Cyberattacks have, unfortunately, become commonplace and only show signs of increasing. As demonstrated by the recent Colonial Pipeline and JBS attacks, ransomware attacks, in particular, are increasing (in terms of both frequency and cost). Therefore, cyber insurance must be part of companies’ cybersecurity and risk management practices–and companies must ensure that their policies are tailored and negotiated to their risks and needs. Here are a few things to consider:
- Review All Sublimits. Many coverages under a cyber policy are subject to “sublimits” that are less than the policy’s overall limit of liability. Rather than be surprised by sublimits after a cybersecurity event, review policies now and ask the insurer to increase sublimits if necessary. As ransomware demands increase, pay particular attention to that coverage’s sublimit.
- Notice! Pay particular attention to cyber policies’ notice requirements. Some coverages may require notice within days of discovery of a cyberattack. Insurer approval may also be required for costs that need to be incurred in the short term, reinforcing the importance of providing prompt notice.
- Robust Third-Party Claim Coverage. As new privacy laws place heavier obligations on companies to protect consumers’ and other third parties’ information, companies must ensure their policies provide robust coverage for third-party claims brought under those new statutes.
- Covered Systems. Make sure the policy covers the company’s and its employees’ computer systems, networks, and devices. In the new “work from home” environment, companies should ask cyber insurers to add endorsements covering employee devices.
- Broker Selection. Cyber policies are complex and ever changing, as are the risks. Consider using a broker who specializes in the placement of cyber insurance policies.
