Cyber Risk Management and Insurance Risks and Rewards Presented by – Jennifer Soper, National Casualty Director, Northbridge

Agenda Applying a traditional Risk Management model to Cyber Risk Mitigation—can everything be insured? Monitoring the plan—how do you know it’s working? Is Cyber spinning out of control?

Risk Management Strategies

Five steps of Risk Management Identify exposures Analyze those exposures Evaluate the risk Implement solution(s) to manage the risk Monitor the outcome

Cyber Risk is not just an IT issue Corporation Board of Directors CEO CFO Legal & HR Risk Manager CRO CSO, CIO

Analyzing and evaluating Cyber Risk Reputation Extortion Hacking Personal Information Manipulation of Data Intellectual Property Virus Business Interruption Customer Data Cloud Compromise Contractual Responsibilities Network Security

Risk Mitigation: The insurance solution

Cyber Risk policy Coverage options are numerous Understanding the exposure = a comprehensive solution How much coverage is too much? First party Third party Incident Response Expenses Network Security & Privacy Cover Digital Asset Expense Internet Media Liability Business Interruption Regulatory Proceeding Expenses E-Commerce Extortion Expenses

Beyond the Cyber Risk policy Blurring the coverage lines Property Covers Commercial General Liability Directors & Officers

The insurance solution: Navigating the abyss Predictive Modelling Reserving Reinsurance Insurance Company Pricing Actuarial Cyber Accumulation accumulation Limits

Monitoring the plan

The role of Claims when it goes wrong The outcome The fix The breach

The Courts The Courts PIPEDA Breach notification and monitoring The Insurers The Insureds PIPEDA Breach notification and monitoring Role of the Cyber policy Will other covers be called in? Jurisdiction

The evolution Past Present Future Cyber Risk? It can’t happen to me It can happen to me

Where do we go from here?

The Future The Internet of Things has pushed the need for Cyber insurance solutions to its greatest level It has caused Insurers to step far beyond their comfort zone as data is limited and still very new Claims, coverage, pricing, modelling and analytics will continue to become more sophisticated but will challenge our traditional thinking of how we look at Cyber risk