  Pricing insurance for risks associated with information technology systems
presents a complex modelling challenge, combining the disciplines of operations
management, security, and economics. This work proposes a socioeconomic
modelling framework for cyber-insurance decisions compromised of entity
relationship diagrams, security maturity models, and economic models,
addressing a long-standing research challenge of capturing organizational
structure in the design and pricing of cyber-insurance policies. Insurance
pricing is usually informed by the long experience insurance companies have of
the magnitude and frequency of losses that arise in organizations based on
their size, industry sector, and location. Consequently, their calculations of
premia will start from a baseline determined by these considerations. A unique
challenge of cyber-insurance is that data history is limited and not
necessarily informative of future loss risk meaning that established actuarial
methodology for other lines of insurance may not be the optimal pricing
strategy. The modelling framework proposed in this paper provides a vehicle for
agreement between practitioners in the cyber-insurance ecosystem on
cyber-security risks and allows for the users to choose their desired level of
abstraction in the description of a system.
