Cyber Risks

Analyzing Cyber Risk Coverage

Unlike other types of insurance, there is no standard form on which the insurance industry as a whole underwrites cyber coverage.
By: | March 13, 2015 • 10 min read
cyber insurance article

Many companies are now taking a close look at the protections provided by cyber risk insurance policies — some for the first time — as data breach incidents and related cyber risks continue to increase and gain publicity, and as government agencies become more actively involved in policing the corporate response.

Advertisement




Although cyber coverage is a relatively new product in the insurance marketplace, there are now roughly 50 insurance carriers that offer it (although the amounts of coverage available often are limited).

These policies are sold under a number of different names, including “cyber risk,” “information security,” “privacy,” and “media liability” coverage.  Unlike other types of insurance, there is no standard form on which the insurance industry as a whole underwrites cyber coverage.

These policies are sold under a number of different names, including “cyber risk,” “information security,” “privacy,” and “media liability” coverage.

While this provides some challenges to buying coverage, especially for the uninitiated, it often provides more room for negotiation of the terms of cyber policies than many other types of coverage.

Most cyber policies currently in the marketplace offer some combination of traditional liability coverage protecting against claims by third parties, and first-party coverage protecting against losses suffered by the insured.

There also are important terms and conditions of cyber policies that can have a significant impact on available coverage.  While no company can reasonably expect to secure every available component of coverage, awareness of differences among the policies being offered is critical to maximizing premium dollars spent.

While not exhaustive, some of the important features to be mindful of when shopping for cyber coverage include:

Third-Party (Liability) Coverages

Privacy liability coverage. This includes liability to the insured’s customers, clients and employees for breaches of their private information which can be a major component of liability in the case of a data breach.

Seeking trigger language that focuses on the insured’s failure to protect confidential information, regardless of the cause (e.g., “any failure to protect”), rather than language requiring an intentional breach, is advisable.

Also, some (but not all) cyber policies also provide coverage for the insured’s failure to disclose a breach in accordance with privacy laws.

Policies that include defense from the earliest stages of an investigation, typically including a civil investigative demand or similar request for information, are preferable.

Regulatory actions. There is substantial variance among cyber policies regarding whether and to what extent they provide coverage for regulatory and other governmental actions. Even where covered, some policies require that the action be initiated by a formal “suit” in order to trigger the defense obligation.

This limitation typically would preclude defense of the investigative stage of government actions — which often is the most expensive stage for the entity being investigated.

Policies that include defense from the earliest stages of an investigation, typically including a civil investigative demand or similar request for information, are preferable.

It also bears noting that civil fines and penalties are covered under many cyber policies, and companies should be mindful of this if an insurer seeks to exclude such coverage.

Notification costs. This coverage includes the costs of notifying third parties potentially affected by a data breach. There is an ever-increasing and constantly evolving landscape of breach notification laws on a state-by-state basis.

This coverage is included in most cyber policies.  However, many policies, often by endorsement, limit the number of individuals that must be notified and the method(s) of notification.  Some policies also may vest some control over the notification process (which is often sensitive to the insured) with the insurer.

These limitations could leave a company absorbing at least some of the notification costs if a breach occurs, and may require it to relinquish some control over the notification process.

Advertisement




Crisis management. This coverage includes the costs of managing the public relations outfall from most data breach scenarios. Most, but not all, cyber policies contain some form of this coverage.

The insured sometimes is required to choose from a pre-determined list of vendors.  In most cases, if the insured chooses another vendor, the insurer is not required to pay for the services.  However, this restriction may be negotiable.

Call centers. This coverage may be included within the notification and crisis management coverages, may be a stand-alone coverage, or may not be provided at all.

Because this tends to be one of the higher costs associated with data breaches, it is important to identify whether this coverage is expressly provided and any applicable limitations (including the number of affected persons who are eligible to receive call center services, the hours and locations of the call center, and the specific services the call center staff will provide).

Credit/identity monitoring. This coverage is included in most cyber policies, but again, may be limited for the number of affected individuals that can receive the services and the prescribed vendors that are available.

Transmission of viruses/malicious code. As its name suggests, this coverage protects against liability claims alleging damages from transmission of viruses and other malicious code or data. Not all cyber policies have this coverage.

However, before making it a priority, a company should consider the extent to which its operating systems realistically have the potential to be a source of this type of liability.

