand their risk profile, provide risk managers with an enhanced basis for investment and risk transfer decisions, and enable insurers to assess cyber risks with greater precision.

Ultimately, this can contribute to making cyber risks more manageable and, over the long term, more insurable.

The collaboration between Munich Re and TÜV SÜD therefore offers organizations an additional option to strengthen the connection between continuous cyber resilience improvement and cyber insurance. It complements established market practices such as questionnaires and underwriting dialogues by incorporating independent, evidence-based inspection into the risk evaluation process.