Cyber Insurance Risk Transfer Alternatives Heather Soronen - Operations Director Rocky Mountain Insurance Information Association

Agenda Cyber Risk Value Proposition What is Available Underwriting Topics What You Need to Know

Cyber Risk

Cyber Risk & Cyber Insurance “Cyber Risk” – “any risks that emanate from the use of electronic data and its transmission, including technology tools such as the internet and telecommunications networks. It also encompasses physical damage that can be caused by cyber attacks, fraud committed by misuse of data, any liability arising from data storage, and the availability, integrity and confidentiality of electronic information – be it related to individuals, companies, or governments.” 1 1 CRO Forum, Cyber Resilience Paper at 5 (December 2014) 2016 Cyber Insurance Buying Guide. Financial Services Sector Coordinating Council for Critical infrastructure Protection and Homeland Security

Almost 43 million cybersecurity incidents detected in 2014 – 40% increase over – increased another 38%. 3 Included: –Disruption of Business- Legal Penalties –Erosion of Customers- Loss of Revenue –Forensic Investigation- Customer Notification –Regulatory Fines- Attorney Fees –Brand and Reputational Damage –Loss of Intellectual Property –Exposure of Sensitive or Confidential Personal and Business Information 2PwC, Managing Cyber Risk In an Interconnected World: Key FInding from The Global State of Information Security Survey 2015 at 7 (Sept 30, 2014) 3PwC, Turnaround and Transformation in cybersecurity: Key FInding from The Global State of Information Security Survey 2016 at 2 (September 2015) 2016 Cyber Insurance Buying Guide. Financial Services Sector Coordinating Council for Critical infrastructure Protection and Homeland Security

Insurance has responded with a variety of products. Main Types of Coverage: –Data Privacy –Liability Coverage for Loss or Breach of Data –Remediation Cost Coverage Customer Notification Forensic Investigation –Regulatory Fines and other Penalties 2016 Cyber Insurance Buying Guide. Financial Services Sector Coordinating Council for Critical infrastructure Protection and Homeland Security

Other Types of Coverage –Costs and Liability Arising out of Cybersecurity Incidents NOT involving Data Breaches –Business and Contingent Business Interruption –Cyber Extortion –Media Liability Brokers can help find appropriate coverages. Create “towers” of insurance – and adding “excess” layers. 4 DO NOT expect your traditional property or liability policy to cover Cyber Losses! 4 Willis Re, Marketplace Realities 2015: Spring Update (April 2015) 2016 Cyber Insurance Buying Guide. Financial Services Sector Coordinating Council for Critical infrastructure Protection and Homeland Security

Value Proposition

Holistic Response Risk Mitigation Response / Recovery Risk Transfer –Many organizations lack awareness about cyber insurance –Why? 2016 Cyber Insurance Buying Guide. Financial Services Sector Coordinating Council for Critical infrastructure Protection and Homeland Security

Reasons to Consider Cyber Insurance Value on cyber risk Underwriting process can help identify gaps and improvement opportunities Inclusion of risk mitigation tools & incident response Cyber Insurance Buying Guide. Financial Services Sector Coordinating Council for Critical infrastructure Protection and Homeland Security

What is Available

How to Begin? Evaluate potential risk exposure –What information is used? –What are the ramifications if the information is compromised? –What steps have already been taken? How much insurance? –What is your risk appetite? –What type of insurance? 2016 Cyber Insurance Buying Guide. Financial Services Sector Coordinating Council for Critical infrastructure Protection and Homeland Security

First Party Coverage -Crisis Management & Identity Theft Response -Cyber Extortion -Data Asset Protection Third Party Coverage –Network Security Liability –Privacy Liability Most CGL Policies will NOT cover losses as a result of Data Breach Cyber Insurance Buying Guide. Financial Services Sector Coordinating Council for Critical infrastructure Protection and Homeland Security

Underwriting Topics

The Underwriting Process a.k.a. “Get Your House in Order” Dedicated Information Security Resources Information Security Policies and Procedures Employee Education Incident Response Planning Security Measures Vendor Management Board Oversight *Tip – Ask the underwriters for a list of questions prior to the discussion Cyber Insurance Buying Guide. Financial Services Sector Coordinating Council for Critical infrastructure Protection and Homeland Security

What You Need to Know

What to be Aware of When Shopping Policy Construction – Insuring Agreement –When is coverage triggered? –When is notice to the insurers required? –How are breach counsel and vendors selected? *Tip – Only buy coverage you NEED 2016 Cyber Insurance Buying Guide. Financial Services Sector Coordinating Council for Critical infrastructure Protection and Homeland Security

What to be Aware of When Shopping Key Exclusions / Sublimits –Portable electronic device exclusion –Intentional Acts Exclusion –Nation / State, Terrorism, Cyber Terrorism Exclusions / Acts of God –Negligent Computer Security Exclusion –Sublimits –Post-Breach Services –Vicarious Liability / Vendors –Other Policy Considerations *Tip – Only buy coverage you NEED 2016 Cyber Insurance Buying Guide. Financial Services Sector Coordinating Council for Critical infrastructure Protection and Homeland Security

Conclusion / Q&A