Hunton Retail Law Resource

Providers of technology products and services are consistently innovating to grow their offerings to retailers. These new products and services present significant opportunity for retailers to more effectively reach customers, generate sales and grow revenue. But while these new offerings present a great tool to grow sales in this challenging market, they also can present significant cybersecurity risks.

To manage risk, technology transactions have long prescribed contractual insurance requirements for providers, supplementing security-related warranties and indemnities and backstopping limitations on liability. Unlike traditional insurance coverages (e.g., errors and omissions, commercial general liability, automotive) that employ industry standard policy language, cybersecurity policy language has not yet evolved to an industry standard. This will likely be the case until the cybersecurity market matures and insurance providers become comfortable with uniform cybersecurity policy language.

In light of the evolving cybersecurity market, consider the following five tips when thinking about what cybersecurity insurance requirements you need in your technology transactions.

Rely first on effective prevention.

Both parties are better off avoiding an incident than relying on insurance to cover losses. Critically evaluate the security infrastructure offered by your vendor and the security assurances they can provide during the life of the deal. It may not make sense to share some kinds of higher-risk data with vendors who don’t measure up. Where information must be shared, ensure that comprehensive requirements for encryption, access to information, password management, handling of sensitive information and physical and network security are clearly laid out in your contract.

Require cybersecurity insurance.

For most companies that possess, share or generate electronically stored information, whether a cyber breach will occur is not a matter of “if,” but “when.” It is prudent, therefore, to include a provision in your insurance requirements specifically addressing such an eventuality. The provision should address, at a minimum:

• the provider’s requirement to obtain cybersecurity insurance (including coverage amounts). For example: “Cyber liability insurance, with limits not less than ____ per incident, occurrence, event or claim, ____ aggregate”; and

• the specific cyber risks that are to be covered (e.g., breach response costs, regulatory fines and penalties, crisis management costs).

Additionally, companies should consider whether to be named as an “additional insured” – realizing that this may be of limited value if there is a major breach affecting many customers who are also insureds. It may also require further language excepting any otherwise preclusive “insured versus insured” exclusions such that the additional insured is not precluded from itself claiming against the Named Insured.

Understand the cybersecurity risk your transaction presents to your organization and be realistic in the amount of coverage you ask providers to carry.

Spend time thinking about the specific risk posed by a transaction to your organization’s risk profile. Ask:

• Will the provider handle personal information?
• What will the provider have access to on your network?
• How is the relevant information protected?
• What is the realistic breadth of any potential data breach (e.g., how many records could get out)?

Your risk management team can assess the appropriate levels of coverage based on the risk posed by the transaction and the levels of coverage typically purchased by similarly sized providers. In general, small and medium sized providers typically will have policy limits of $2MM to $4MM. Large providers likely have much greater coverage.

Ask for a copy of the policy, do not rely solely on the certificate of insurance.

Ask your provider to provide complete, certified copies of its cybersecurity insurance policy, including all endorsements. Because there is no industry standard cybersecurity language, it is not enough to only review the certificate of insurance, which is not binding on the insurer, in any event. Reviewing the policy language is important to validate that the policy was actually issued, that it covers the risks identified in your contract, that no broad exclusions apply and that no material gaps exist between the cybersecurity coverage afforded and any ancillary coverages that might exist for non-cyber risks (e.g., commercial crime, general liability, etc.). Our clients often ask us to conduct such reviews to help them assess the scope of coverage offered by providers.

Consider purchasing an “excess” cybersecurity policy.

“Excess” cybersecurity insurance provides additional protection for retailers. Excess cybersecurity insurance applies only in excess of a provider’s cybersecurity policy. The provider’s policy acts as the primary insurance and the excess policy provides an additional limit of insurance. Your risk management team and insurance broker can help determine if an excess cybersecurity insurance policy makes sense for your organization. Having your own policy may be the best protection, since, in a major breach, you may be forced to share with many other claimants a relatively small pay-out under a vendor’s policy.