Cybersecurity Insurance

• Do you have a Chief Privacy Officer, or Chief Information Officer who has responsibility for meeting worldwide obligations under privacy and data protection laws?
• Do you have a written information security plan and privacy policy which outlines the company policy and procedures for the secure care, handling, storage and access of private, sensitive or confidential information?
• Do these policies and procedures comply with laws governing the handling and/or disclosure of such information?
• What is the company policy and procedures for the secure care, handling, storage and access of private, sensitive or confidential information?

• Do you perform security audits to ensure compliance with the security policy?
  • Who performs the audits?
  • Frequency of audits?
  • Are security recommendations always followed? 
• Do you perform privacy audits to ensure compliance with their privacy policy?
  • Who performs the audits?
  • Frequency of audits?
  • Are security recommendations always followed?

Are all employees trained for your security privacy policies, do you have documentation of training?

• Do you employ electronic information gathering techniques (spyware, adware, cookies etc.)?
• Do you collect, process or maintain personal information as part of business activities including collecting over a website?
• Does your website display a privacy disclosure statement?
• What type of private and sensitive information do you receive, store, use or process:
  • financial account payment information
  • credit card or debit account number
  • chequing, banking or automated clearing house information
  • financial data 
• Government issued identification information
• Name, address, contact information
• Medical or health related information
• Information on children who use your website
  • are there controls in place to obtain parental permission
• trade secrets or intellectual property information
• third party corporate information
• Provide the number of records maintained by the company containing the information noted above 
• What percentage of the above live in the United States?
• Any personal or private information gathered from customers or users, sold, disclosed or distributed to any third party?
  • If yes, is prior permission obtained from the customers or clients?
• Is employee access to personally identifiable or sensitive information:
  • on a business need to know basis? 
  • terminated immediately when an employee exits the company?
• Are third party vendors provided private or sensitive information?
  • If yes, is there a review completed of the third party vendor’s information security plan?

• Describe security of the business’s premises and facilities
• Describe security measures used to prevent access to your systems or servers (both internally and externally)
• Describe security measures used to protect confidentiality and integrity of your company’s data or data which is entrusted to you
• Describe the technology used by the company for the following:
  • Encryption
  • Authentication
  • Anti-Virus
  • Firewall

• If you accepts credit or payment card transactions for the payment of goods or services, are you compliant with applicable data transaction compliance standards (i.e. Payment Card Industry Data Security Standard compliance)?

• Do you have access control procedures and hard drive encryption to prevent unauthorized exposure of data on all laptops, PDAs, smartphones (e.g. BlackBerry) and home-based personal computers?
• Do you encrypt all sensitive and confidential information:
  • That is physically removed from the premises by tape, disk hard drive or other means?
  • That is stored in your databases, servers or individual files?
  • That is transmitted within and from your organization?
• Do you ensure that all wireless networks have protected access?
• Do you have a document and e-mail retention and destruction policy?
• Do you enforce a software update process, including patches and anti-virus software?
• How frequently are computer systems and data backups performed?
• Are backups stored off-site in a secure location?

• Describe all security breaches and privacy complaints or violations that have occurred in the last 5 years
• Describe preventive measures taken to avoid future security breaches or privacy violations:

• Are any of the following network system functions outsourced to a third party?
  • Hosting Facility
  • Co-location Facility
  • Management Security Services Provided
  • Data Storage Facility
  • Other (provide details):
• If yes:
  • Is a written agreement in place with the third party provider?
  • Does the agreement require a level of security commensurate with the company’s information systems security policy?

• Provide details of all Cyber Liability Insurance held during the past three years
• When was the first date on which the Applicant purchased continuous claims made coverage?
• Has any insurance been refused or canceled in the past five years?
• Does the company or any other person proposed for this insurance have knowledge or information of any claim, demand, suit, or proceeding which has been made or is pending against any insured proposed for coverage under the proposed insurance? 
• Have there been any suits, claims, occurrences (including allegations) made against the company or any other person proposed for this insurance in the last five years?
• Has the company been subject to any government action, investigation or subpoena regarding any alleged violation of a privacy law or regulation in the last five years? 
• Has the company notified consumers or any other third party of a data breach incident involving the applicant in the last five years?
• Has the company experienced an actual or attempted extortion demand with respect to its computer systems in the last five years?
• Has the company been involved in, or is aware of, any disputes over any domain names under their control in the last five years?
• If yes to any of the above, attach details.

Over time, if any of this changes you need to inform your insurer so your policy is modified accordingly.