Insurability

One efficient and top of the list means to mitigate the costs and risks inherent to cyber-attacks and data breaches is the purchase of cyber-insurance because it allows an organization to transfer potential (and substantial) financial risks to an insurance mechanism.

Yet, eligibility for cyber-insurance should not be taken for granted. First, cyber-incident/data-breach insurance is an emerging and fast-evolving market; the application forms that used to take a few minutes to complete now take a few hours and include several technical questions. Second, an organization must meet certain standards to be able to qualify and to benefit from competitive insurance premiums, and this includes necessarily compliance. As a result, the answers an organization provides to an insurer represent a critical step of the process considering that inaccurate or misleading answers could result in denial of coverage.

Moreover, organizations should be very cautious in purchasing cyber-insurance as not all insurance products may be pertinent or appropriate to meet their needs. Depending upon the nature, volume and sensitivity of the data and the probable risks to anticipate, the needs must be carefully evaluated as well as the coverage offered since the costs of a cyber-incident (especially when it involves personal identifiable information) may easily soar into the hundreds of thousands of dollars within a few days.... For example, it might be worthwhile to consider whether your organization needs coverage for ransomware, forensic investigations, lawsuits, data breach notification expenses, regulatory investigations, lawyers and consultants, remedial measures, third-party liability, etc.

In addition, it is important to validate the suitability of several key aspects of cyber-insurance coverage such as the conditions to be met to trigger the policy, the elements that are excluded from the policy, the types of data covered, what response costs and services are covered in the event of a breach, whether it is possible to select vendors and/or counsel, etc.

Given the criticality of cyber-insurance as a means to mitigate risks, DUBE LATREILLE will provide peace of mind to organizations by assisting them in the process of selecting the appropriate cyber-insurance products.