The Baldwin Group: Understanding Common Cyber Coverage Pitfalls

Guest Blog Post

As businesses explore how their organization can grow with technology, understanding the cyber landscape is key. But all cyber policies are not created equal and there is no standard policy. In this article, we offer guidance to help avoid some common pitfalls.

Ask yourself:
Do we have cyber coverage/do our current policies cover an incident?
Many businesses assume that their existing policies cover cyber incidents, but this is not always true. Conduct a thorough assessment of your existing coverages to help prevent you from being financially liable after an incident.

Which internal stakeholders should be involved?
Cybersecurity IT leaders, finance, legal, C-suite, and board members should communicate about the organization’s cyber risk and the resulting financial exposure. Determine who will oversee selecting cyber insurance and file claims.

Can we meet the coverage requirements?
Cyber insurers continue to increase the prerequisites insureds need to meet to obtain coverage. Most insurers want to see that you have certain measures in place, including:

• Employee awareness trainings and phishing simulations
• Multi-Factor Authentication (MFA)
• Password manager
• Frequent and replicated back-ups
• Back-up testing
• A principle of least privilege policy
• Use of a Virtual Private Network (VPN)
• Secure Remote Desktop Protocol (RDP)
• Encrypted backups
• Removal of end-of-life (EOL) and end-of-service life (EOSL) devices and software
• Endpoint detection and response (EDR) solution
• Enable and analyze logs for your devices and digital landscape
• Patch management program
• Continually tested incident response plan
  
  

What does our cyber policy cover?
A comprehensive cyber insurance policy includes first-party coverage and third-party liability.
First-party cyber liability insurance helps protect your company by responding to data breaches at your own business. It can cover costs for:

• Communicating with impacted customers
• Credit monitoring
• Forensic analysis
• Data restoration
• Public relations and reputation management
• Losses due to ransomware, etc.
• Expenses for remediation activities
• Loss of income
• Other recovery activities
  
  

Third-party liability coverage provides financial protection if you fail to prevent a data breach at a client’s business, as well as if another company sues you for compromising their data – causing losses or damages. It can cover:

• Legal fees
• Government penalties and fines
• Cost of responding to regulatory inquires
• Settlements and judgments related to the claim
  
  

Are there coverage exclusions we need to be aware of?
Don’t assume your insurance will cover the costs of an incident. Policy wordings and definitions are inconsistent, with some policies clearly stating inclusions and exclusions, and others not being very explicit in what they cover. Many insurers exclude or severely limit coverage for these events:

• Consumer protection acts
• War and terrorism
• Contractual liability
• Electrical or mechanical failure
• Infrastructure breaches or failures
• Voluntary shutdown coverage
• Regulatory fine limitations
• Loss at an associated company not explicitly listed in policy

 
Find the right coverage
Partnering with a team of experts dedicated to improving your approach to cyber risk can help render optimal results from the cyber insurance market. Contact The Baldwin Group for help creating cyber programs tailored to your needs. www.baldwin.com​

 Kathryn Koch, LUTCF, CLU, RFP |Partner
T 863-904-7409| E [email protected]