How to Buy Privacy Insurance
Start with the basics
For many insurers and brokers, the technicalities of information security and the details of how to deal with a data breach are still a mystery. The market for cyber liability products is also in its infancy so be prepared to work with your provider to ensure that you get what you actually require.
A good starting point is to determine what costs or expenses you would like to have covered and what types of incidents you want cover for. Circulate and discuss this list with all the relevant people, not forgetting to get all the information you need from third-party suppliers and partners. List both your own costs (known as first-party costs) and the costs that others may attempt to claim from you as a result of the incident (known as third-party costs).
Getting the right broker is important. A good specialist broker will save you time in determining what is right for your business, remembering that this may not be the broker you are currently using for your non-cyber risks. Share your list of estimated expenses and costs with your broker and talk through the different exclusions that might stop you from making a claim.
Apart from obviously being responsible for the product, insurance companies are responsible for providing support to your broker about the products. In addition, they will decide if they are willing to take on your risks according to your completed proposal form and what premium you will need to pay. Choosing the right insurer can be the difference between paying little for cover that you will never be able to utilise in the event of an incident or having cost-effective cover where the insurer understands the implications of a breach and the costs associated with it.
Selecting the right policy for your business, business model, industry, size, exposures and so forth is a very complex exercise, which is why a specialist broker is important, as they are likely to know the best products to suit your needs.
It is important to understand the support you receive as part of the cover. Some policies provide a point of contact who will handle everything from the moment the insurer has agreed the claim, whereas others will let you manage the incident and decide which services you want to use from their list of suppliers.
Remember that your organization may not have the people or experience to manage a data breach incident so third-party suppliers can often be a better route to take.
Analyzing Cyber Risk Coverage
Unlike other types of insurance, there is no standard form on which the insurance industry as a whole underwrites cyber coverage.
By: Steve Raptis | March 13, 2015
Many companies are now taking a close look at the protections provided by cyber risk insurance policies — some for the first time — as data breach incidents and related cyber risks continue to increase and gain publicity, and as government agencies become more actively involved in policing the corporate response.
Although cyber coverage is a relatively new product in the insurance marketplace, there are now roughly 50 insurance carriers that offer it (although the amounts of coverage available often are limited).
These policies are sold under a number of different names, including “cyber risk,” “information security,” “privacy,” and “media liability” coverage. Unlike other types of insurance, there is no standard form on which the insurance industry as a whole underwrites cyber coverage.
These policies are sold under a number of different names, including “cyber risk,” “information security,” “privacy,” and “media liability” coverage.
While this provides some challenges to buying coverage, especially for the uninitiated, it often provides more room for negotiation of the terms of cyber policies than many other types of coverage.
Most cyber policies currently in the marketplace offer some combination of traditional liability coverage protecting against claims by third parties, and first-party coverage protecting against losses suffered by the insured.
There also are important terms and conditions of cyber policies that can have a significant impact on available coverage. While no company can reasonably expect to secure every available component of coverage, awareness of differences among the policies being offered is critical to maximizing premium dollars spent.
While not exhaustive, some of the important features to be mindful of when shopping for cyber coverage include:
1.Third-Party (Liability) Coverages
Privacy liability coverage. This includes liability to the insured’s customers, clients and employees for breaches of their private information which can be a major component of liability in the case of a data breach.
Seeking trigger language that focuses on the insured’s failure to protect confidential information, regardless of the cause (e.g., “any failure to protect”), rather than language requiring an intentional breach, is advisable.
Also, some (but not all) cyber policies also provide coverage for the insured’s failure to disclose a breach in accordance with privacy laws.
Policies that include defence from the earliest stages of an investigation, typically including a civil investigative demand or similar request for information, are preferable.
Regulatory actions. There is substantial variance among cyber policies regarding whether and to what extent they provide coverage for regulatory and other governmental actions. Even where covered, some policies require that the action be initiated by a formal “suit” in order to trigger the defense obligation.
This limitation typically would preclude defense of the investigative stage of government actions — which often is the most expensive stage for the entity being investigated.
