1

I work for a small to mid-sized CPA firm. We employ the standard security procedures: Firewall, password complexity requirements, Anti-virus protection and the like. The partners have been offered a cyber liability policy that is specific to CPAs.

What are your thoughts? Should a firm this size be covered outside of our General Liability policy?

8 Spice ups
2

This is probably a question for the lawyers at this point. I don’t know what amount of liability you incur from handling the data that you do. You could also take a look at your General policy and see what it covers. It might be worth contacting your liability company to see if they’ll give you that information in writing since most reps will just give you a verbal, “Yeah, we cover that”, which is worth as much as the paper it is printed on…

3

What cyber liability could you incur that would not be covered by your Public Liability Insurance… Indeed what point would there be in having Public Liability Insurance that didn’t cover your online activities? Are those online activities clearly stated in the proposal form your company submitted to obtain their liability insurance?

Sounds like a bit of a scam to me. In the UK this might even be a risk in itself - double insuring a liability can lead to all sorts of problems, and may even mean you are not insured at all…

4

Very interesting topic, I would be very curious are you privy to what the language of the current liability insurance is and or the language of the Cyber liability policy? What exactly does the Cyber liability policy cover?

5

Thanks for the input. I do not have access to the current General/Professional Liability policy, so I cannot speak about what it covers. But here is the wording from the Cyber Liability policy info:

“2 significant enhancements to the network risk and privacy claim coverage currently included in the AICPA Professional Liability Insurance policy”

  1. Privacy Event Expense Coverage - Reimburses you, up to the limit of liability, for reasonable and actual costs incurred if you sustain a privacy breach. Includes the cost to: comply with notice law, including notifying affected individuals by 1st class mail; procure credit monitoring on behalf of individuals affected; manage or respond to unfavorable publicity; manage relationships with regulatory authorities or law enforcment; remediate a risk control deficiency that may have contributed to a breach.

  2. Network Damage Claim Coverage - responds if a claim brought by non-clients results from an unauthorized use of your network to attack or damage another’s network alleging the following, if caused by you; the unscheduled and unplanned inability to gain access to their network; damage to information residing on their network; the suspension or interruption of their network.

6

I work for a UK Insurance broker.

I have spoken to one of the people at the sharp end who have said that Cyber liability cover specifically deals with risks that would not normally be covered by your standard public liability cover, so you wouldn’t be double insured.

From our website:

"Cyber crime is one of the fastest growing crimes. Risks such as hacking, information misuse, fraud and virus transmission can seriously damage your business.

What is Cyber Liability Insurance?
Cyber Liability Insurance addresses risks associated with e-business, the internet, networks and information assets.

When do I need Cyber Liability Insurance?
Anyone with a web site now has the legal liabilities of a publisher. Companies that venture into the World Wide Web face liability exposures that are emerging, evolving and are complex.

Almost every company has some kind of network, database or online presence that puts it at risk for litigation. If you have a website, you could be targeted for violating copyright. You could be liable for slander or defamation due to information posted on a blog or a social networking site by an employee.

What does Cyber Liability Insurance cover?
CL insurance can cover:

  • Network or website damage
  • Breach of Privacy
  • Fraud
  • Virus transmission
  • Infringements of intellectual property rights
  • Defamation

Examples of claims that can be made

  • Breaches of confidentiality
  • Breaches of privacy due to comments circulated via the internet or email
  • Libel and slander due to email or website content
  • Misleading advertising
    "

As you’re in the US, perhaps this might be of help? CFC are one of the Underwriters we use in the UK.

http://www.cfcunderwriting.com/What-we-do/Products/Americas/US/CPM.aspx

Caveat

I am an IT professional, not an Insurance professional. None of the above constitutes Insurance advice.

2 Spice ups
7

This sounds more like what in the UK would be called ‘Professional Indemnity Insurance’ or in other words, your protection against what advice you give/what services you offer to others going wrong.

The cross-over between Prof. Indemnity and Public Liability is always a grey area, and when I worked for an underwriters we preferred to do both together so that there wouldn’t be an argument in case of a claim.

