As a contractor, your job is to build or repair things. You are probably not storing credit card information for thousands of clients and you may have information on only one hundred current and past employees. Why should you worry about cyber risk?
To help you answer the question as to whether you need to consider cyber/privacy liability insurance, please answer the following questions:
- Do you use tablets, smart phones or laptops to perform your daily work in the office or field?
- Do any of these devices contain client information?
- Do you perform service work for any commercial clients?
- Do you ever take client credit card information to accept payment?
- Are you a small or medium sized business without a full-time IT Security expert monitoring your servers, software, and website?
- Do you store information electronically regarding your employees or customers, including address, DOB, and/or Social Security number?
If you answered yes to one or more of the above questions, you have a cyber/privacy exposure. This does not mean you need to purchase coverage, but at a minimum you should explore the best way to manage the risk.
Let’s start with the cost of a security breach. According to the 2015 Ponemon Cost of a Data Breach study, the average cost of a breach is $154 per record. This cost includes forensic IT, hotline support & credit monitoring, in-house investigations, and loss of business due to client turnover and fewer new customers. In the example above with a hundred total employees, the cost would be approximately $15,400. Add in personal information on 300 clients and the cost quickly jumps to more than $61,000. You can see how quickly a data breach claim could grow exponentially for a Contractor.
As scary as a data breach would be, Hausmann-Johnson Insurance believes a Contractor's biggest exposure might actually be a Business Interruption loss due to extortion and/or a denial-of-service attack. According to a 2014 Kaspersky Lab Global IT Security Risk Survey, Distributed Denial of Service Attacks (DDoS) cost small and medium sized businesses around $52,000 per attack. The cost includes hiring IT consultants, loss of access to critical information, and reactive spending on increased security software and infrastructure. The basis for our assertion that DDoS might be your biggest exposure comes from the same Kaspersky study where the Construction/Engineering sector ranks as the fourth most targeted sector.
Next, let’s take a look at a number of first-party exposures that can be covered by a cyber/privacy policy:
- Employee/Customer credit monitoring
- Notification costs for employees/customers or other affected parties
- Business interruption costs
- And, most importantly, access to Crisis Management Experts and Public Relations Firms that deal with this type of claim on a regular basis
In addition, here are some third-party exposures that can also be covered by a cyber/privacy policy:
- Lawyers’ fees, including access to attorneys with expertise in cyber/privacy claims
- Settlements, awards, or judgements levied against you as a result of a data breach
All cyber/privacy policies are not created equal. Hausmann-Johnson would welcome the opportunity to help you assess your cyber exposure and determine the best way to manage this evolving and growing risk.
P.S. To learn even more about cyber liabilty risks, watch our On-Demand Webinar: Your Company's Data Breach Risk, presented by Scott Hausmann.
COMMENTS