Whether you are a business large or small, old or new, the dangers of a cyber breach are lurking. The truth is that all businesses today are digital in one form or another. It is the age of the Internet of Everything! Cloud computing is the basis of almost all transactions and with every touch of the keyboard or data entry, there is an attached risk of a breach. And with that breach, comes the liability that might not just be disruptive to your business; it could be devastating.
The costs of a breach can be enormous. (Imagine losing a major bank transfer or assuming a loss of $10,000 for each cyber-security infraction.) By the way, your attacker can come from the outside or inside, as 70 percent of breaches are initiated by employees or former employees.
So what this thing called cyber insurance? Cyber insurance arose out of the traditional Errors and Omissions (E&O) coverage known to most businesses. Over time coverage was extended to viruses, data corruption to connected client systems, or damage affecting customers. Generally, early adopters were technology-based companies.
More than a decade ago, network security policies expanded to include breaches of confidential information. At that point, the retail segment adopted cyber insurance on a wide scale.
Coverage for any business could be simple or complex. The determining factor is an employer’s decision on degree of acceptable risk. Let’s take the simple first.
The Bank of Tucson, through Grandpoint Insurance Services, now offers cyber insurance coverage for its customers at a nominal cost. The coverage for business accounts protects against losses for funds transfer fraud (when someone impersonates your company for a funds transfer) and cyber deception (when a criminal pretends to be your vendor employee or client and gets you to transfer money to them). Mike Hannley, president of Bank of Tucson, announced the new product in the last month. Mike commented, “Internet criminals do not use guns for illicit gain, but they gladly use your computer and network for paydays!”
Let’s take a look at broader, more complex cyber insurance. That kind of cyber insurance may have several parts:
Network Security: Your network has failed in some form. It could be that someone is trying to shut down your network to in an effort to stop you from conducting business. Or, you’ve just experienced a data breach, some form of extortion, or tapped your system to advance a virus to all of your connected transmissions.
Privacy: Privacy is huge and does not necessarily have to be connected to a system failure. There are many known cases of information of physical records that are not properly disposed of, including human errors (think of a lost laptop with an easily penetrated passcode) or a hard drive with customer records that somehow got into the wrong hands.
Media Liability: This aspect covers advertising injury claims like copyright, libel and slander. Coverage may extend to offline content as well.
Digging deeper, network security and privacy liability policies covers first and third party liabilities. First party means the direct costs of responding to a breach; third party means it applies when people sue or make claims against you.
First party inclusions:
Costs of notifying anyone attached to the breach
Loss of profits and business interruption
Legal advice and regulatory obligations
Public relations expenses
Third party inclusions:
Regulatory fines and penalties
Damage and judgments related to the breach
Costs of responding to regulatory inquiries
According to Jack Clements, CPA at the Clements Agency, “Every company, large or small, should at least consider cyber Insurance. There are so many examples of exposure to loss that it is difficult to list them all; some exposures are unique to certain types of businesses.”
“And don’t forget about controls; they are critical,” Jack continued. “In broad policies, premiums are based upon the quality of your controls. Many companies believe that their controls are so strong, that it can never happen to them. Believe me, it can and it will.”
Another aspect of this discussion is commonly known as “Social Engineering” or “Duping.” This is a scheme where a seemingly legitimate email is sent to you asking for money or confidential information. It happens all the time. Jack added, “In fact, an attempt was made on our office this week. We received a business email from my brother, with whom we do business, asking for a wire transfer. When we called him, we learned that it was completely fraudulent. Had we complied, the transaction would not have been covered by our Cyber Policy, since we willingly sent the money. We would, however, have been covered by the Social Engineering endorsement that we have on our package policy. Just another area to think about.”
Linda Drake is a 25-year, seasoned global entrepreneur, corporate executive, author and Certified Professional & Executive Coach.