1. Society of Risk Management Consultants Annual Conference
October 17, 2013
Text Goes Here
00/00/00
Presented by:
Kurtis E. Suhs, Vice President
National Practice Leader for Privacy and Technology
/ (404)

2. The Underwriting Process
Non-binding indication
Consultative discussion with Risk Management, Information Security, Human Resource, Records Management and Company Underwriter
Formal quote
Premiums based upon the following:
Annual revenue of applicant
Industry class
Type of coverage
Limits, sub-limits, retentions, terms and conditions
Risk profile

3. Privacy and Network Security Coverage
Third Party Coverage
Side A Excess D&O Liability Coverage
Network Security Liability Coverage
Privacy Liability Coverage
Regulatory Proceeding Coverage
Internet Media Liability Coverage
First Party Coverage
Digital Asset Loss Coverage
Business Interruption Loss and Dependent Business Interruption Income Loss Coverage
Network Extortion Threat and Reward Payments Coverage
Privacy Breach Expenses Coverage

4. Privacy Breach Expenses
Public Relations
Advertising
Press Releases
Legal
Data Breach Attorney
Defense of claims or suits
Payment of judgments or settlements
Forensics
Cost to investigate the breach
Cost to contain the breach
Notification
Drafting Letter
Printing or Design
Mailing
Notification by Substitute Means
Identity Monitoring
Credit Freezes and Thaws
Call Center

5. Pre-Loss Control Services

6. Key Terms and Conditions
Separate Network Security and Privacy Liability coverage grant;
Privacy coverage includes non-public personal information and confidential corporate information in any format;
PII not defined as Last Name, First Name in combination with SS# etc.
Identity Monitoring versus Credit Monitoring
Regulatory Proceedings Coverage extends to both Privacy and Network Security;
Privacy breach expenses including notification, legal, public relations, forensics, identity monitoring and call center services;
Coverage for the insured’s liability arising from the actions of independent contractors and third party service providers;
Severability of application for individual insured persons, with only the knowledge of specified executives imputed to other insureds;
Carve backs in exclusion such as Dishonesty, Insured versus Insured, ERISA and EPLI.

7. Losses in the marketplace
HealthNet $10M limit with a $1M SIR for $485K in premium
March Nine unaccounted server drives with personal information for 24,599 CT residents $6.6M total incurred.
TRICARE/ SAIC $15M limit. Premium unknown. Open Claim
September 2011 – Theft of unencrypted back up tapes containing information on 4.9M TRICARE members stolen from the car of an SAIC employee. Eight class actions filed demanding $4B against TRICARE and SAIC.
Heartland $20M limit with a $1M SIR. Premium unknown
Payment May 2008– Third party hacker gains access to 130 million
Systems credit and debit card accounts. Full limit loss.

8. Losses in the marketplace
Steven Hutchins No cyber coverage in force.
Architects, Inc January 2008 – Office Manager destroys 7 years’ worth of architectural drawings and blueprints estimated at $2.5M in value.
Aereo $1M limit with a $50K SIR for $14K in premium.
March 2012 – Start-up company that streams the broadcast of television through a browser and DVR in the cloud is sued by several networks for copyright infringement. Full limit loss.
Strategic No cyber coverage in force.
Forecasting December 2011 – Third party hacker gain s access to 75K credit cards, 860K passwords and 5 million s. In June 2012, Stratfor settled a class action lawsuit for $1.75M `

9. Questions