When a data breach or other cyber event occurs, the damages can be significant, often resulting in lawsuits, fines and serious financial losses. What’s more, cyber exposures impact businesses of all kinds, regardless of their size, area of focus, or status as a private or public entity.
In order for organizations to truly protect themselves from cyber risks, corporate boards must play an active role. Not only does involvement from leadership improve cyber security, it can also reduce liability for board members.
To help oversee their organization’s cyber risk management, boards should ask the following questions:
Does the organization utilize technology to prevent data breaches?
Every company must have robust cyber security tools and anti-virus systems in place. These systems act as a first line of defense for detecting and preventing potentially debilitating breaches.
While it may sound obvious, many organizations fail to take cyber threats seriously and implement even the simplest protections. Boards can help highlight the importance of cyber security, ensuring that basic, preventive measures are in place.
These preventive measures must be reviewed on a regular basis, as cyber threats can evolve quickly. Boards should ensure that the management team reviews company technology at least annually, ensuring that cyber security tools are up to date and effective.
Has the board or the company’s management team identified a senior member to be responsible for organizational cyber security preparedness?
Organizations that fail to create cyber-specific leadership roles could end up paying more for a data breach than organizations that do. This is because, in the event of a cyber incident, a fast response and clear guidance is needed to contain a breach and limit damages.
When establishing a chief information security officer or similar cyber leadership role, boards need to be involved in the process. Cyber leaders should have a good mix of technical and business experience. This individual should also be able to explain cyber risks and mitigation tactics at a high level so they are easy to understand for those who are not well-versed in technical terminology.
It should be noted that hiring a chief information security officer or creating a new cyber leadership role is not practical for every organization. In these instances, organizations should identify a qualified, in-house team member and roll cyber security responsibilities into their current job requirements. At a minimum, boards need to ensure that their company has a go-to resource for managing cyber security.
Does the organization have a comprehensive cyber security program? Does it include specific policies and procedures?
It is essential for companies to create comprehensive data privacy and cyber security programs. These programs help organizations build a framework for detecting threats, remain informed on emerging risks and establish a cyber response plan.
Corporate boards should ensure that cyber security programs align with industry standards. These programs should be audited on a regular basis to ensure effectiveness and internal compliance.
Does the organization have a breach response plan in place?
Even the most secure organizations can be impacted by a data breach. What’s more, it can often take days or even months for a company to notice its data has been compromised.
While cyber security programs help secure an organization’s digital assets, breach response plans provide clear steps for companies to follow when a cyber event occurs. Breach response plans allow organizations to notify impacted customers and partners quickly and efficiently, limiting financial and reputational damage.
Board members should ensure that crisis management and breach response plans are documented. Specific actions noted in breach response plans should also be rehearsed through simulations and team interactions to evaluate effectiveness.
In addition, response plans should clearly identify key individuals and their responsibilities. This ensures that there is no confusion in the event of a breach and your organization’s response plan runs as smoothly as possible.
Has the organization discussed and formalized a cyber risk budget? How engaged is the board in terms of providing guidance related to cyber exposures?
Both overpaying and underpaying for cyber security services can negatively affect an organization. Creating a budget based on informed decisions and research helps companies invest in the right tools.
Boards can help oversee investments and ensure that they are directed toward baseline security controls that address common threats. Boards, with guidance from the chief security officer or a similar cyber leader, should also prioritize funding. That way, an organization’s most vulnerable and important assets are protected.
Has the management team provided adequate employee training to ensure sensitive data is handled correctly?
While employees can be a company’s greatest asset, they also represent one of their biggest cyber liabilities. This is because hackers commonly exploit employees through spear phishing and similar scams. When this happens, employees can unknowingly give criminals access to their employer’s entire system.
In order to ensure data security, organizations must provide thorough employee training. Boards can help oversee this process and instruct management to make training programs meaningful and based on more than just written policies.
In addition, boards should see to it that education programs are properly designed and foster a culture of cyber security awareness.
Has management taken the appropriate steps to reduce cyber risks when working with third parties?
Working alongside third-party vendors is common for many businesses. However, whenever an organization entrusts its data to an outside source, there’s a chance that it could be compromised.
Boards can help ensure that vendors and other partners are aware of their organization’s cyber security expectations. Boards should work with the company’s management team to draw up a standard third-party agreement that identifies how the vendor will protect sensitive data, whether or not the vendor will subcontract any services and how it intends to inform the organization if data is compromised.
Does the organization have a system in place for staying current on cyber trends, news, and federal, state, industry and international data security regulations?
