# Which Three ISO 27001:2022 Annex A Controls Every Cyber Underwriter Tests During Premium Calculation (and the Quantified-Loss Scenarios That Replace Generic Self-Assessments)
When a Saudi financial institution submits a cyber insurance application, the underwriter's first question is no longer "Do you have ISO 27001 certification?" It is "What would a ransomware attack cost your institution in the first 72 hours, and how much revenue would you lose in the following month?" The shift from compliance attestation to ISO 27001 cyber insurance premium calculation based on quantified scenarios reflects a fundamental change in how underwriters price risk. Generic self-assessments that confirm the existence of policies no longer differentiate applicants or justify favorable terms. Instead, underwriters verify three specific Annex A controls through scenario-based loss estimates that reveal whether your institution understands its actual exposure.
This article identifies the three ISO 27001:2022 Annex A controls that underwriters test most rigorously, explains why quantified loss scenarios have replaced policy checklists, and shows how CFOs, CISOs and risk managers at Saudi financial institutions can prepare impact ranges for ransomware, wire fraud and DDoS scenarios that reduce premiums and align coverage with genuine exposure.
Why Underwriters No Longer Accept Policy Documents as Evidence
Cyber insurance losses in the financial sector have taught underwriters that an institution can hold ISO 27001 certification yet still suffer catastrophic interruption because its incident response plan was never tested under realistic conditions, its monitoring tools generated alerts no one reviewed, or its threat intelligence arrived too late to prevent a known attack pattern. The gap between documented controls and operational resilience became visible in claims data, and underwriters responded by changing how they assess applicants.
Instead of asking whether a control exists, underwriters now ask what would happen if it failed. They want to see quantified impact ranges—revenue interruption, forensic cost, regulatory penalties, third-party liability—for the scenarios most likely to trigger a claim. Institutions that provide these estimates demonstrate a mature understanding of their risk profile and typically receive lower premiums, higher limits and fewer exclusions than those that submit only policy documents.
For Saudi institutions regulated by the Saudi Central Bank (SAMA), this shift aligns with the SAMA Cyber Security Framework's emphasis on scenario-based testing and resilience measurement. The framework requires institutions to assess the potential impact of cyber incidents on critical services, and underwriters now expect to see the same analysis in insurance applications.
The Three Annex A Controls Underwriters Verify Through Scenarios
Underwriters focus on three ISO 27001:2022 Annex A controls because they directly influence loss severity and the institution's ability to contain an incident before it becomes a claim.
A.5.24 Information Security Incident Management Planning and Preparation
This control requires the organization to plan and prepare for managing information security incidents. Underwriters test it by asking for quantified estimates of how long it would take to detect, contain and recover from a ransomware attack, and what each phase would cost.
A generic incident response plan that lists roles and escalation paths does not answer these questions. Underwriters want to see:
- Detection time: How many hours between initial compromise and confirmed detection, based on your monitoring coverage and alert-response process.
- Containment cost: Forensic fees, legal counsel, notification expenses and the cost of isolating affected systems.
- Recovery duration: How many days of revenue interruption, calculated from your recovery-time objectives for each critical service.
- Regulatory penalties: Potential fines from SAMA or the National Data Management Office if the incident involves a data breach or service disruption that exceeds regulatory thresholds.
Institutions that provide these estimates demonstrate that their incident planning rests on tested assumptions, not theoretical workflows. Underwriters reward this clarity with lower retentions and broader coverage for business interruption.
A.8.16 Monitoring Activities
This control addresses the need to monitor networks, systems and applications for anomalous behavior. Underwriters verify it by examining whether your monitoring tools would detect the precursors to wire fraud or account takeover before funds leave the institution.
A list of deployed security tools does not satisfy underwriters. They want to know:
- Coverage gaps: Which transaction types, user populations or network segments are not monitored in real time.
- Alert volume and triage: How many alerts your team reviews each day, and how long it takes to escalate a genuine threat.
- False-negative risk: What would happen if a known attack pattern—such as credential stuffing or business email compromise—bypassed your monitoring because it resembled legitimate activity.
Quantified scenarios for wire fraud should include the average transaction value at risk, the time window between fraudulent instruction and irreversible transfer, and the cost of recovery efforts if funds are lost. Institutions that can articulate these numbers show underwriters that their monitoring is calibrated to the threats they actually face, which reduces the likelihood of a large claim.
A.5.7 Threat Intelligence
This control requires the organization to collect and analyze information about threats. Underwriters test it by asking whether your institution would have advance warning of a distributed denial-of-service (DDoS) attack targeting Saudi financial services, and whether you could mitigate it before customers experienced service disruption.
Underwriters are not interested in the number of threat feeds you subscribe to. They want evidence that threat intelligence informs your defenses:
- Relevance: Do you receive alerts about attack campaigns targeting institutions in your sector and geography, or only global threat summaries?
- Timeliness: How quickly does intelligence reach the teams responsible for firewall rules, web-application firewalls and content-delivery networks?
- Action: Can you show an example of a mitigation you deployed in response to threat intelligence before an attack occurred?
