Below are a few tips that corporate policyholders should consider in analyzing their coverage:

Ensure that exclusions for bodily injury or invasion of privacy are carved back so that they do not apply to otherwise covered claims arising out of a privacy breach.
Consider optional coverages, such as reputation loss or public relations and crisis management coverage, to mitigate the fallout from any cyberattack.
Review terrorism and war exclusions to ensure they cannot be used to deny coverage for common cyberattacks and that they contain exceptions for cyberterrorism.
Ensure contractual liability exclusions contain carve-outs for liability that would exist absent contract and otherwise covered cyber incidents. Many companies are required to make contractual representations or warranties on cyber security programs or standards as part of contacts with clients and vendors and these representations may be alleged in a suit following a cyberattack. Consumers also often assert quasi-contract theories of liability about safeguarding data. If your business is subject to payment card industry data security standards, ensure that the contractual liability exclusion contains a carve-out for payment card claims, fines, and penalties. All of these claims should be covered, but can fall into gaps or exclusions in policies where policyholders have not worked to ensure coverage.
Purchase express social engineering coverage on your company's crime insurance policy to cover losses arising from social engineering schemes and business email compromises that lead to fraudulent transfers.

The coverage gaps above are just a few traps for the unwary insured. Companies are best served by working with experienced insurance coverage counsel and insurance brokers to analyze coverage and fill gaps so as to maximize coverage for the company, board, and executives in the event of a cyber incident.

Special Reports /

Scrutiny ratchets up of companies' cyber insurance, practices

Related Stories

Recommended For You