Cyber-related legislation can change with little warning, often having a sprawling impact on the way organizations do business. If organizations do not keep up with federal, state, industry and international data security regulations, they could face serious fines or other penalties.
Boards should ensure that the chief information security officer or similar leader is aware of his or her role in upholding cyber compliance. In addition, boards should ensure that there is a system in place for identifying, evaluating and implementing compliance-related legislation.
Additionally, boards should constantly seek opportunities to bring expert perspectives into boardroom discussions. Often, authorities from government, law enforcement and cyber security agencies can provide invaluable advice. Building a relationship with these types of entities can help organizations evaluate their cyber strengths, weaknesses and critical needs.
Has the organization conducted a thorough risk assessment? Has the organization purchased or considered purchasing cyber liability insurance?
Cyber liability insurance is specifically designed to address the risks that come with using modern technology—risks that other types of business liability coverage simply won’t cover.
The level of coverage your business needs is based on your individual operations and can vary depending on your range of exposure. As such, boards, alongside the company’s management team, need to conduct a cyber risk assessment and identify potential gaps. From there, organizations can work with their insurance broker to customize a policy that meets their specific needs.
Asking thoughtful questions can help boards better understand the strategies management uses to prevent, detect and respond to data breaches. When it comes to cyber threats, organizations need to be diligent and thorough in their risk prevention tactics, and boards can help move the cyber conversation in the right direction.
Cyber exposures impact organizations from top to bottom, and all team members play a role in maintaining a secure environment. However, managing personnel and technology can be a challenge, particularly for organizations that don’t know where to start.
That’s where Scurich Insurance can help. Contact us today to learn more about cyber risk mitigation strategies you can implement today to secure your business.
Serving alcohol is a common practice for restaurants, bars, catering companies, entertainment venues and similar establishments. While providing a wide array of beverage options is important, serving alcohol in particular can create a variety of risks for business owners.
For instance, if a patron of your business becomes intoxicated and injures a third party or causes property damage, you could be held liable for the damages. In order to protect your business from serious financial and reputational losses, it’s important to consider purchasing liquor liability insurance.
What is Liquor Liability?
The term liquor liability refers to an organization’s legal and financial responsibility for the actions of individuals who consume alcohol at their establishment. Under liquor liability laws, a business can be found liable for both the bodily injury and property damage caused by a person they improperly served alcohol to.
What is Liquor Liability Insurance?
Liquor liability insurance is designed to protect any business that sells or serves alcoholic beverages. Specifically, this type of insurance covers damages that result from things like fights, careless behavior or automobile accidents caused by individuals who have consumed alcohol.
Liquor liability is important, as it protects you should your clients or patrons sue your business for damages related to their intoxication—something a general liability policy won’t cover.
Most businesses carry a general liability policy, which covers claims against your business for bodily injury, property damage or personal injury. While these policies often include host liquor liability coverage, they only provide protection related to the incidental service of alcohol. While host liquor liability may protect you if you are simply serving alcohol at a company party, it does not offer the coverage you need if you sell alcohol as part of your business.
What’s more, the majority of states require establishments that serve, sell or assist in the purchase of alcohol to carry liquor liability insurance. As such, it’s important to know what to look for in a policy.
What Should My Policy Account For?
When it comes to protecting your business from any kind of liability, it’s critical that you account for common risks. In order to secure the right level of coverage, keep in mind the following policy enhancements when shopping for liquor liability insurance:
Assault and battery coverage.
When alcohol is involved, fights are a common risk. However, many liquor liability policies exclude coverage for assault and battery. Therefore, it’s important to ensure you account for this protection when building your policy. It should be noted that assault and battery coverage can also be extended to include specific incidents such as sexual assault, stabbings and shootings.
Legal fees from liquor-related claims can easily exceed tens of thousands of dollars. Be sure that your policy accounts for defense costs outside of the policy limit. Otherwise, legal expenses could quickly exhaust your policy limit, leaving little to no insurance to pay for any damages.
Even if you forbid your employees to drink on the job, there’s a chance that they may disregard your instruction. Look for a policy that will cover your employees as patrons to better protect your business from liquor-related incidents.
In the event of a lawsuit, claimants may allege they were injured in nonphysical ways. In these instances, patrons could sue you for stress, mental anguish or psychological injury. Ensure that your policy accounts for these types of injuries.
It should be noted that liquor liability insurance won’t cover claims that arise from the sale of alcohol to minors or similar illegal transactions. Be sure your employees are instructed to verify patrons are of legal drinking age.
What Determines Pricing?
