Insights

Lost income and expenses related to business interruptions account for some of the most significant damages incurred during an intrusion. In fact, the damages can be so significant that one of the primary considerations organizations make when deciding whether or not to pay a ransom demand, is the potential lost income that would result from refusing such a payment. While almost all cyber policies provide coverage for breach related business income losses, there are some critical differences among carriers’ coverage triggers and the damages they insure against.

Broad indemnification agreements are a staple protection for corporate officers of both public and private companies alike. Unfortunately, corporate indemnification isn’t a guarantee. There are a number of situations in which such protections may become unavailable or indemnification may be wrongfully denied by the company. In such situations, the only source of funds available to executives, are those provided by a the Side A insuring agreement of a D&O policy which provides coverage for non-indemnifiable claims.

Private companies face many of the same risks as public companies; litigation from investors, derivative suits, regulatory actions, and bankruptcies, etc. The only real difference are the applicable laws and the nuances of the allegations. There are also some key differences among their D&O insurance programs as well. Generally speaking, public company D&O policies are more expensive per limit and contain higher retentions, which can easily exceed 1 Mill. The towers themselves are often a bit different.

Sophisticated directors and officers insurance programs are generally built in layers, with a full ABC underlying policy, topped with excess limits and/or a Side A DIC (difference in condition) cap. In contrast to the full D&O policy which provides coverage for the company’s balance sheet, Side A DIC D&O policies provide broader coverage solely for non-indemnifiable claims against insured persons.

Despite all the nuances and intricacies of D&O insurance, nothing generates more questions than the simple ABC insuring agreements. We’ve previously provided a general D&O guide here, but in the interest of any lingering confusion, here’s an over-simplified example of the ABCs, in plain English, that everyone can easily understand.

Digital accessibility lawsuits, once perceived as litigation trend that would quickly die down, have now become commonplace, creating a headache for many companies. These lawsuits allege that a company’s website, mobile app or its digital features violate the American’s with Disability act by denying access to those with visual or hearing impairment or other disabilities. Many of these suits arise from very simple formatting and programming errors such as:
 

ESG initiatives are creating emerging exposures for public companies at a rapid rate. Greenwashing claims, emission litigation, cyber/privacy failures, and lawsuits related to diversity and inclusion failures are creating disclosure challenges and fueling litigation. Additionally, the SEC’s newly developed climate and ESG task force, and newly proposed cybersecurity rules signal tighter ESG oversight resulting in an increased potential for regulatory enforcement.

Securing executive liability or cyber insurance may seem like a straight forward process, however the emergence of online service shopping has created considerable confusion and actually become a risk to executives seeking coverage. As organizations delegate insurance inquiries to management and more insurance companies aim for the “quick quote” model, it’s becoming increasingly common for organizations to pursue their coverage needs by saturating the most convenient platforms such as direct quote platforms, online brokerages and insure-tech portals.

This is the part one of our four part Ransomware Guide. Parts 2-4 can be located below.

Part 2: The Most Effective Ransomware Protection According To The Experts

Part 3: Ransomware Insurance: What to Look For

Given the recent surge of ransomware attacks and escalating conflict with Russia, assessing a cyber insurance policy’s war/terrorism exclusion has never been more important. The cyber war exclusion, used by insurers to insulate against catastrophic risk, has been a considerable topic of discussion due to its overly broad language and potential for mis-application. Nearly all cyber attacks are in essence, invasions, involving foreign enemies, many of which do inflict terror – this highlights the obvious issue at hand.