Policies that include defense from the earliest stages of an investigation, typically including a civil investigative demand or similar request for information, are preferable.
It also bears noting that civil fines and penalties are covered under many cyber policies, and companies should be mindful of this if an insurer seeks to exclude such coverage.
Notification costs. This coverage includes the costs of notifying third parties potentially affected by a data breach. There is an ever-increasing and constantly evolving landscape of breach notification laws on a state-by-state basis.
This coverage is included in most cyber policies. However, many policies, often by endorsement, limit the number of individuals that must be notified and the method(s) of notification. Some policies also may vest some control over the notification process (which is often sensitive to the insured) with the insurer.
These limitations could leave a company absorbing at least some of the notification costs if a breach occurs, and may require it to relinquish some control over the notification process.
Crisis management. This coverage includes the costs of managing the public relations outfall from most data breach scenarios. Most, but not all, cyber policies contain some form of this coverage.
The insured sometimes is required to choose from a pre-determined list of vendors. In most cases, if the insured chooses another vendor, the insurer is not required to pay for the services. However, this restriction may be negotiable.
Call centers. This coverage may be included within the notification and crisis management coverages, may be a stand-alone coverage, or may not be provided at all.
Because this tends to be one of the higher costs associated with data breaches, it is important to identify whether this coverage is expressly provided and any applicable limitations (including the number of affected persons who are eligible to receive call center services, the hours and locations of the call center, and the specific services the call center staff will provide).
Credit/identity monitoring. This coverage is included in most cyber policies, but again, may be limited for the number of affected individuals that can receive the services and the prescribed vendors that are available.
Transmission of viruses/malicious code. As its name suggests, this coverage protects against liability claims alleging damages from transmission of viruses and other malicious code or data. Not all cyber policies have this coverage.
However, before making it a priority, a company should consider the extent to which its operating systems realistically have the potential to be a source of this type of liability.
2. First-Party Coverages
Theft and fraud coverage. Covers certain of the costs of theft or destruction of the insured’s data and theft of the insured’s funds.
Forensic investigation. Covers the costs of determining the cause of a loss of data.
Network/business interruption. Covers the costs of business lost and additional expense due to an interruption of the insured’s computer systems. Some cyber policies require that the interruption be caused by an intentional cyber attack and some do not.
There typically are limitations to this coverage, including a requirement that the interruption last a minimal length of time before coverage incepts, and the total length of an interruption that will be covered. This coverage may also include contingent business expenses.
Extortion. Covers the costs of “ransom” if a third party demands payment to refrain from publicly disclosing or causing damage to the insured’s confidential electronic data.
Data loss and restoration. This component — included in some but not all cyber policies — covers the costs of restoring data if it is lost, and in some cases, diagnosing and repairing the cause of the loss. It typically is subject to a substantial retention, and may be limited in terms of the cause of the data loss at issue.
The claims-made type polices typically are more restrictive in terms of the events that can trigger coverage, and the timing of resulting claims in relation to the loss may limit or preclude available coverage.
3. Other Key Provisions
Trigger — loss or claim. Cyber policies typically are triggered either by an event that results in the loss of data, or a “claim” arising from the event that is made against the insured (or made against the insured and reported to the insurer) during the policy period.
The claims-made type polices typically are more restrictive in terms of the events that can trigger coverage, and the timing of resulting claims in relation to the loss may limit or preclude available coverage. Thus, the loss type policy is preferable, even though this coverage may be more expensive.
Trigger — defense. In some cyber policies, the defense obligation is triggered by a “suit,” which requires a lawsuit or written demand against the insured. This definition may preclude defense of a claim that has yet to ripen into a lawsuit or written demand (where much of the defense costs on a particular matter may be spent).
If available, less restrictive defense language is preferable. As noted above, in some cyber policies, the “suit” limitation does not apply to governmental actions (such as investigations), which make this language somewhat more acceptable to some companies.
