Seeing where cyber risk sits across a membership is hard. Deciding what to do about it may be harder: how far to go in helping members act, what to expect in return, and how to tell whether any of it is improving resilience.
KYND’s new white paper, Defining the Pool’s Role in Member Cyber Resilience, brings together perspectives from six public entity pools navigating those decisions.
Four questions shaping the pool’s role
Members bring different resources, technical capabilities and competing priorities to cyber. Pools must consider those differences alongside their own capacity and the shared interests of the membership.
The paper examines four questions at the heart of that balancing act:
- How much does the pool need to know about their members’ cyber posture?
- What happens after the pool finds something?
- What should the pool provide, and what should it expect in return?
- How does the pool know whether its approach is working?
Six perspectives across the member journey
Across the conversations, pools kept returning to the same starting point:
members vary widely in staffing, resources and technical maturity, and that makes a clear view of cyber risk harder to build.
With more than 600 members, the Special District Risk Management Authority points to the growing importance of understanding systemic cyber risk across the pool. At the Alaska Public Risk Alliance, many members have limited staff, and cyber competes for time and budget with water, roads and fuel. For both, better visibility has to come without adding to the burden on members.
Visibility is only useful if it leads somewhere. At the South Carolina School Boards Insurance Trust (SCSBIT), a high-risk, zero-day vulnerability was traced to a specific district, and the pool reached that district’s IT director directly. The fix was made during a scheduled weekend window, and SCSBIT estimates it avoided a cyber event that could have cost more than $300,000. Enduris sees this handoff as central to the pool’s role:
connecting members with the right help and staying engaged as they act.
Pools are also thinking about what they expect in return. Schools Insurance Group gave cyber its own credit program, designed to help districts focus their effort and move at a pace that fits their reality.
And they want to know whether it’s working. At the Washington Schools Risk Management Pool, the share of members reporting continuity and recovery planning rose from 8% to 69% over three years.
Defining an approach for your membership
These six perspectives don’t point to a single model. They show how pools are making choices about support, member expectations and evidence of improvement based on their membership, resources and program maturity.
For leadership, risk management and member services teams, they offer a basis for discussing those choices deliberately, before a member incident forces the question.
Explore the full paper: Defining the Pool’s Role in Member Cyber Resilience.
Questions for what this could look like for your pool? Contact Ben Duffy at bduffy@kynd.io.
