Cyber insurance is a hot topic among many but unfortunately, far too many companies are not getting any cyber coverage or are not getting the coverage they need for their risks.
This week I had the privilege of moderating a panel discussion targeted for in-house counsel that was titled “Making Sure It’s Covered: Cyber Insurance — What are the Practical Things In-House and Outside Attorneys Need to Know?”
For this discussion we had these amazing panelists sharing their unique industry expertise:
Our objective was to give the attendees a broad understanding of cyber insurance so they know why it is important to have cyber coverage (and dispel some of the “fake news” about cyber insurance), how to get the right coverage, and how to properly use their insurance solutions before and after they have an incident. We covered these main topics:
Why cyber insurance is critical.
Overview of the insurance process, who the players are such as brokers, underwriters, and claims, and how they all work together in the overall insurance ecosystem.
Getting the right coverage.
The claims process.
Understanding how the panel of approved vendors works and why it is important to understand that before you have an incident.
In a recent Wall Street Journal article, The Case for Protecting Small Firms from Cyber Lawsuits, the authors argue that, because smaller companies lack the resources of larger companies when it comes to protecting data, smaller companies should have legal protections to exempt them from facing the consequences of these laws.
While it seems this argument is based on a fundamental misunderstanding of the purpose of these laws, it does offer some productive suggestions and I found it interesting for another reason. The reasons the authors gave for arguing that smaller companies should be exempted from the laws are some of the same reasons I give to smaller companies when I explain why it is so important that they have appropriate cyber insurance coverage:
Small businesses have the same obligations to protect data that larger companies have.
Breach notification laws may have penalties of a certain cost per record breached, regardless of fault.
Breach notification laws may require notifying those individuals whose data was breached, that their data has been breached.
Breach notification laws may require providing identity theft protection services to the individuals whose data was breached.
Individuals whose data was breached may sue and seek recovery of damages and legal fees.
I have been practicing in the cybersecurity and data privacy areas of law for nearly two decades and have served as breach guide to hundreds of companies — one of the biggest lessons that I have learned in all of these years is that in many cases, it is not the initial incident that causes most of the harm, it is the failure to properly respond to the initial incident after learning about it that causes it to escalate.
Incident response is expensive. The legal fees, the fees for security services, forensic services, remediation, public relations, and identity theft protection, notification of consumers, and reporting to regulatory agencies — all of these things are very expensive but they are mandatory to properly respond to an incident, in most cases. When a business does not have the resources to pay these expenses, it is not able to properly respond to an incident and that is what can be most devastating of all for small and midsize businesses. That is why it is so critical that small and midsize businesses have appropriate cyber insurance coverage to step in and provide them with the resources needed to help manage and properly respond to such incidents.