Defense — choice of counsel. In some cyber policies, defense costs are covered only to the extent that the insured chooses from the insurer’s (sometimes short) list of “panel” law firms. If the insured chooses a different firm, its defense costs probably will not be covered.
Given the substantial costs likely to be associated with a significant data breach (which could exceed the limits of the policy), the insured ideally will have substantive input in the choice of counsel.
Accordingly, policies with more balanced choice of counsel language (e.g., the insured and the insurer shall mutually agree on defense counsel and if they cannot agree, the insured shall choose counsel for which the insurer shall pay up to a set hourly rate) are preferable.
Retroactive coverage. Cyber policies often contain a “retroactive date.” Losses arising from events prior to the retroactive date will not be covered. Insurers often fix the retroactive date at the initial date of coverage by the insurer, although the insured may be able to negotiate a retroactive date further back in time.
Acts and omissions of third parties. Acts or omissions of third parties may not be covered expressly, or even may be excluded, under some cyber policies.
By way of example, if a company uses the services of a third-party vendor to maintain its confidential customer or employee information in the “cloud” and the vendor experiences a data breach, the company could be sued by its customers or employees, and may not have any coverage.
Some cyber policies provide coverage for breaches of data maintained by third parties as long as there is a written agreement between the insured and the vendor to provide such services. If a company relies on any third parties to maintain any of its confidential information, it should consider seeking a policy that expressly covers breaches of data maintained by third parties.
Moreover, any self-insured retention language applicable to this coverage should be clear that any payments made by the third party indemnifying the company for loss sustained by the breach count toward satisfaction of the retention.
Coverage for unencrypted devices. Many cyber policies exclude coverage for data lost from unencrypted devices. Cyber coverage without this limitation is preferable.
Coverage for corporations and other entities. Many cyber policies define covered persons, for liability purposes, to include only natural persons. However, entities affected by data breaches may include corporations and other business entities.
Companies should consider seeking coverage that appropriately defines the scope of entities potentially affected by a data breach.
Policy territory – occurrences outside the United States. Even if a purchaser does not operate outside the Unites States, its employees may lose their laptops, PDAs and other electronic devices containing confidential information (or have them stolen) while traveling abroad.
Many cyber policies restrict the applicable coverage territory to the United States and its territories. Companies should ensure that its cyber policy provides coverage even if the loss or theft of confidential information at issue occurs outside the United States.
Breaches not related to electronic records. Some cyber liability policies restrict coverage to loss or theft of electronic data. However, many breaches occur as a result of loss or theft of paper (or other non-electronic) records. Cyber policies covering both are preferable.
Location of security failure. Coverage under some cyber policies is limited to physical theft of data from company premises. This could be problematic in a number of situations, including theft of a laptop, PDA or external drive from an airport or an employee’s home.
Other policies limit coverage for data breaches resulting from password theft to situations where the theft occurs by non-electronic means. Companies purchasing cyber policies should be wary of these types of limitations, which may not seem particularly pernicious on initial review but could be extremely costly.
Exclusions for generalized acts or omissions. Some cyber policies exclude coverage for losses arising from: (i) shortcomings in security of which the insured was aware prior to the inception of coverage; (ii) the insured’s failure to take reasonable steps to design, maintain and upgrade its security; and (iii) certain failures of security software.
Because this type of exclusionary language at least arguably is overly broad, lacking in adequate definition, and potentially subjective in application, it should be limited appropriately by negotiation or avoided altogether.
Exclusions for acts of terrorism or war. This is a common type of exclusion in cyber policies. It is unclear to what extent insurers will rely on these exclusions when data breach result from an organized attack by a foreign nation or hostile organization.
Again, the scope of these exclusions should be negotiated appropriately or, if that is not feasible, the company should consider purchasing alternative coverage.
Steve Raptis is a partner in the Washington, D.C. office of Manatt, Phelps & Phillips LLP. He counsels corporate policyholders nationwide on a broad range of insurance-related issues and represents them in complex insurance disputes. He can be reached at firstname.lastname@example.org or 202.585.6550.
