Independent Banker - July 2019 - 24

PORTFOLIO
these types of claims are happening every single day, " Farley
says, " so some carriers are now including loss of funds from
social engineering in their cyber policies. "
Which vendors are included?
Cyber insurance policies across the industry typically pay
for preapproved vendors to handle the aftermath of a cyberattack
after the carrier is fi rst notifi ed, Farley says.
Vendors may include an outside privacy attorney to help
draft customer breach notifi cation letters if necessary, or an
IT forensics investigation fi rm to track a hacker's footprints
to determine how they got into the network, what data was
stolen and whether the hacker is still in the network. Other
vendors covered by a cyber insurance policy include companies
that can handle large volumes of customer calls and
notifi cation mailings if a bank doesn't have that capability,
as well as vendors that can provide crisis management services
if a bank doesn't have the public relations specialists
to handle such events.
Staff (specifi cally risk management and IT) should familiarize
themselves ahead of time with the preapproved breach
response vendors provided to policyholders to expedite the
bank's incident response, says Emily Lowe, vice president in
Willis Towers Watson's Boston offi ce.
" Many vendors also off er pre-breach services, such as
penetration and phishing testing, and consulting services to
develop incident response plans, " she says. " If your bank is
already engaged with a vendor, let your broker know so that
the carrier will approve them, though that does depend on
the policy. "
The biggest thing to keep in mind, says Lowe, is that cyber
insurance deals with the confi dentiality, integrity and accessibility
of data and does not cover the value of money. Crime
insurance deals with loss of money, whatever form that
might take, including securities. " When you think about
cyber insurance, you're looking to cover anything that could
compromise the confi dentiality, integrity and accessibility
of your data, " Lowe says.
A typical cyber insurance policy is intended to cover
liability for compromising any personally identifi able information
and any corporate confi dential information under a
bank's control, she says. These policies also cover the liability
of managing a computer network, as well as managing
paper records that a bank may still process. Such policies
cover employees' personal data, including sensitive information
from background checks when hiring them.
Lowe says, " Both cyber and crime policies play a role in
robust risk management programs for community banks. "
Katie Kuehner-Hebert is a writer in California.
Fast-tracking cyber policy underwriting
Thanks to the latest advancements
in technology, the underwriting
process for cyber insurance
policies has vastly improved, says
John Farley, managing director of
cyber liability practice at Arthur J.
Gallagher in New York City.
" In the past, an insurance
company would send a company
wanting a cyber policy a
questionnaire of 50 questions that
were diff icult to answer, and the
company would hope they were
giving the correct answers to get
the policy, " he says. " It was a very
cumbersome process. "
Now, some insurance
companies are using software that
enables them to conduct their
own analysis of the prospective
client without having to talk to
them or have them complete
a questionnaire, Farley says.
Insurers may use scanning
techniques to analyze ports of
entry into the prospective client's
networks to see if the ports of
entry are vulnerable enough
to let a hacker in, as well as to
determine which other cyber
security controls might be lacking.
With these new capabilities,
insurance companies can
make an informed decision in
seconds, Farley says. If controls
are substandard, clients may
still be able to get their policies
underwritten, but they may have
to pay higher
premiums.
" After they get
the policy, if
an insurer
subsequently
discovers a network
access point that is not secure,
the insurer may request that the
client patch it, " he adds.
If the client doesn't mediate it,
the policy may not be renewed.
According to Farley, it all depends
on the wording of the policy.
" Companies should read their
policies very carefully, " he says.
" At the very least, a carrier may not
renew the policy if no action is
taken to remediate the issue. "
24 Q ICBA Independent Banker Q July 2019
Independent Banker - July 2019

Table of Contents for the Digital Edition of Independent Banker - July 2019