First-Party Coverages

Theft and fraud coverage. Covers certain of the costs of theft or destruction of the insured’s data and theft of the insured’s funds.

Forensic investigation. Covers the costs of determining the cause of a loss of data.

Network/business interruption. Covers the costs of business lost and additional expense due to an interruption of the insured’s computer systems. Some cyber policies require that the interruption be caused by an intentional cyber attack and some do not.

There typically are limitations to this coverage, including a requirement that the interruption last a minimal length of time before coverage incepts, and the total length of an interruption that will be covered.  This coverage may also include contingent business expenses.

Extortion. Covers the costs of “ransom” if a third party demands payment to refrain from publicly disclosing or causing damage to the insured’s confidential electronic data.

Data loss and restoration. This component — included in some but not all cyber policies — covers the costs of restoring data if it is lost, and in some cases, diagnosing and repairing the cause of the loss. It typically is subject to a substantial retention, and may be limited in terms of the cause of the data loss at issue.

The claims-made type polices typically are more restrictive in terms of the events that can trigger coverage, and the timing of resulting claims in relation to the loss may limit or preclude available coverage.

Other Key Provisions

Trigger — loss or claim. Cyber policies typically are triggered either by an event that results in the loss of data, or a “claim” arising from the event that is made against the insured (or made against the insured and reported to the insurer) during the policy period.

The claims-made type polices typically are more restrictive in terms of the events that can trigger coverage, and the timing of resulting claims in relation to the loss may limit or preclude available coverage.  Thus, the loss type policy is preferable, even though this coverage may be more expensive.

Trigger — defense. In some cyber policies, the defense obligation is triggered by a “suit,” which requires a lawsuit or written demand against the insured. This definition may preclude defense of a claim that has yet to ripen into a lawsuit or written demand (where much of the defense costs on a particular matter may be spent).

Advertisement




If available, less restrictive defense language is preferable.  As noted above, in some cyber policies, the “suit” limitation does not apply to governmental actions (such as investigations), which make this language somewhat more acceptable to some companies.

Defense — choice of counsel. In some cyber policies, defense costs are covered only to the extent that the insured chooses from the insurer’s (sometimes short) list of “panel” law firms. If the insured chooses a different firm, its defense costs probably will not be covered.

Given the substantial costs likely to be associated with a significant data breach (which could exceed the limits of the policy), the insured ideally will have substantive input in the choice of counsel.

Accordingly, policies with more balanced choice of counsel language (e.g., the insured and the insurer shall mutually agree on defense counsel and if they cannot agree, the insured shall choose counsel for which the insurer shall pay up to a set hourly rate) are preferable.

Retroactive coverage. Cyber policies often contain a “retroactive date.” Losses arising from events prior to the retroactive date will not be covered.  Insurers often fix the retroactive date at the initial date of coverage by the insurer, although the insured may be able to negotiate a retroactive date further back in time.

Acts and omissions of third parties. Acts or omissions of third parties may not be covered expressly, or even may be excluded, under some cyber policies.

By way of example, if a company uses the services of a third-party vendor to maintain its confidential customer or employee information in the “cloud” and the vendor experiences a data breach, the company could be sued by its customers or employees, and may not have any coverage.

Some cyber policies provide coverage for breaches of data maintained by third parties as long as there is a written agreement between the insured and the vendor to provide such services.  If a company relies on any third parties to maintain any of its confidential information, it should consider seeking a policy that expressly covers breaches of data maintained by third parties.

Moreover, any self-insured retention language applicable to this coverage should be clear that any payments made by the third party indemnifying the company for loss sustained by the breach count toward satisfaction of the retention.

Coverage for unencrypted devices. Many cyber policies exclude coverage for data lost from unencrypted devices. Cyber coverage without this limitation is preferable.

Coverage for corporations and other entities. Many cyber policies define covered persons, for liability purposes, to include only natural persons. However, entities affected by data breaches may include corporations and other business entities.

Companies should consider seeking coverage that appropriately defines the scope of entities potentially affected by a data breach.

Policy territory – occurrences outside the United States. Even if a purchaser does not operate outside the Unites States, its employees may lose their laptops, PDAs and other electronic devices containing confidential information (or have them stolen) while traveling abroad.

Many cyber policies restrict the applicable coverage territory to the United States and its territories.  Companies should ensure that its cyber policy provides coverage even if the loss or theft of confidential information at issue occurs outside the United States.