Getting the right broker is important. A good specialist broker will save you time in determining what is right for your business
Cyber Security, Cyber Governance and Cyber Insurance
Christine Marciano and Paul Ferrillo, Counsel at Weil, Gotshal & Manges LLP in New York City write a comprehensive report on. “Responding to Today’s Data Breach Environment: What Every Director (or any company for that matter) Really Needs to Know about Cyber Insurance.”
The report offers a deep dive on cyber insurance and discusses:
- If your company experienced a data breach today, would your board be ready?
- Reputational Loss after a Data Breach
- Incorporating Cyber Insurance Into Your Data Breach Incident Response Plan Today
- Evaluating Cyber Insurance Policies
- The Immediate Advantages of Cyber Insurance
- How Much Cyber Insurance Coverage Should Companies Buy?
- Insuring Your Board and Company’s Cyber Risk
- Evaluating and Knowing Your Cyber Insurance Carrier’s Claims Paying and Handling Reputation is Crucial
- Intellectual Property Exclusion in Cyber Insurance Policies
- Cyber Terrorism
- Five Things Every Board Needs to Know When Buying Cyber Insurance
Top Ten Tips for Companies Buying Cyber Security Insurance Coverage
BY KRISTI SINGLETON, COUNSEL, AND SCOTT GODES, COUNSEL, DICKSTEIN SHAPIRO LLP
Companies may spend a lot of time and effort to protect their confidential data, but they may miss prime opportunities to save costs and mitigate potential losses if they focus solely on protecting information, and ignore the benefits of purchasing comprehensive cyber-security insurance coverage.One way that companies can help protect their clients, and themselves, is to understand the scope of the insurance policies that they have, and purchase comprehensive cyber-security insurance coverage. All cyber-security insurance policies, however, are not created equal, so below are some tips that all companies should consider when purchasing or renewing a cyber-security policy.
1. Buy First-Party and Third-Party Coverage
There are two general categories of risks and potential liabilities for data breaches and cyber risks: “first-party risks” and “third-party risks.” Generally speaking, first-party risks are potential costs for loss of or damage to the policyholder’s own data, or lost income or business because of a data breach or cyber attack. Potential categories of first-party losses include the following: (i) physical damage to, loss of, or loss of use of data and software only, whether caused by third-party, contractor, employee/former employee, state actor, or “cyber war” or “cyber terrorism”; (ii) corrupted, lost, stolen, or ransomed data resulting from data theft, data breach, or virus; (iii) loss of use of data as a result of software failure, network interruption, or denial of service attack; and (iv) an inability to conduct business because of loss of software, data, or network access.
“Third-party risks” include the policyholder’s potential liability to clients or to various governmental or regulatory entities. These potential risks include lawsuits or claims from third parties resulting from a data breach or other cyber event. A company’s optimal cyber-security policy would contain coverage for both first and third-party claims.
2. Consider Whether Your Cyber-Security Insurance Policy Protects Information On Unencrypted Devices
Many professionals today do a substantial amount of work on computers, and much of that work is done outside of the office. Technology has advanced so that an employee can accomplish much of the same work he used to do at the office while sitting at home, or in an airport, or even reclining on a beach on a tropical vacation. And while most company-owned laptops are encrypted, many personallyowned computers and storage devices, such as flash drives, are not. There is a significant potential for data breach claims and cyber-security claims arising from the theft of loss of such unencrypted laptops or flash drives that may contain a client’s confidential and/or proprietary information. Certain cyber-security insurance policies have language that may not extend to cover such claims, or specifically excludes claims arising from the theft or loss of such devices.
3. Protect Information in the Care, Protection or Control of Third Parties
Businesses may take every security precaution possible when protecting data in the company’s own electronic systems, but sometimes companies have to put confidential information in the hands of third parties, such as vendors or consultants. Cyber-security insurance policies that do not provide protection for data breaches that occur when confidential information is in the care, protection, or control of others may create a potential gap in coverage for companies that routinely use such third-party vendors. Another way that insurers may attempt to limit their risk on claims arising from data breaches at a third-party’s place of business are to provide coverage for such breaches, but only if the sharing of confidential information is authorized by contract. As copy vendors may not require a written contract before accepting a project, consider how the coverage would apply when there is not a written contract for work.
