Understanding Cyber Insurance NASCUS/CUNA Cybersecurity Symposium Jay Isaacson - VP, Business Protection August 25, 2015

Cyber Insurance Introduction State Sponsored Critical Infrastructure Virus/Malware Hacktivism Compromised Plastic Cards Social Engineering Denial of Service

Cyber Security Risk Exposures Core processing system is compromised Rogue software programmer building a backdoor to access confidential information Insider malfeasance Employee and/or third-party vendor errors/accidental disclosure Virus/Malware attacks on a credit union system Hacking

What Is Covered*? Theft or Loss of Funds Coverage is typically triggered in the event an insured has a security breach Expenses/ Recovery Lawsuit Protection Outside Consultants Defense Expenses Forensics Settlements Breach Notification Judgments Credit Monitoring Regulatory Penalties/Investigations Lost Revenue (system being down) Public Relations (rebuilding reputation) Extortion Expenses What Is Not Covered? Theft or Loss of Funds Lost Revenue From Damaged Reputation Operational/IT Infrastructure Costs *Individual coverage may vary- refer to your own policy terms and conditions for specifics

Common Credit Union Claims Employee/Vendor Errors Lost Laptops and Smartphones Virus/Malware Unintended Disclosure Lost Portable Media

Why Consider a Cyber Insurance Solution? Leverage risk management services of providers Ability to utilize tools and resources to bolster incident response capabilities Benefit from experience and expertise of insurers in responding to data breaches Mitigate costs of reacting and responding to a breach event Cyber insurance may be a contractual requirement

Who Is Buying This Type Of Coverage Today? Businesses across all sectors of the economy are adopting this coverage to help manage cyber risk Organizations deemed to be critical infrastructure have adopted coverage at a higher rate Approximately 35-40% of credit unions purchase cyber insurance today Credit unions of all size ranges have elected to purchase Typically as asset size increases, adoption of the insurance coverage also increases

This presentation was created by the CUNA Mutual Group based on our experience in the credit union and insurance market. It is intended to be used only as a guide, not as legal advice. Any examples provided have been simplified to give you an overview of the importance of selecting appropriate coverage limits, insuring-to-value and implementing loss prevention techniques. No coverage is provided by this presentation/ publication, nor does it replace any provisions of any insurance policy or bond.   CUNA Mutual Group is the marketing name for CUNA Mutual Holding Company, a mutual insurance holding company, its subsidiaries and affiliates. Insurance products offered to financial institutions and their affiliates are underwritten by CUMIS Insurance Society, Inc. or CUMIS Specialty Insurance Company, members of the CUNA Mutual Group. Some coverages may not be available in all states. If a coverage is not available from one of our member companies, CUNA Mutual Insurance Agency, Inc., our insurance producer affiliate, may assist us in placing coverage with other insurance carriers in order to serve our customers’ needs. For example, the Workers’ Compensation Policy is underwritten by non-affiliated admitted carriers. CUMIS Specialty Insurance Company, our excess and surplus lines carrier, underwrites coverages that are not available in the admitted market. Data breach services are offered by Kroll, a member of the Altegrity family of businesses. Cyber liability may be underwritten by Beazley Insurance Group. This summary is not a contract and no coverage is provided by this publication, nor does it replace any provisions of any insurance policy or bond. Please read the actual policy for specific coverage, terms, conditions, and exclusions. CSS-1270482.1-0815-0917©CUNA Mutual Group 2015, All Rights Reserved.