A quantified DDoS scenario should estimate the revenue lost per hour of service unavailability, the cost of emergency mitigation (such as activating a cloud-based scrubbing service), and any contractual penalties for missed service-level agreements. Institutions that demonstrate proactive use of threat intelligence receive better terms because underwriters see lower loss severity.
How to Prepare Quantified Loss Scenarios for Each Control
Preparing scenario-based estimates requires collaboration between risk, finance, operations and technology teams. The goal is to produce impact ranges that reflect your institution's actual exposure, not industry averages or generic assumptions.
Step One: Select Scenarios That Matter to Your Business
Choose three scenarios that align with the controls underwriters test:
- Ransomware (tests A.5.24): Encryption of core banking systems or customer-facing platforms.
- Wire fraud (tests A.8.16): Fraudulent payment instruction that bypasses monitoring and approval controls.
- DDoS (tests A.5.7): Volumetric attack that renders online banking or payment channels unavailable.
Each scenario should be specific to your institution's architecture, customer base and regulatory obligations.
Step Two: Estimate Costs by Category
For each scenario, estimate the financial impact across four categories:
Incident response and forensics: Fees for external investigators, legal counsel, notification services and public-relations support. Base estimates on your panel-firm rate cards or recent incident costs.
Revenue interruption: Lost income during the period when affected services are unavailable. Calculate this from your average daily revenue for each critical service, multiplied by your recovery-time objective.
Regulatory penalties: Potential fines from SAMA for failure to meet incident-notification deadlines, service-availability requirements or data-protection obligations. Review the SAMA Cyber Security Framework and the Personal Data Protection Law for penalty ranges.
Third-party liability: Claims from customers, correspondents or service providers if the incident causes them direct loss. Estimate based on contractual indemnities and the value of funds or data at risk.
Step Three: Express Estimates as Ranges
Underwriters prefer ranges to point estimates because they show you have considered best-case and worst-case outcomes. For example:
- Ransomware detection time: 4 to 12 hours, depending on whether the attack occurs during business hours and whether your security operations center identifies the initial compromise before encryption begins.
- Wire-fraud loss: SAR 2 million to SAR 15 million, depending on the transaction limit of the compromised account and whether the fraud is detected before settlement.
- DDoS revenue interruption: SAR 500,000 to SAR 3 million, depending on attack duration and whether you can redirect traffic to backup channels.
Ranges demonstrate analytical rigor and help underwriters calibrate your premium to your actual exposure rather than a generic sector benchmark.
Step Four: Document Assumptions
For each estimate, record the assumptions that underpin it: recovery-time objectives, average transaction values, monitoring coverage, threat-intelligence sources and regulatory penalty frameworks. Underwriters will ask you to explain your numbers, and clear assumptions make your submission credible.
How Quantified Scenarios Reduce Premiums and Improve Terms
Institutions that submit quantified loss scenarios alongside their ISO 27001 certification achieve three outcomes that reduce total cost of risk:
Lower premiums: Underwriters price to your demonstrated exposure, not to the highest loss in your sector. If your ransomware scenario shows a maximum revenue interruption of SAR 5 million because your recovery-time objective is 24 hours, you will pay less than an institution with a 72-hour objective and a SAR 15 million exposure.
Aligned limits: Your coverage limit reflects the upper bound of your quantified scenarios, so you are neither underinsured nor paying for excess capacity you do not need.
Fewer exclusions: Underwriters are more willing to cover business interruption and dependent business interruption when they see that you have tested your recovery assumptions and can articulate the financial impact of downtime.
How the Firm Supports Cyber Risk Quantification for Insurance
We estimate the financial impact of your most likely and most severe cyber scenarios, so limits, retentions and budgets rest on numbers the board can trust.
The process involves four steps. First, we select scenarios that matter to your business. Second, we estimate costs, interruption, liability and penalties for each scenario. Third, we compare limit and retention options based on the quantified impact ranges. Fourth, we present a recommendation and board summary that explains the analysis and supports your insurance decision.
Deliverables include a scenario loss model, a limit and retention recommendation, and a board presentation. The engagement runs for four to six weeks and incorporates scenario selection with business owners, loss estimates by cost category, limit and retention options compared, and a board-ready summary. The approach aligns with the SAMA Cyber Security Framework and ISO 27001, and uses a scenario-based method adapted to the data you have. You do not need extensive historical data; we start with what you have and make the assumptions explicit.
Closing: From Policy Documents to Quantified Exposure
Cyber underwriters no longer accept ISO 27001 certification as sufficient evidence of insurability. They verify A.5.24, A.8.16 and A.5.7 through quantified loss scenarios that reveal whether your institution understands its actual exposure to ransomware, wire fraud and DDoS attacks. Preparing these scenarios requires collaboration across risk, finance and technology teams, but the result is a submission that stands out, a premium that reflects your genuine risk profile, and coverage limits that align with your board's risk appetite.
If your institution is preparing a cyber insurance renewal or first-time application and you want to replace generic self-assessments with quantified impact ranges, the Cyber Risk Quantification for Insurance service produces the scenario loss model, limit recommendation and board presentation that underwriters expect and your CFO can defend.