4. Consider Data Restoration Costs In Your Coverage
Many cyber-security insurance policies on the market today may not cover costs to replace, upgrade, update, improve or maintain a computer system that was breached. Data restoration costs are potentially prohibitive, especially for any companies that may rely on access to large amounts of data in order to conduct their business or service their clients. Any company that runs the risk of a data breach should ensure that its cyber-security coverage will “make it whole” in the event of a claim by paying for, or reimbursing the company, for data recovery costs.
5. Consider Whether Your Policy Covers Regulatory Actions
A data breach may cause not only the loss of information, or the disbursement of confidential information, but also could result in various regulatory actions against the company that is the victim of such a breach. State and federal agencies have become more active in the context of data breaches, privacy, and cyber-security. Consider whether your company’s insurance policy provides coverage for a regulatory investigation or a regulatory action resulting from a cyber incident. A comprehensive cyber-security insurance policy will provide coverage for a wide range of regulatory actions by different agencies, such as the Federal Trade Commission or the Department of Health and Human Services, or Consumer Protection Act.
6. Consider Whether Injuries to a Company’s Corporate Clients Are Covered, Not Just Injuries to Natural Persons
Consider whether your company’s cyber-security insurance policy protects corporate client data, not just the private information of natural persons. Many companies have more corporate clients than individual clients. To the extent that the cyber-security insurance policy contains language restricting coverage,consider whether thepolicy provides coverage for injuries only to natural persons, rather than to corporations as well, for certain types of cyber-risks. Companies should carefully review their cyber-security policiesto determine whether all of the language in the definitions and grants of coverage include coverage for injuries to companies, corporations, partnerships, and other entities, as well as natural persons.
7. Consider Whether The Insurance Policy Covers Data Transmittals That Take Place Outside of the Company’s Offices
Some cyber-security insurance policies, like property policies, contain coverage based on occurrences that take place in a certain territory, such as the United States, or for occurrences that take place within a certain distance from the policyholder’s place of business.In light of cloud providers and other vendors that may host data and software outside of the United States, as well as the increased amounts of global travel for company employees, however, considering the geographic limitations of a cyber-security insurance policy is critical.
8. If Your Business Accepts Payment By Credit Cards, Consider Whether Your Company’s Cyber-Security Insurance Policy Provides Coverage for Payment Card Industry Liabilities
It is not an exaggeration to say that the vast majority of businesses today that sell products to the public probably accept payments by credit card. Having access to credit card information makes companies a target to hackers. If there is a data breach that is traced back to your company, your company may face liability imposed via the Payment Card Industry. The liability for such a data breach may be significant. Certain cyber-security insurance policies are marketed as providing coverage for Payment Card Industry liability, and companies would be well-advised to consider how their insurance policies would respond to such liabilities.
9. Consider Whether Your Company’s Cyber-Security Insurance Policy Provides Coverage for Identity Theft Resolution Services
Identity Theft Resolution Services protects your company if private or personal data of individuals is leaked as a result of a data breach. A good cyber-security insurance policy will cover the costs associated with notifying individuals about the breach, and provide credit monitoring expenses for the individuals whose information was leaked as well as credit counseling services, credit restoration services, and even identity theft resolution services. The optimal policy will provide such coverage even when the notification is voluntary and there is no law requiring such notification.
10. Consider Including Loss Control Services In Your Coverage
It is an old saw that insurance companies do not want their policyholders to make claims. In order to decrease the number of claims that a policyholder may make, many insurers are selling cyber-security insurance policies that pay for, reimburse the client for, or offer discounted rates oncertain loss control services. Essentially, the insurer will pay up to a certain limit to have a pre-approved loss control services company evaluate the policyholder’s electronic security measures, and make recommendations on how to improve them. Companies should be careful, however, that the coverage they purchase, and any renewals, arenot contingent upon the policyholder agreeing to perform any security upgrades recommended by the loss control services company.
