Insurance in the Cloud

1. Insurance in the Cloud Ben Hunter, Canadian Underwriting Specialist Technology Insurance Specialty Chubb Insurance Company of Canada

2. DISCLAIMER This document is advisory in nature. The views, information and content expressed herein are those of the authors and does not necessarily represent the views of any of the insurers of The Chubb Group of Insurance Companies. Chubb did not participate in and takes no position on the nature, quality or accuracy of such content. The information provided should not be relied on as legal advice or a definitive statement of the law in any jurisdiction. For such advice, an applicant, insured, listener or reader should consult their own legal counsel

3. Agenda • Difficulty Insuring Cloud Exposures • Insurance Coverage Available • E&O Insurance • Technology Risk Spectrum • Underwriting Considerations • ‘I’ve been hacked!’ • Q&A

4. Difficulty in Insuring The Cloud • How do you insure the data? • Data is not at rest in one location; schedule on property policy? • Data is in the care, custody or control of a third party • Business Income coverage typically excludes on line access providers • Carriers may provide sublimits for loss of utilities type contingent business income coverage • Errors and Omissions • Review definition of ‘your product’ and ‘your service’ • Ensure cloud computing activities not excluded • Confirm no exclusion for loss of internet service

5. Insurance Coverage Property • Contingent Business income • Check exclusions. Must be a physical damage trigger • Usually sublimited. May purchase additional limits • Electronic Data • May need to schedule on an ‘any other location’ basis • Impairment of Computer Services • Business income and electronic data recovery costs due to an attack to the insured’s network General Liability • Privacy • Has migrated to the E&O policy Errors and Omissions • Originally covered financial loss due to a product defect or service deficiency • Now expanded into the world of intellectual property, privacy, and ‘cyber’ coverage

6. Technology Insurance Solutions • Errors & Omissions Third Party • Product and Service Financial Injury • Privacy & Network Security • Intellectual Property (patent excluded) • Media First Party • Privacy Remediation Expense • Insured’s reasonable and necessary expenses incurred after a data breach: • Public Relations • Notification • Forensics • Credit monitoring

7. Technology Risk Spectrum CUSTOMERS CONSUMER & REGULATORY RESPONSE ProductDefects Breach ofContact COMPETITORS & IP RIGHTS Failure toPerform Services Fines andPenalties PrivacyRemediationExpenses IP / InjunctiveRelief Disclosure, Publication or Use PII/BCI Media /Libel /Slander Use of technology is ubiquitous, exposures are pervasive

8. What do Underwriters need to know? • Contracts • Operational exposures (human resources, network and physical security management) • Cloud Resiliency and Redundancy • Corporate governance in respect of IT and Privacy • Content, Transactions & e-commerce exposures • Risk Management and Loss Control attitude • Ability to recover from a loss • Claims History

9. ‘I’ve been hacked!’ • Contact your Insurance Broker and/or Carrier • Contact Legal Counsel who specializes in data breaches • Engage third party experts to assist with investigation and remediation • Offer customers credit monitoring services • Engage a skilled public relation specialist • Contact Law enforcement, if applicable • Contact a Breach Coach

10. Breach Coach • A Breach Coach can help you determine: • Is a computer forensics investigation needed? • Are breach notifications required? • What is the potential for regulatory fines or penalties? • What is the potential for legal action? • What are your next steps?

11. Thanks for your time