And seriously? Reimbursing you for postage? Now I am not sure in the US what the post office charges now, but even if I had to send out 10,000 letters this still wouldn’t break £5,000! The premiums for this would have to be tiny to make sense…

8

Just reading through Huw3481’s post, I have to ask why wouldn’t this be covered under standard Public Liability Insurance? Sounds like a case of an insurance company trying to wiggle out of an area of responsibility because it is new… after all if you have declared yourself in the proposal form to be a company that sells on the internet, it can hardly be claimed by your insurers that they can’t cover your business of using the internet…

Oh well, more money for the lawyers…

9

Well I would say that based on what you posted Suzanne and what Huw wrote it would seem this is supplemental liability insurance specifically aimed at the “unique” liability scenarios that can occur int he digital realm. It seems to me this would be a pretty wise idea, especially if you do not keep all data in house (use cloud based or SaaS services) You could still sustain a breach internally, but you know what safeguards you have in place and you are not as high a a target as someone who houses lots of information as opposed to just your own businesses, and as evidenced by security breaches of data recently the clients are still responsible for data breaches and cost associated with them even if a third party provider was the one that was hacked.

10

Brian1602 wrote:

Just reading through Huw3481’s post, I have to ask why wouldn’t this be covered under standard Public Liability Insurance? Sounds like a case of an insurance company trying to wiggle out of an area of responsibility because it is new… after all if you have declared yourself in the proposal form to be a company that sells on the internet, it can hardly be claimed by your insurers that they can’t cover your business of using the internet…

Oh well, more money for the lawyers…

Apparently it’s because standard PL cover was not designed for the intricacies of “online”. Nobody had forecast Twitter, Facebook, LinkedIn for a start…

11

all very good points, but other than HUW3481, do each of your employers purchase this type of insurance?

12

Not mine, as far as I can find out.

13

Interesting. I didn’t even know there was such a thing.

14

Since I started working here I’ve been stunned by the level of detail some risk covers go to.

15

Thought I would chip in having seen this thread and having been involved in cyber liability insurance for the past ten years or so…

Cyber liability insurance (at least in insurance terms) is pretty new. It’s been generally available on the market for about 15 years, but in the last two or three years has become much more mainstream.

It is very distinct from public liability insurance (which is just designed to cover losses for bodily injury or tangible property damage) and different to professional liability insurance (although there are a few more overlaps / grey areas here).

In the US the risk profile is very different to the UK. The main driver is the cost of making a notification in the event of a privacy breach, which is a legal requirement in most US states (and will be in Europe within the next few years). The cost of this is phenomenal. On average it costs about $60 per notification (legal costs, postage and stationery, credit monitoring, call centre operators, etc)…and with many breaches running into 1m plus records you can see how this adds up. On top of this it protects you against the inevitable lawsuits that result when you lose people’s personal information.

Interestingly Sony have estimate their loss (before legal costs) to be $130m. This comes from the cost of forensic investigations, business interruption, system damage and restoration, and breach notification. Most industry commentators expect this loss to rise to over $1bn when you take into account the inevitable multi-jurisdictional regulatory investigations and lawsuit defences. All of these items are covered under a standard cyber policy. Very few, if any of these losses will be covered by either their PI or public liability insurance.

In the UK for your average SME the risk profile is very different. There is no mandatory requirement for notification, there is little propensity for class action lawsuits, and the data protection fines are relatively small (max £500k). However, all this changes when you introduce commercial contracts where you are storing commercially confidential data on behalf of third parties where you will inevitably have to provide an unlimited contractual indemnity for any breach of confidential data.

On top of this most new cyber policies also protect against IP infringement and defamation risks arising from the use of social media (rather than the delivery of professional services, which is what is covered under professional indemnity insurance).

Pricing is pretty low in the UK now and cover is purchased at a corporate rather than individual level. In the US a CPA firm could expect to pay something like $2k for a $1m limit if fees are under circa $3m.

Hope this helps.

1 Spice up