In the electronic age, fiscally-responsible companies have a duty to keep up with technology and take necessary steps to protect confidential and proprietary information. Unfortunately, no firewall is unbreachable, and no security system inpenetrable. Companies should consider risk transfer in this area, and a cyber-security insurance policy that is comprehensive, but also tailored to the specific risks a company may face, will help with that task.
The information in this Top Ten should not be construed as legal advice or legal opinion on specific facts and should not be considered representative of the views of its authors, its sponsors, and/or the ACC. This Top Ten is not intended as a definitive statement on the subject addressed. Rather, it is intended to serve as a tool providing practical advice and references for the busy in-house practitioner and other readers.
This article was originally published in Anderson Kill's Enforce magazine (Volume II, Issue I)
The Department of Homeland Security and lawmakers have issued warnings recently regarding the need for businesses to do a better job of minding the store when it comes to data security. Companies themselves are aware of this need: a recent survey indicated that about 30 percent of corporate general counsels believe that their companies are unprepared for a serious data breach. That's a sobering figure that should cause in-house lawyers, risk managers and IT departments to stop and think about their own company's ability to protect its customers and itself from this risk. A smart blend of careful contracting, the right purchases of insurance, due diligence and follow-up with employees can assist greatly in reducing the risks associated with data security breaches.
Risk Management for Data Security Breaches Through Insurance
Data security breaches can lead to a slew of different losses. In the wake of a cyber incident, significant expenses can be incurred in defending class-action litigation, indemnifying those who have a stake in disclosed information, and responding to state attorneys general, the Federal Trade Commission and the Securities and Exchange Commission. The costs of investigating cyber breaches and complying with notification laws can be significant. Cyber incidents can also affect profitability when an incident interrupts business and systems need to be taken offline or security needs to be redeveloped.
The good news is that the insurance market for policyholders shopping for specialty cyber policies is more competitive than ever before. This means more flexibility and coverage options than were available five years ago. As always, however, it is essential to mind the fine print. Below are a few issues to work out with underwriters at the point of sale — not the point of claim.
Exclusions for Terrorism, Hostilities
Many cyber insurance policies contain exclusions for terrorism, "hostilities (whether war is declared or not)" and claims arising from "acts of foreign enemies." Given that many cyber attacks and breaches are believed to originate in foreign countries and some of those are further believed to be at the direction of foreign governments, policyholders must decide whether such exclusions make the cyber coverage unsuitable for their needs. This question may be especially germane if the policyholder is in a key infrastructure industry, defense industry or technology sector.
Exclusions for Contractual Liability
Some cyber insurance policies purport to exclude coverage for "any guarantee, warranty, contractual term or liability assumed or accepted by an Insured under any contract or agreement." Exclusions of this type are often misused by certain insurance companies to contest valid claims. "Contractual liability" exclusions are particularly problematic in the cyber insurance realm because many policyholders will have contractual relationships with merchant banks, credit card companies, clients, vendors, investors and other business partners. In the case of a cyber breach impacting a policyholder's relationship with these entities, insurance companies may try to argue that such exclusions bar coverage otherwise available under the cyber policy. Some insurance companies will also argue that breach of contract damages do not constitute a covered "loss."
Even if the cyber insurance policy provides a carve-out from the exclusion for scenarios in which the policyholder may have liability absent the contract relationship, policyholders still are regularly forced to refute creative arguments about legal doctrines that are not supposed to apply to the insurance coverage realm, such as the so-called economic loss doctrine. These types of exclusions therefore need to be eliminated or greatly narrowed in scope to avoid their potential application to cyber losses.
Unauthorized Collection of Data Exclusions
Some cyber insurance policies contain exclusions for the "unauthorized" collection or gathering of information. For policyholders engaged in some forms of online business activity, such an exclusion can be problematic. For instance, it was reported recently that the FTC had warned several data brokerage firms that their practices of gathering and selling consumer information potentially violate the Fair Credit Reporting Act. Other companies have been accused of keeping consumer credit card transaction data for too long a time after the credit card transaction was complete. Policyholders that gather information for consumer transactions, marketing purposes or as part of their core business model, must gauge how an exclusion for unauthorized collection might be used by an insurance company to evade insurance coverage for a data security breach claim.
