The value of insurance and risk management often comes into sharp focus when a loss occurs. This is especially true of cyber risks such as data breaches.
When an organization discovers a breach, its list of worries grows: loss of data, potential disruption to business, time and expense needed for recovery, notification, reputational damage, and more. Fortunately, there are steps all organizations can take — before and after a breach — that make the recovery process easier.
Before a breach occurs, or if the organization has previously experienced a cyber incident, before its next one happens, critical steps include:
Get cyber insurance. Cyber policies vary greatly, but virtually all of them provide access to services and expertise that not only can mitigate the risks of cyber incidents but also respond quickly to a data breach. Procuring such services and identifying cyber risk experts independently takes time and is far more costly.
Assess and mitigate cyber exposures. Organizations should take advantage of pre-loss services available under many cyber policies, such as cybersecurity assessments, penetration testing and security monitoring. Outside experts contracted by cyber insurers can identify vulnerabilities in an organization's systems and practices and suggest ways to strengthen weaknesses.
Having coverage in place won't necessarily prevent a data breach, but it can certainly ease some worries and make recovery smoother. The number of attacks by cyber criminals continues to rise. In its 2018 Cyber Claims Study, NetDiligence found that criminal activity in cyber incidents has increased in each year since 2013. In 2017, 86% of claims were caused by criminal activity, including ransomware, hackers, malware, business e-mail compromise attacks and phishing. Another troubling development, according to NetDiligence's analysis of cyber claims between 2013 and 2017, is that businesses of all sizes are targets.
After a data breach is discovered, the most important steps an organization can take include:
Notify the cyber insurer. Whether an incident ultimately becomes an insurance claim is secondary to activating the services available under the organization's cyber policy. Notification of a potential claim can quickly set in motion forensic investigators and legal experts to respond to a data breach. Timely notification also is important to preserve coverage.
Preserve evidence. This is often an overlooked step, due to many information technology professionals' tendency to try to restore systems as soon as possible. System restoration efforts by IT employees may erase logs and other valuable evidence of a cybercrime. Forensic experts generally respond very quickly — in one recent case, in less than two hours — to capture information that facilitates cyber insurance claims as well as the ability to defend legal action. A forensic investigation can determine whether and how much data was exfiltrated and how the breach occurred.
Work with breach counsel. Consulting experienced legal counsel and establishing attorney/client privilege early are highly recommended steps in data breach response. The benefits of doing so include ensuring confidentiality in investigating sensitive matters, clearly understanding what the organization's legal requirements following a breach and organizing information that may be needed to defend lawsuits. Not least, qualified legal counsel can serve as a breach coach, acting as a trusted adviser during a cyber incident and beyond.
Ensure compliance with applicable laws and regulations. All 50 U.S. states and some federal agencies have laws requiring notification of data breaches, but their thresholds and specific required actions differ. For example, Indiana's threshold is one person; if only a single individual's data is exposed, state law mandates notification. The U.S. Department of Health and Human Services' Office of Civil Rights, which enforces the Health Insurance Portability and Accountability Act (HIPAA), has a presumption of breach when protected health information (PHI) is involved. OCR maintains a "Wall of Shame" listing organizations that have data breaches involving PHI of 500 or more individuals. In addition to public shaming, penalties for HIPAA violations are steep, so the ability to rebut the presumption of breach can make an enormous difference financially. That is another reason why preserving evidence immediately after a breach is discovered is so crucial.
BOTTOM LINE
Taking the right steps before and after a data breach are critical to recovery. From forensic investigators to cybersecurity experts to breach counsel to insurance professionals, specialists can make all the difference in a good outcome after a breach vs. a nightmare come true. Choose partners carefully, especially when considering cyber insurance. To better understand the complexities of this specialized insurance and obtain the broadest coverages available in the marketplace, partner with a wholesale specialist.
Footnotes
1. NetDiligence 2018 Cyber Claims Study.
2. U.S. Department of Health and Human Services' Office of Civil Rights, Breach Portal.
Originally Published by CRC Group "Wholesale & Specialty" Post
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