The underwriting process for liquor liability insurance can differ depending on the type of business you conduct. In general, the following four factors determine the rating and pricing of coverage:
Type of venue. When examining a business’s risk, underwriters look to identify the primary purpose of a venue. If you own a restaurant, the primary purpose of your venue is to serve food, so you are generally considered to have less risk than a nightclub or tavern.
Location of the venue.
Liquor laws can vary drastically depending on the jurisdiction. Each state has its own scoring system based on the nature of local dram shop laws. Dram shop laws impose certain liability standards on area venues that serve alcohol. Because the strictness of these laws may change from location to location, where you operate your business can have a major impact on how your liquor liability insurance is priced.
Percentage of liquor sales.
As a general rule, the more alcohol sales you make, the higher your premiums will be. This factor tends to have more of an impact on pricing than venue type, as a restaurant that has a high percentage of alcohol sales may be priced similar to a bar.
Individual traits of the risk. There are a number of miscellaneous variables underwriters will take into consideration when pricing out policies, including the following:
- Types of entertainment offered
- Experience level of management
- Formal loss control measures
- Security measures and procedures for dealing with intoxicated patrons
Serve Your Patrons Responsibly
When serving liquor, the best way to protect your business from potential claims is through proper risk management and liquor liability insurance. These policies can be complex, and it’s important to discuss the nature of your operations with a qualified insurance broker. Contact Scurich Insurance today to learn more.
Contractors, no matter what industry they work in, face environmental risks stemming from operations on a daily basis. For most contractors, a single pollution incident or loss can seriously damage their reputation, operations and even their balance sheet. Making matters worse, pollution incidents can be sudden or occur gradually over time.
While many contractors assume that environmental claims will be covered under their commercial general liability (CGL) policy, the unfortunate reality is that most CGLs contain pollution exclusions that leave contractors uninsured in the event of a pollution incident.
Thankfully, contractors are increasingly turning to contractors pollution liability (CPL) insurance to ensure they have the right coverage in place to remain secure and profitable.
CPL Coverage Basics
CPL policies provide contractor-based insurance for third-party coverage for bodily injury, property damage, defense, and cleanup as a result of sudden and gradual pollution incidents arising from contracting operations performed by or on behalf of the contractor. CPL insurance is intended to provide coverage to all types of contracting operations, including contractors who are involved in building construction and environmental firms that remediate polluted sites.
CPL policies are offered on either a claims-made or occurrence basis. What’s more, CPL policies are nonstandard, meaning each policy is different and can be modified to cover the various needs of the contractor purchasing the policy. Policies can be offered on a project or blanket program basis.
In some instances, CPL policies can also be used to cover losses from civil fines, penalties and punitive damages.
Covered Pollution Incidents
Contractors should keep in mind that CPL insurance policies differ in regard to the types of pollution incidents that are covered. Two important considerations when evaluating CPL insurance policies are:
- Whether or not the policy will respond to gradual releases of pollutants, as opposed to sudden and accidental releases
- The types of substances that are considered “pollutants” under the terms of the policy
Generally, policies that cover both gradual and sudden releases of pollutants provide contractors with a broader scope of coverage. In addition, policies that provide a broad definition of pollutants are considered superior to those that contain a narrow definition. Accordingly, it is important that contractors work with their broker to find a CPL policy that is tailored to their needs.
CGL Pollution Exclusions
A primary reason why contractors obtain a CPL policy is due to the various pollution exclusions contained in most CGL policies. The pollution exclusions found in most CGL policies take one of two forms, either “absolute” or “total.”
CGL policies with an absolute pollution exclusion remove coverage for most pollution events that would occur in the course of an insured’s business operations. However, despite its name, an absolute pollution exclusion may preserve coverage for certain incidental pollution damages, products and completed operations liability, and certain off-premises work.
However, more commonly, CGL policies include a more restrictive “total pollution exclusion.” This type of exclusion effectively removes coverage for any event the insurer characterizes as a pollution incident.
Contractual requirements serve as another motivating factor that lead many contractors to obtain a CPL policy. In many instances, project owners and general contractors will require contractors to obtain pollution insurance that meets certain, predetermined standards.
From this perspective, having a CPL insurance policy in place can serve as an upfront sales tool during the bidding process that enables contractors to qualify for opportunities when such coverage is required.
Finding the Right Policy
Regardless of specialty, all contractors should be mindful of the pollution risks associated with their work. A CPL insurance policy can provide much-needed security in the event of a pollution incident, even in the most unlikely of circumstances.
Let Scurich Insurance work with your organization to find the CPL coverage that is right for you.