Cyber insurance policies may also contain exclusions for "pollutants." Again, depending upon the policyholder's industry, such an exclusion may be problematic or lead to an unnecessary dispute over the scope of coverage for a claim. Given that cyber attacks are increasingly aimed at key infrastructure, it is possible that a cyber attack could implicate "pollutants." Insurance companies have been very aggressive over the years in urging a broad application of pollution exclusions to go far beyond industrial polluters, such as arguments that indoor air quality claims implicate pollution exclusions. Accordingly, depending on the policyholder's industry, imposition of an exclusion for pollutants may require a conversation at your underwriting meetings.
Violation of Statute, Rule, Law or Consumer Protection Law
Some cyber policies have exclusions that seek to restrict or void coverage where the policyholder has violated a statute, rule, law or order of a regulatory agency. There are many variations of such exclusions and it is important that the insurance broker either eliminate such exclusions, or find a policy that has the most palatable one available. In the wake of a serious data breach or cyber attack, it is not uncommon for regulators and others to assert that the policyholder's data-handling and conduct violated state or federal law as noted under "Unauthorized Collection of Data Exclusions" above.
Untested Policy Language
A great many of the cyber insurance policy terms and forms now on the market are untested in court. That is likely to change in the future as more of this insurance is purchased and insurance companies start staking out "the limits" of coverage in response to claims. Policyholders should anticipate this inevitability by looking hard at these terms and forms before buying them. Policyholders also should steer clear of foreign law and foreign mandatory arbitration clauses that sometimes creep into cyber insurance policies, almost always favoring the interests of the insurance companies.
Cyber Insurance is Just One Piece of the Puzzle
There are now more options than ever to protect against cyber losses via dedicated specialty insurance for a data security breach. Before purchasing such insurance, however, it is important to examine what coverage the business has under its traditional insurance policies and identify where potential coverage gaps might exist. Make sure as well that coverage will be available — whether under cyber policies, business package policies, E&O policies or crime bonds/policies — when cloud computing services are used. Most insurance coverage can readily be adapted to expressly cover cloud computing risks.
The bottom line is that the insurance policy should match the cyber exposure of the policyholder so that coverage for a data security breach is as comprehensive and protective as possible. After all, this is the point of insurance.
Joshua Gold is a shareholder in Anderson Kill's New York office. Mr. Gold has extensive experience in insurance coverage analysis, consulting and litigation, with an emphasis on directors and officers insurance, errors and omissions insurance, online and high-tech liability and property insurance coverage issues and offshore market insurance products.
Cort T. Malone is a shareholder in Anderson Kill's Stamford, CT, office. Mr. Malone is an experienced litigator, focusing on insurance coverage litigation and dispute resolution, with an emphasis on commercial general liability insurance, directors and officers insurance, employment practices liability insurance, advertising injury insurance and property insurance issues.
About Anderson Kill
Anderson Kill practices law in the areas of Insurance Recovery, Commercial Litigation, Environmental Law, Estate, Trusts and Tax Services, Corporate and Securities, Antitrust, Bankruptcy, Real Estate and Construction, Public Law, Government Affairs, Anti-Counterfeiting, Employment and Labor Law, Captives, Intellectual Property, Corporate Tax and Health Reform. Recognized nationwide by Chambers USA for Client Service and Commercial Awareness, and best-known for its work in insurance recovery, the firm represents policyholders only in insurance coverage disputes – with no ties to insurance companies and has no conflicts of interest. Clients include Fortune 1000 companies, small and medium-sized businesses, governmental entities, and nonprofits as well as personal estates. Based in New York City, the firm also has offices in Ventura, CA, Stamford, CT, Washington, DC, Newark, NJ and Philadelphia, PA.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.