As traditional media companiesadapt and attempt to thrive within the rapidly changing digitalspace, they are discovering—sometimes painfully—that theirinsurance coverage also must evolve.

Case in point: Media companies are no longer just creatingcontent—they are increasingly selling it directly to consumers viaWeb sites and mobile apps. This practice creates the possibilityfor security breaches that compromise consumers’ credit-cardnumbers and other personal information.

Addressing such exposures, the Securities and ExchangeCommission (SEC) issued guidance on Oct. 13, 2011 stating thatpublicly traded companies must disclose which aspects of theiroperations “give rise to material cyber-security risks”—anddisclose any relevant insurance coverage they hold to address theserisks.

“It’s the most dramatic change that’s ever happened since CyberLiability coverage was introduced,” observes Kevin Kalinich, globalpractice leader for Cyber Liability with Aon Corp. “It doesn’tmandate that insureds buy coverage, but it tells them they need todisclose to shareholders, under SEC guidance, the ways theymitigate cyber exposures.”

And while this guidance applies only to publicly held companies,Kalinich adds, it’s likely that plaintiffs’ attorneys will look tosuch disclosures in helping set a cyber-security threshold forother companies.

Will the SEC’s guidance result in more companies, both publicand private, media and otherwise, buying a dedicated cyber-riskpolicy? “I’m not sure we’re seeing this yet translate intosignificant activity toward the product,” observes Tim Francis,enterprise cyber-insurance lead for Travelers Insurance, whichbegan offering a dedicated cyber policy for non-technologybusinesses last summer. “But many companies were looking at theproduct even before the SEC guidelines came out.”

Philadelphia Insurance says it has seen “pretty substantialgrowth” in the number of companies shopping since it began offeringits own dedicated Cyber Liability product in 2010, says TomHerendeen, vice president of management and professionalliability.

A big reason why companies are looking, Herendeen and othersagree, is that the cost of handling a data breach continues torise: an average of $214 per record in 2010, up 5 percent from theyear before, according to a study conducted by the PonemonInstitute. The bulk of this per-record cost comes from expensesassociated with notifying customers of breaches and in providingfollow-up services such as credit monitoring.

But buying a dedicated cyber policy is not always necessary.Many carriers bundle aspects of the coverage in with their standardbusiness policies. Making the decision to purchase separatepolicies comes down to factors such as the number and sensitivityof data records held, as well as overall coverage limits andsub-limits in areas such as notification costs.

For media companies, whose insurance concerns also typicallyencompass libel and copyright infringement, striking the rightbalance in covering both these core business exposures and cybersecurity can be a challenge.

“The issue of convergence and getting everything under one roofis a big one,” observes Rennie Muzii, managing director of thefinancial and professional group at Marsh Inc. “If you blow outyour coverage limit on a garden-variety media claim, you’ve gotnothing left for cyber, and vice versa.”

Cyber Liability products are still relatively new, Muziicontinues, and carriers continue to innovate with this coverageline. Some are offering turnkey cyber solutions that specify whichdata forensics and consumer-notification firms their insureds mustuse.

Other companies are setting coverage limits tied to the numberof records compromised as opposed to an overall cash limit, whichMuzii says can be a significant benefit to the insured. The size ofa company and its revenue, and whether or not its media assets arehandled separately from the parent organization, also play intowhich policy makes most sense.