Abstract: The management and prevention of information security risks have become the most concern for enterprises and government departments. The security investment and cyber insurance are the most efficient tools for firms to reduce the loss of information security risks, which caused by hacker attacks or improper security operations. With the promulgation of Cyberspace Security Law of China and the General Data Protection Regulations of the European Union and other mandatory rules and regulations, the firms' information security investment and security level will be affected by these mandatory constraints.
In this context, the optimal decision problem of information security investment and cyber insurance under mandatory constraints is studied in this paper. And the optimal security investment and cyber insurance premium determination based on bankruptcy probability constraint under observable enterprise loss and unobservable enterprise loss were compared. Research results show that:
(1) In the observed loss and fair premium cases, when to maximize the expected utility of individual enterprises, the optimal security investment was explored, and the optimal values could be improved by the government subsidies and mandatory constraint. But when all enterprises maximize utility, the firms' security investment and her total utility could be increased only by the mandatory constraint. What's more, the optimal security investment has nothing to do with the loss of the observable degree.
(2) In the case of unobservable loss, when the expected utility of a single firm is maximized, the security investment of the firm will be increased; while when the utility of all firms are maximized, any firm cannot easily reduce the security investment, even if other firms reduce the security investment.
(3) Under the constraint of ruin probability and actuarially fair policy, the amount of security investment of the firm would not be affected by the premium formulation. So the security investment, vulnerability level and expected utility of the firm remain unchanged. But as the premium increases, the amount of claims increases continuously. Under the constraint of ruin probability and the ratio of coverage policy, the firm's security investment is increased, but the firm's security investment and expected utility is decreased.
The policy implication of this paper could be applied by firms to control information security risks and guide the investment of information security and cyber insurance. However, the dynamic distribution of information security risk loss and the deductible of insurance are not considered in this research. In future work, the dynamic risk measurement method and CVaR method should be taken into consideration.

Key words: information security investment, cyber insurance, mandatory constraints, observable loss, unobservable loss