Breaches not related to electronic records. Some cyber liability policies restrict coverage to loss or theft of electronic data. However, many breaches occur as a result of loss or theft of paper (or other non-electronic) records.  Cyber policies covering both are preferable.

Location of security failure. Coverage under some cyber policies is limited to physical theft of data from company premises. This could be problematic in a number of situations, including theft of a laptop, PDA or external drive from an airport or an employee’s home.

Other policies limit coverage for data breaches resulting from password theft to situations where the theft occurs by non-electronic means.  Companies purchasing cyber policies should be wary of these types of limitations, which may not seem particularly pernicious on initial review but could be extremely costly.

Exclusions for generalized acts or omissions. Some cyber policies exclude coverage for losses arising from: (i) shortcomings in security of which the insured was aware prior to the inception of coverage; (ii) the insured’s failure to take reasonable steps to design, maintain and upgrade its security; and (iii) certain failures of security software.

Because this type of exclusionary language at least arguably is overly broad, lacking in adequate definition, and potentially subjective in application, it should be limited appropriately by negotiation or avoided altogether.

Advertisement




Exclusions for acts of terrorism or war. This is a common type of exclusion in cyber policies. It is unclear to what extent insurers will rely on these exclusions when data breach result from an organized attack by a foreign nation or hostile organization.

Again, the scope of these exclusions should be negotiated appropriately or, if that is not feasible, the company should consider purchasing alternative coverage.

Steve Raptis is a partner in the Washington, D.C. office of Manatt, Phelps & Phillips LLP. He counsels corporate policyholders nationwide on a broad range of insurance-related issues and represents them in complex insurance disputes. He can be reached at sraptis@manatt.com or 202.585.6550.
Share this article:

Cyber Risks

Risk Managers Struggle With Data Security

Many companies were ill-prepared to protect data or to respond should a breach occur.
By: | March 6, 2015 • 4 min read
data security

The much ballyhooed Sony Corp. hack, allegedly at the hands of North Korea, is hardly an isolated event, as two recent reports demonstrate.

Advertisement




While Sony’s recent experience garnered the most recent headlines, data breaches targeting JPMorgan Chase, Target (the retailer just revealed that its 2014 data breach cost the company $162 million) and others have resulted in expensive investigations, litigation and settlements, the costs of which are borne by customers,  the businesses and insurers.

Cyber attacks have become an almost daily event affecting all sizes and types of businesses.

Two surveys, from Trustwave and A.M. Best, bring home the reality that many businesses are still struggling with information security deficiencies and common security weaknesses that can elevate their risk of data breaches.

“Data tends to migrate to unexpected areas. You need to take inventory, identify, track and monitor that data, but many companies don’t have a process at all.” — Greg Rosenberg, security engineer, Trustwave

In its “2014 State of Risk Report,” (PDF) which surveyed 476 information technology and security professionals located in more than 50 countries, Trustwave found that many companies remain ill-prepared when it comes to cyber risk.

“Businesses must look at security as an imperative,” said Michael Aminzade, vice president of global compliance and risk services at Trustwave, in Reston, Va. “Understanding their risk level is the first step. By identifying their largest security shortfalls and rectifying them, businesses can stay ahead of the criminals and decrease their risk of getting breached.”

Trustwave found that one of five (21 percent) businesses do not have data breach incident-response procedures in place and about the same amount (20 percent) do not have a process that enables reporting of security incidents.

It also found that more than six in 10 (63 percent) businesses do not have sophisticated methods to control and track sensitive data and that less than half (49 percent) fully encrypt stored sensitive data.

Advertisement




As for the insurance industry, A.M. Best identified cyber security as one of the most serious emerging risks facing insurers, in its report, titled “Cyber Security Presents Challenging Landscape for Insurers and Insureds.”

Fred Eslami, a senior financial analyst at A.M. Best in Washington, D.C., said security issues will only grow more intense this year and beyond.

“These discussions will get increasingly more robust in 2015 as the insurance industry continues to ‘peel the onion’ on this evolving issue,” Eslami said, adding that it involves not only identifying general underwriting processes, the number of policies, types of coverage, policy forms, and limits and exclusions, but also how insurers manage and mitigate the many cyber risks and the ever-increasing threats of cyber-attacks on their own companies.

