Insurance in the Cloud Ben Hunter, Canadian Underwriting Specialist Technology Insurance Specialty Chubb Insurance Company of Canada

This document is advisory in nature. DISCLAIMER This document is advisory in nature. The views, information and content expressed herein are those of the authors and does not necessarily represent the views of any of the insurers of The Chubb Group of Insurance Companies. Chubb did not participate in and takes no position on the nature, quality or accuracy of such content. The information provided should not be relied on as legal advice or a definitive statement of the law in any jurisdiction. For such advice, an applicant, insured, listener or reader should consult their own legal counsel

Agenda Difficulty Insuring Cloud Exposures Insurance Coverage Available E&O Insurance Technology Risk Spectrum Underwriting Considerations ‘I’ve been hacked!’ Q&A

Difficulty in Insuring The Cloud How do you insure the data? Data is not at rest in one location; schedule on property policy? Data is in the care, custody or control of a third party Business Income coverage typically excludes on line access providers Carriers may provide sublimits for loss of utilities type contingent business income coverage Errors and Omissions Review definition of ‘your product’ and ‘your service’ Ensure cloud computing activities not excluded Confirm no exclusion for loss of internet service

Insurance Coverage Property General Liability Errors and Omissions Contingent Business income Check exclusions. Must be a physical damage trigger Usually sublimited. May purchase additional limits Electronic Data May need to schedule on an ‘any other location’ basis Impairment of Computer Services Business income and electronic data recovery costs due to an attack to the insured’s network General Liability Privacy Has migrated to the E&O policy Errors and Omissions Originally covered financial loss due to a product defect or service deficiency Now expanded into the world of intellectual property, privacy, and ‘cyber’ coverage

Technology Insurance Solutions Errors & Omissions Third Party Product and Service Financial Injury Privacy & Network Security Intellectual Property (patent excluded) Media First Party Privacy Remediation Expense Insured’s reasonable and necessary expenses incurred after a data breach: Public Relations Notification Forensics Credit monitoring

Technology Risk Spectrum CUSTOMERS CONSUMER & REGULATORY RESPONSE COMPETITORS & IP RIGHTS Breach of Contact Failure to Perform Services Product Defects Use of technology is ubiquitous, exposures are pervasive Disclosure, Publication or Use PII/BCI Privacy Remediation Expenses Fines and Penalties IP / Injunctive Relief Media / Libel / Slander 7

What do Underwriters need to know? Contracts Operational exposures (human resources, network and physical security management) Cloud Resiliency and Redundancy Corporate governance in respect of IT and Privacy Content, Transactions & e-commerce exposures Risk Management and Loss Control attitude Ability to recover from a loss Claims History

‘I’ve been hacked!’ Contact your Insurance Broker and/or Carrier Contact Legal Counsel who specializes in data breaches Engage third party experts to assist with investigation and remediation Offer customers credit monitoring services Engage a skilled public relation specialist Contact Law enforcement, if applicable Contact a Breach Coach

Breach Coach A Breach Coach can help you determine: Is a computer forensics investigation needed? Are breach notifications required? What is the potential for regulatory fines or penalties? What is the potential for legal action? What are your next steps?

Thanks for your time