A Foundation for Defense of Democracies report recommends that Congress use the upcoming reauthorization of the Terrorism Risk Insurance Act (TRIA) to establish a federal reinsurance program for systemic cyber incidents already covered by most cyber insurance policies. The proposed backstop would share losses above a threshold, cap the federal government’s total liability and recoup funds if it paid out. It is a recommendation—not an existing federal program.
What the report proposes
Nicholas Leiserson, the report’s author, argues for a federal cyber insurance reinsurance program aimed at systemic incidents that are already within the coverage of most cyber policies. In the report’s words, Congress should “design and authorize a reinsurance program designed to mitigate systemic risk associated with cyber incidents that are already covered by most cyber insurance policies.”
The proposed structure has three parts: private insurers would retain some losses, the federal government would provide coinsurance after a defined threshold, and the government’s total liability would be capped. If the backstop were used, the program would recoup funds afterward. CyberScoop’s June 2025 account describes this recoupment as a fee or tax paid over time by insurance companies.
The recommendation does not specify in the material summarized here the threshold, the size of the cap, or the precise method for calculating recoupment. Those would be design decisions for lawmakers, not settled features of a program already in operation.
#1 Best Overall
Why connect cyber reinsurance to TRIA?
TRIA created a federal loss-sharing role in terrorism insurance after insurers pulled back following the September 11 attacks. Leiserson proposes using the law’s scheduled reauthorization to consider a federal role in catastrophic cyber risk as part of a broader review of coverage for human-caused incidents.
The practical timing argument rests on how commercial insurance is commonly written: policies are often annual, so insurers make coverage decisions before a new policy period begins. The FDD report argues Congress should act by December 31, 2026, to reduce the chance of disruption as carriers decide how to handle terrorism coverage for later policy periods. That is the report’s proposed practical deadline, not TRIA’s statutory expiration date.
Rank #2
How the proposal differs from existing TRIP coverage
The Terrorism Risk Insurance Program (TRIP), established under TRIA, is not a general federal backstop for cyber losses. Cyber losses may qualify when they are tied to an act of terrorism and satisfy the program’s statutory requirements, including certification as terrorism. A catastrophic cyberattack does not automatically meet those criteria.
The FDD proposal is broader in a different way: it targets systemic cyber incidents already covered by most cyber policies, rather than only cyber losses that qualify as terrorism under TRIP. It would therefore require a separate program design; it is not simply a recommendation to treat every cyberattack as a covered act of terrorism.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteRank #3
- Vehicle Inspections Handbook provides step-by-step information CMV drivers need to conduct successful pre-trip, en-route, and post-trip inspections, so they can avoid breakdowns, citations, fines, repair bills, and crashes.
- Information is presented graphically within the vehicle safety handbook so that it's easy to find, with call-outs that address real-life situations drivers may experience during inspections.
- Vehicle inspection book features checklists that drivers can use to ensure successful vehicle inspections.
- Major topics covered include: The importance of vehicle inspections; Key regulations; Preparing for inspections; The inspection process; Vehicle inspection reports (DVIRs); Common inspection violations; and more!
- Softbound handbook measures 5.25" x 8.25", has 76 pages, and is written in English. Copyright 2020.
| Question | Existing TRIP under TRIA | FDD report’s proposed cyber backstop |
|---|---|---|
| Which events could qualify? | Cyber losses tied to an act of terrorism that meets statutory requirements, including certification as terrorism. | Systemic cyber incidents already covered by most cyber insurance policies. |
| What triggers federal participation? | Applicable TRIP requirements, including terrorism certification. | Coinsurance above a threshold; the threshold and other specific trigger criteria are not stated in the recommendation summarized by FDD. |
| How would losses be shared? | TRIP’s existing statutory framework. | Government coinsurance above the threshold, with an overall cap on federal liability. |
| How would federal payments be funded back? | Not stated in the cited GAO summary of TRIP’s cyber-coverage limits. | Recoupment if the backstop is triggered; the precise formula is not stated in the recommendation summarized by FDD. |
Why the existing market and federal framework may leave a gap
In its 2022 report, the U.S. Government Accountability Office (GAO) found that both private cyber insurance and TRIP were limited in their ability to cover potentially catastrophic losses from systemic cyberattacks. GAO reported that insurers had taken steps to limit exposure to systemic events, citing exclusions for cyber warfare and infrastructure outages as examples.
TRIP’s terrorism-certification rules create a distinct limitation: an incident can cause catastrophic cyber losses and still fail to qualify for the terrorism program. That matters because the FDD proposal is directed at systemic cyber incidents more broadly, including incidents that cyber policies already cover.
Rank #4
Leiserson’s case for a federal role is a policy argument about the scale and spread of systemic losses. He warns that, without a dedicated mechanism, government could still face pressure to support disaster recovery after a sufficiently catastrophic cyber event. That is the report author’s rationale, not an established forecast of a future taxpayer cost.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What GAO, CISA, FIO and Treasury have done
GAO’s assessment recommendation
GAO recommended that the Cybersecurity and Infrastructure Security Agency (CISA) and the Treasury Department’s Federal Insurance Office (FIO) jointly assess whether cyber risks to critical infrastructure and the resulting insurance exposures warrant a federal response, and inform Congress of their findings.
Best Value
Status reported in September 2025
In September 2025 testimony, GAO said those joint-assessment recommendations remained open. GAO also reported that, as of April 2025, Treasury had not provided a timeline for completing its overall assessment, while noting that Treasury had continued research and stakeholder engagement. This describes the agency status reported in that testimony; it does not establish whether further work occurred afterward.
Treasury’s March 2026 TRIP review
In March 2026, Treasury solicited public comments for its report on TRIP’s effectiveness. Among other questions, it asked about reauthorization beyond December 31, 2027; cyber-related terrorism exposures; insurance take-up; and possible changes to covered lines, the insurer deductible or the federal share.
That process concerns TRIP and cyber losses connected to terrorism. The comment request does not enact the FDD proposal for a wider federal reinsurance program for systemic cyber incidents.
What Congress would need to weigh
A federal backstop could change how insurers and policyholders prepare for extreme cyber losses. GAO identifies design considerations for federal assistance that include clear coverage criteria, cybersecurity requirements, dedicated funding, mitigation of moral hazard and protection of taxpayer interests.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Quick Recap
- Coverage and trigger: Congress would need to define what counts as a systemic incident, which losses qualify, and how a threshold would be measured. The proposal’s specific criteria are not stated in the report recommendation summarized here.
- Taxpayer exposure: A liability cap would limit the government’s stated maximum exposure, while recoupment would provide a mechanism to recover funds after a payout. Neither feature alone establishes how much a future program would cost or whether recoupment would fully offset payments.
- Security incentives: If insurers or policyholders expect federal support for extreme losses, that could weaken incentives to reduce risk unless program rules account for cybersecurity practices. This is a moral-hazard concern to address in design, not proof that the proposal would undermine security.
- Evidence for a federal response: Assessing systemic exposure requires an adequate picture of risks across critical infrastructure and insurance coverage. GAO’s call for a joint CISA–FIO assessment is relevant to that question, but it is separate from enactment of the proposed backstop.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
