Cybersecurity Risk and Insurance Are...

This hour of continuing education is focused on describing the current state of the underlying risk in the cybersecurity world and the insurance implications for producers and their clients.

The first of the four seminar parts details how many small insureds are not prepared for the risk of a cyber-attack.  It also explains how this risk has been increased or accelerated with the developments in 2020, with more business being conducted via email and on e-platforms such as GoToMeeting and Zoom.

The second section discusses cybersecurity legal requirements.  The theme of this area is that there are multiple laws which may affect clients, depending on what industry they are in.  However, there is a degree of consistency in these various laws that can help when a producer is advising about risk.  The conceptually consistent principles of cybersecurity law are discussed in two ways.  

Amplifying on this legal aspect of the cybersecurity risk, the third section shifts focus to third-party liabilities and lawsuits.  It draws on “real world” exposure from a data breach, the new California Consumer Privacy Act and the coming tide of biometric protection statutes.

The final portion of the hour turns to the ongoing struggle over the scope of cybersecurity coverage by focusing on a pair of recent coverage decisions.  The two decisions: (a) illustrate the possible gaps in coverage; and (b) examine ways in which the policy language itself might be “undone” or overridden by promotional assurances of coverage.  Thus, the seminar can address the errors and omissions implications for this field.  Finally, other decisions in this field are mentioned, along with the interesting question of whether coverage may be precluded by the “acts of war” exclusion existing in so many policies.
 

Basic Course Information

• Consumer Expectations
• Small Businesses remain unprepared
• The impact of the pandemic on the cyber risk    
• The NAIC Cybersecurity Model
• Current Status
• Conceptual Example of cyber principles
• GDPR 
• The NIST Framework    
• Consumer class actions
• California’s Consumer Privacy Act of 2018
• Liability Considerations
• Biometric Data Protection    
• The G&G Oil decisions
• The use of “promo” materials on coverage
• The status of social engineering claims    

• Cybersecurity Risk