Nearly three in 20 (13 percent) respondents admitted that their companies had been targets of data breaches or cyber attacks.

A.M. Best found that just 10 percent of respondents said they had a dedicated cyber security policy, while another 10 percent said they bundled such coverage with errors and omissions, property/business interruption and general liability policies.

Nearly three in 20 (13 percent) respondents admitted that their companies had been targets of data breaches or cyber attacks.

Trustwave security engineer Greg Rosenberg said many businesses and risk managers hold a gross misconception that data security is purely a technical problem, a so-called “gearhead” conversation.

“Nothing could be farther from the truth,” he said. “Data security is about people, process and technology.”

Rosenberg said the notion of how to track truly sensitive data can be completely off the radar in some companies, adding that to understand cyber risk requires an effective risk assessment, including data discovery.

Many times, he said, risk managers don’t know all the types of data they have or all the systems that can result in data leaks.

“Data tends to migrate to unexpected areas,” he said. “You need to take inventory, identify, track and monitor that data, but many companies don’t have a process at all.”

Kevin Kalinich, cyber risk global practice leader for Aon Risk Solutions, said that while it’s certainly important to utilize surveys such as these and others when considering cyber exposure strategies, risk managers need to consider all the factors, including separating “critical” data from data with little value in terms of losses.

“The value of the data — how much damage would occur if it is stolen or exposed — and the amount of insurance protection purchased are critical factors in creating an effective risk management plan,” he said. “Even in some of the biggest cases media-wise, for the most part consumers have not been successful in proving damage.”

Advertisement




He added that despite some recent survey findings and data breach cases, research from Aon shows the percentage of companies actively focusing risk management on data security is much greater than even two years ago.

“Overall, awareness has been heightened and companies are reacting and responding,” he said.

“Of course, every organization should have an IT security strategy that uses reports like these to build best practices in protecting data assets, but it all needs to be in context,” he cautioned. “The surveys and reports are but one part of the process.”

Tom Starner is a freelance business writer and editor. He can be reached at riskletters@lrp.com.
Share this article:

Sponsored: Liberty Mutual Insurance

2015 General Liability Renewal Outlook

As the GL insurance cycle flattens, risk managers, brokers and insurers dig deeper to manage program costs.
By: | March 2, 2015 • 5 min read
SponsoredContent_LM

There was a time, not too long ago, when prices for general liability (GL) insurance would fluctuate significantly.

Prices would decrease as new markets offered additional capacity and wanted to gain a foothold by winning business with attractive rates. Conversely, prices could be driven higher by decreases in capacity — caused by either significant losses or departing markets.

This “insurance cycle” was driven mostly by market forces of supply and demand instead of the underlying cost of the risk. The result was unstable markets — challenging buyers, brokers and carriers.

However, as risk managers and their brokers work on 2015 renewals, they’ll undoubtedly recognize that prices are relatively stable. In fact, prices have been stable for the last several years in spite of many events and developments that might have caused fluctuations in the past.

Mark Moitoso discusses general liability pricing and the flattening of the insurance cycle.

Flattening the GL insurance cycle

Any discussion of today’s stable GL market has to start with data and analytics.

These powerful new capabilities offer deeper insight into trends and uncover new information about risks. As a result, buyers, brokers and insurers are increasingly mining data, monitoring trends and building in-house analytical staff.

“The increased focus on analytics is what’s kept pricing fairly stable in the casualty world,” said Mark Moitoso, executive vice president and general manager, National Accounts Casualty at Liberty Mutual Insurance.

With the increased use of analytics, all parties have a better understanding of trends and cost drivers. It’s made buyers, brokers and carriers much more sophisticated and helped pricing reflect actual risk and costs, rather than market cycle.

The stability of the GL market also reflects many new sources of capital that have entered the market over the past few years. In fact, today, there are roughly three times as many insurers competing for a GL risk than three years ago.

Unlike past fluctuations in capacity, this appears to be a fundamental shift in the competitive landscape.

SponsoredContent_LM“The current risk environment underscores the value of the insurer, broker and buyer getting together to figure out the exposures they have, and the best ways to manage them, through risk control, claims management and a strategic risk management program.”
— David Perez, executive vice president and general manager, Commercial Insurance Specialty, Liberty Mutual

Dynamic risks lurking

The proliferation of new insurance companies has not been matched by an influx of new underwriting talent.

The result is the potential dilution of existing talent, creating an opportunity for insurers and brokers with talent and expertise to add even greater value to buyers by helping them understand the new and continuing risks impacting GL.

And today’s business environment presents many of these risks:

  • Mass torts and class-action lawsuits: Understanding complex cases, exhausting subrogation opportunities, and wrangling with multiple plaintiffs to settle a case requires significant expertise and skill.
  • Medical cost inflation: A 2014 PricewaterhouseCoopers report predicts a medical cost inflation rate of 6.8 percent. That’s had an immediate impact in increasing loss costs per commercial auto claim and it will eventually extend to longer-tail casualty businesses like GL.
  • Legal costs: Hourly rates as well as award and settlement costs are all increasing.
  • Industry and geographic factors: A few examples include the energy sector struggling with growing auto losses and construction companies working in New York state contending with the antiquated New York Labor Law

David Perez outlines the risks general liability buyers and brokers currently face.

Managing GL costs in a flat market

While the flattening of the GL insurance cycle removes a key source of expense volatility for risk managers, emerging risks present many challenges.

With the stable market creating general price parity among insurers, it’s more important than ever to select underwriting partners based on their expertise, experience and claims handling record – in short, their ability to help better manage the total cost of GL.

And the key word is indeed “partners.”

“The current risk environment underscores the value of the insurer, broker and buyer getting together to figure out the exposures they have, and the best ways to manage them — through risk control, claims management and a strategic risk management program,” said David Perez, executive vice president and general manager, Commercial Insurance Specialty at Liberty Mutual.

While analytics and data are key drivers to the underwriting process, the complete picture of a company’s risk profile is never fully painted by numbers alone. This perspective is not universally understood and is a key differentiator between an experienced underwriter and a simple analyst.

“We have the ability to influence underwriting decisions based on experience with the customer, knowledge of that customer, and knowledge of how they handle their own risks — things that aren’t necessarily captured in the analytical environment,” said Moitoso.

Mark Moitoso suggests looking at GL spend like one would look at total cost of risk.

Several other factors are critical in choosing an insurance partner that can help manage the total cost of your GL program:

Clear, concise contracts: The policy contract language often determines the outcome of a GL case. Investing time up-front to strategically address risk transfer through contractual language can control GL claim costs.

“A lot of the efficacy we find in claims is driven by the clear intent that’s delivered by the policy,” said Perez.

Legal cost management: Two other key drivers of GL claim outcomes are settlement and trial. The best GL programs include sophisticated legal management approaches that aggressively contain legal costs while also maximizing success factors.

“Buyers and brokers must understand the value an insurer can provide in managing legal outcomes and spending,” noted Perez. “Explore if and how the insurer evaluates potential providers in light of the specific jurisdiction and injury; reviews legal bills; and offers data-driven tools that help negotiations by tracking the range of settlements for similar cases.”

David Perez on managing legal costs.

Specialized claims approach: Resolving claims quickly and fairly is best accomplished by knowledgeable professionals. Working with an insurer whose claims organization is comprised of professionals with deep expertise in specific industries or risk categories is vital.

SponsoredContent_LM“We have the ability to influence underwriting decisions based on experience with the customer, knowledge of that customer, and knowledge of how they handle their own risks, things that aren’t necessarily captured in the analytical environment.”
— Mark Moitoso, executive vice president and general manager, National Accounts Casualty, Liberty Mutual

“When a claim comes in the door, we assess the situation and determine whether it can be handled as a general claim, or whether it’s a complex case,” said Moitoso. “If it’s a complex case, we make sure it goes to the right professional who understands the industry segment and territory. Having that depth and ability to access so many points of expertise and institutional knowledge is a big differentiator for us.”

While the GL insurance market cycle appears to be flattening, basic risk management continues to be essential in managing total GL costs. Close partnership between buyer, broker and insurer is critical to identifying all the GL risks faced by a company and developing a strategic risk management program to effectively mitigate and manage them.

Additional insights



For more information about how Liberty Mutual can help you manage the total cost of your GL program, visit their website or contact your broker.

SponsoredContent
BrandStudioLogo

This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with Liberty Mutual Insurance. The editorial staff of Risk & Insurance had no role in its preparation.




Liberty Mutual Insurance offers a wide range of insurance products and services, including general liability, property, commercial automobile, excess casualty, workers compensation and group benefits.
Share this article: