Chubb Documents
Chubb
Catastrophic Risks
Catastrophic Cyber Risks:
A Growing Concern
In this document, Chubb discusses the increasing threat of large-scale cyber incidents and their potential impact on businesses and the insurance industry.
Growing Cyber Risks
- The frequency, severity, and sophistication of cyber incidents are increasing as the world becomes more digitized.
- Due to greater interconnectivity, vulnerabilities and exposures are multiplying, creating systemic risks that are difficult to detect or control.
- Recent cyber incidents have caused billions of dollars in economic losses, demonstrating the potential for a catastrophic attack.
Cyber Insurance Evolution
- Cyber insurance has become more widely adopted, with nearly 50% of U.S. businesses now covered.
- While cyber insurance provides important risk transfer and management solutions, the ability of insurers to absorb the total loss potential in the long term is uncertain.
Escalating Threats
- Over 18,000 new software vulnerabilities were published in 2020, nearly tripling from 2015.
- Nearly 1.2 million new malware threats were identified in 2020, more than double the number from 2015.
- Recent high-profile incidents like Solorigate and Hafnium have affected hundreds of thousands of organizations worldwide.
Potential Catastrophic Cyber Risks
The document outlines several types of events that could lead to catastrophic cyber incidents:
- Severe known vulnerability exploits
- Severe zero-day exploits
- Software supply chain exploits
- Infrastructure outages
- Other widespread events
- Ransomware encounters
Strengthening Cyber Resilience
- Organizations need to improve preparations for potential cyber catastrophes by understanding their specific exposures and committing resources to improve cyber defenses.
- The government and private sector collaboration is necessary to address global cyber threats.
Insurance Industry Response
- The insurance industry may need to adapt by offering coverage for catastrophic events separately from core coverages, similar to how property insurance handles catastrophic risks.
- This approach aims to ensure the long-term sustainability of the cyber insurance market while continuing to provide innovative solutions for policyholders.
This document emphasizes the critical need for organizations to enhance their cyber resilience and for the insurance industry to evolve its approach to cyber risk management in the face of growing catastrophic cyber threats.
Chubb
SMB Risk Management
What All Cyber Criminals Know:
Small & Midsize Businesses With Little or No Cybersecurity Are Ideal Targets
This document discusses the cybersecurity risks faced by small and midsize enterprises (SMEs) and provides strategies for protection.
Cybersecurity Threats to SMEs
Cybercriminals increasingly target SMEs due to their often inadequate security measures. Over half of all cyberattacks are directed at SMEs, with 93% of affected businesses reporting severe impacts. These impacts include financial losses, reputational damage, and operational disruptions.
The Domino Effect
Cyberattacks can trigger a cascade of negative consequences for SMEs:
- Website/system outages leading to lost business
- Data breaches causing customer attrition and brand damage
- Ransomware attacks resulting in costly recovery efforts
- Potential lawsuits from affected parties
Common Attack Methods
Cybercriminals typically gain access through:
- Physical system vulnerabilities
- Weak authentication and privilege management
- Denial of service attacks
- Malicious content (e.g., ransomware, phishing)
Protection Strategies
SMEs can enhance their cybersecurity by:
Implementing strong password policies
- Educating employees on security best practices
- Updating IT equipment and deploying security software
- Creating a cyber incident response plan
- Purchasing cyber insurance
Importance of Cybersecurity for SMEs
Despite the high risk, only 3% of SMEs have cyber insurance, compared to 40% of large businesses. Many SMEs lack adequate resources for cybersecurity, with 67% having no data security policies. Given the potential for severe business impacts, implementing basic cybersecurity measures is crucial for SME survival in today’s digital landscape.
By adopting these strategies, SMEs can significantly reduce their cyberattack vulnerability and protect their business continuity.
Chubb
Attack Inevitability
Cyber Attack Inevitability:
The Threat Small & Midsize Businesses Cannot Ignore
This document highlights the growing threat of cyber attacks targeting small and medium-sized enterprises (SMEs). Despite the media focus on large-scale cyber incidents, 62% of all cybercrime targets are SMEs. This trend is expected to continue rising as cybercriminals exploit the often inadequate security measures of smaller businesses.
Why SMEs Are Targeted:
- SME leaders often underestimate their risk and lack sufficient information about protection.
- Digital transformation increases vulnerability.
- Cyber crimes against SMEs are low-risk for criminals due to advanced technology.
Common Cyber Attack Strategies:
- Stolen email accounts leading to fraudulent wire transfers
- Ransomware scams encrypting company files
- Phishing scams compromise sensitive employee information
- Device theft resulting in data loss
Impact on SMEs:
The average cost to recover from a cyber incident is $400,000, which can be catastrophic for smaller businesses. Since January 2016, there have been 4,000 cyber incidents daily, a 300% increase from the previous year.
Preventative Measures:
- Create a cyber-attack response plan
- Use a secure password manager
- Educate employees about cyber risks
- Install and update antivirus software
- Regularly update operating systems and applications
- Protect networking activity with secure routers and VPNs
Importance of Cyber Insurance:
A comprehensive cyber insurance policy can provide:
- Built-in loss mitigation services
- Incident response services
- Access to experts in various fields
- Financial risk coverage
The document provides real-life examples of SMEs that were protected by cyber insurance policies, demonstrating how these policies mitigated losses and helped businesses recover from attacks.
Given the statistical likelihood of falling victim to a cyber attack, SMEs are strongly advised to implement preventative measures and consider comprehensive cyber insurance. The continued survival of small and medium-sized businesses may depend on their ability to protect themselves against this growing threat.
Chubb
Cyber Underwriting
Cyber COPE® Transforming Cyber Underwriting
In this Document, Chubb introduces Cyber COPE®, a new model for cyber underwriting developed to improve the assessment of cyber and privacy risks. The model adapts the traditional COPE (Construction, Occupancy, Protection, Exposures) framework used in property insurance to the cyber domain.
Key Components of Cyber COPE®:
- Components: Objective data elements about a company’s cyber “structure,” such as the number of computers, user accounts, and Internet connections.
- Organization: Objective data providing a board-level view of the company’s cyber vulnerability, including industry, security standards, and budget allocation for cybersecurity.
- Protection: Subjective data on security controls within a company, focusing on essential measures like awareness training, authentication, and encryption.
- Exposures: Subjective data on potential cyber vulnerabilities generally beyond a company’s control, such as targeted attacks and common software vulnerabilities.
Benefits and Implementation
Cyber COPE® aims to simplify and improve cyber risk assessment by:
- Providing a balance of objective and subjective data for underwriters.
- Fostering information sharing among organizations to mitigate future losses.
- Offering a framework that both technical and non-technical individuals can understand.
Chubb implemented Cyber COPE® as the basis for their Global Cyber Facility insurance application. The model presents opportunities for innovation in cyber underwriting, particularly in the Components and Exposures categories.
Importance and Future Outlook
The document emphasizes the growing need for effective cyber risk assessment due to increasing cyber threats and high potential losses. By adopting a standardized approach like Cyber COPE®, the insurance industry can:
- More accurately assess and price cyber risks.
- Provide better coverage and solutions to protect organizations.
- Promote collaboration and data sharing to improve overall cybersecurity.
As the model evolves, ongoing collaboration with industry leaders is crucial to refine measurements and identify impactful ways to reduce cyber attack risks.
Chubb
Social Engineering
Guarding Against Email Social Engineering Fraud:
Re-examining a Global Problem
In this document, Chubb discusses the growing threat of email social engineering fraud and outlines strategies for businesses to protect themselves against such attacks.
Email Fraud Statistics and Risks
- An estimated 300 billion email messages are exchanged daily by businesses and individuals.
- Cybercriminals stole over $28 billion through email fraud from 2016-2020, with an average loss per incident exceeding $150,000.
- Cyber security risks have increased due to remote work and increased e-commerce during the COVID-19 pandemic.
Common Social Engineering Schemes
- Impersonation of executives, vendors, and suppliers to request fraudulent wire transfers.
- Hacking into vendors’ email accounts to alter invoices and redirect payments.
- Exploiting weak security in vendor management portals to change payment information.
Preventive Measures: Technology Solutions
- Implement email authentication techniques like Sender Policy Framework (SPF), Domain-Keys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting & Conformance (DMARC).
- Use Multi-Factor Authentication (MFA) to add an extra layer of security.
Preventative Measures: Procedural Changes
- Establish a strong wire transfer authority policy requiring multiple approvals for large transactions.
- Implement a “four eyes” principle for reviewing and authenticating payment requests.
- Develop a robust vendor management process to verify changes in supplier information.
- Work with solution providers that authenticate information provided by vendors.
Response to Fraud
If a business suspects it’s a victim of email fraud, it should:
- Contact the originating bank to recall the wire transfer.
- File a complaint with the FBI at www.ic3.gov.
- Preserve all records of the incident.
- Contact the insurance carrier.
This document emphasizes the need for businesses to continually adapt their processes and procedures to address the evolving nature of email fraud. It stresses the importance of implementing technological defenses and re-evaluating policies to verify information received electronically, authenticate identities, and authorize payments to business partners.
Chubb
Healthcare Claims
Cyber Claims Scenarios:
Healthcare Organizations
In this document, Chubb outlines cyber claims scenarios for healthcare organizations, highlighting the unique risks and challenges faced by the industry. The summary covers four main types of cyber incidents:
Loss of PHI (Personal Health Information)
In this scenario, criminals outside the U.S. exploited vulnerabilities in a healthcare organization’s system, accessing over 200,000 patients’ PHI. Chubb, the insurance provider, assisted by engaging an incident response coach and forensics firm. The incident required notifying governmental agencies, establishing a call center, and offering credit monitoring to affected patients.
Physician Impersonation
An unlicensed individual impersonated a doctor at an insured healthcare organization, gaining access to medical files during a peer review process. This breach led to the exposure of patients’ PHI and resulted in third-party claims against the organization for failing to protect sensitive information.
Ransomware Attacks
A hospital was victim to a ransomware attack that, despite a small ransom demand of $500, caused significant disruption to operations. The attack impacted billing systems, imaging capabilities, patient monitoring, and payroll. The hospital incurred over $700,000 in forensics, data recovery, business interruption, and crisis management costs.
Vendor/Supply Chain Incident
A business associate of an insured healthcare organization experienced a ransomware attack, potentially compromising the medical records and PHI of the insured’s customers. The insured organization consulted with an incident response coach to determine their reporting obligations under HIPAA. Fortunately, no PHI was exfiltrated, but the incident still resulted in $20,000 in first-party costs.
Chubb emphasizes the importance of cyber insurance and preparedness in the healthcare sector. It showcases how Chubb’s cyber insurance solutions can provide crucial support in various scenarios, including access to top-tier response coaches, forensic firms, and technical expertise. The examples illustrate the complex nature of cyber threats in healthcare, ranging from external attacks to internal vulnerabilities and third-party risks.
These scenarios underscore the critical need for robust cybersecurity measures, incident response planning, and comprehensive cyber insurance coverage in the healthcare industry. They also highlight the potential financial and operational impacts of cyber incidents, emphasizing the value of expert assistance in managing and mitigating such events.
Chubb
Claims Scenarios
What Have We Paid Lately:
Chubb Cyber Claims Scenarios
This document provides an overview of Chubb’s cyber insurance claims scenarios and their approach to handling claims. Chubb emphasizes their commitment to managing claims with integrity, empathy, promptness, expertise, and fairness.
Key Claim Scenarios
Biometric Cases
Companies collecting employee biometric data face lawsuits under Illinois’ Biometric Information Privacy Act (BIPA). These class-action suits seek damages for BIPA violations, with penalties ranging from $1,000 to $5,000 per violation.
Physician Impersonation
A healthcare organization discovered an unlicensed individual impersonating a doctor and accessing patient files. This led to notifications of exposure to personal health information (PHI) and subsequent third-party claims against the insured.
BitPaymer Ransomware
A financial service firm fell victim to BitPaymer ransomware, which encrypted their data and demanded over $500,000 in ransom. The attack also involved a banking Trojan designed to steal financial information. After consultation with Chubb, the insured decided to pay the ransom, which was covered under their cyber policy.
Business Interruption
A retail goods seller experienced a ransomware attack that encrypted their data and demanded $25,000 in Bitcoin. After paying the ransom and regaining access to their data, Chubb assisted in calculating the business interruption loss, resulting in a payment of over $200,000.
Chubb’s Approach
Chubb demonstrates its value in handling these claims through:
- Utilizing top-tier cyber defense counsel
- Conducting expert claims investigations
- Providing technical expertise
- Offering superior coverage
This document emphasizes Chubb’s commitment to providing peace of mind through its insurance offerings and its guiding principle of handling claims with integrity and expertise. It showcases Chubb’s capabilities in addressing various cyber threats and their dedication to supporting their insured clients through complex claim scenarios in the ever-evolving landscape of cyber risks.
Chubb
Claims Scenarios
What Have We Paid Lately:
Chubb Cyber Claims Scenarios
This document provides an overview of Chubb’s cyber claims scenarios and their approach to managing cyber security incidents. The summary highlights four critical cyber risk scenarios across different industries, showcasing Chubb’s expertise in handling various cyber threats.
Cyber Claims Scenarios
The document presents a summary of four cyber risk scenarios:
- Emotet Malware affecting a public entity
- Payment Card Scam in the restaurant/hospitality industry
- Ryuk Ransomware targeting a financial services company
- Business Interruption impacting a retail chain
Each scenario is associated with a specific claim difference, such as technical expertise, expert claims investigation, top-tier response coaching, and superior coverage.
Detailed Claim Scenarios
Emotet Malware
The document briefly mentions that Emotet is one of the more costly and destructive types of malware impacting governments today. While it doesn’t provide specific details about a claim scenario for Emotet, it highlights the significance of this threat, particularly for public entities.
Payment Card Scam
A restaurant fell victim to a malicious email containing a link that installed malware on their computer system. This attack compromised over 400,000 credit card numbers, resulting in potential Payment Card Industry (PCI) assessments estimated to cost more than $1 million, covered under the restaurant’s cyber policy.
Ryuk Ransomware
A financial services company experienced a targeted Ryuk ransomware attack, with a ransom demand exceeding $100,000 in Bitcoin. The attack affected the entire network, rendering data inaccessible. Chubb’s Cyber panel provided an incident response coach and forensic firm to assess the situation and determine potential notification obligations under data privacy laws.
Business Interruption
A Canadian retail chain suffered a ransomware attack that infiltrated its servers, computer systems, cash registers, online store, and website. Chubb-preferred vendors were retained to mitigate the incident. The attack resulted in approximately $1 million in mitigation expenses and $100,000 in business interruption costs.
Chubb’s Approach
The document emphasizes Chubb’s attentiveness to detail in managing cyber claims and their insight into trends and exposures impacting cyber security. It highlights their ability to help prevent and address cyber exposures when incidents occur, showcasing their experience across various industries.
Chubb
Financial Cyber Claims
Cyber Claims Scenarios:
Financial Institutions
In this document, Chubb outlines various cyber claims scenarios for financial institutions, highlighting the risks they face and how Chubb’s insurance coverage addresses these incidents.
Key Cyber Risks and Scenarios
Phishing Scam
A financial institution fell victim to an email phishing attack, resulting in over 400 compromised employee email accounts. The incident response involved retaining a forensic firm and an incident response coach from the Chubb Cyber Panel, with initial costs exceeding $1.5 million.
Ryuk Ransomware
A financial institution was targeted by a Ryuk ransomware attack, known for its large ransom demands. The attackers demanded over $1 million in Bitcoin, which the company refused to pay. Chubb’s Cyber Policy covered the retention of an incident response coach and forensic firm to assess the damage and determine any necessary remediation.
ATM Skimming
A card skimmer installed at a drive-up ATM compromised the information of more than 400 bank customers, leading to fraudulent transactions. Chubb’s Crime Policy and Cyber Policy were activated, providing incident response coaching, customer notification, and credit monitoring services.
Rogue Employee
An employee at a financial institution misused newly issued credit card numbers for personal gain over several months. The institution retained counsel from the Chubb Cyber Panel to determine notification obligations and prepare for potential third-party suits.
Chubb’s Cyber Insurance Advantages
Chubb’s unique offerings in handling these cyber claims:
- Access to top-tier response coaches and forensic firms
- Superior coverage for various cyber incidents
- Expert claims investigation
- Technical expertise in handling complex cyber scenarios
This document illustrates the diverse and complex cyber risks financial institutions face and demonstrates how Chubb’s comprehensive cyber insurance solutions provide crucial support in managing and mitigating these incidents. By offering specialized coverage, access to expert resources, and tailored response strategies, Chubb positions itself as a valuable partner for financial institutions in navigating the evolving landscape of cyber threats.
Chubb
Enterprise Risk
Chubb Cyber Enterprise Risk Management (ERM)
Chubb’s Cyber Enterprise Risk Management (Cyber ERM) is a comprehensive solution designed to address the evolving landscape of cyber risks businesses face today. With over 20 years of experience handling cyber incidents, Chubb offers a sustainable approach to insuring a broad array of cyber events, including widespread events that can result in catastrophic losses.
The Cyber ERM program is built on a three-pronged approach:
- Loss Mitigation Services: Providing tools and resources to assess and address cybersecurity risks proactively.
- Incident Response Services: Offering a diverse team of experts to help limit exposure when an event occurs.
- Risk Transfer: Providing broad and sustainable insurance coverage backed by Chubb’s financial strength.
Competitive Advantages
Chubb’s Cyber ERM stands out with several competitive advantages:
- Leading provider of cyber risk solutions since 1998
- Highly customizable solutions for all sizes of businesses
- No minimum premiums
- Cybercrime coverage available
- Expansive consumer-based solutions for cyber incident response
- Online quoting for eligible small risks
- Innovative coverage addressing evolving standards
- Easy-to-read policy form
- Worldwide coverage territory
New Endorsements (2021)
Chubb introduced three new endorsements in 2021 to enhance their Cyber ERM offering:
- Widespread Event Endorsement: Addresses events with widespread impact, allowing tailored coverage for specific perils.
- Ransomware Encounter Endorsement: Provides a customized set of coverage options for ransomware risks.
- Neglected Software Exploit Endorsement: Rewards good software patching practices while gradually adjusting risk-sharing for unpatched software.
Coverage Options
Cyber ERM offers a range of coverage options, including:
Third-Party Liability Coverage:
- Cyber, Privacy, and Network Security Liability
- Payment Card Loss
- Regulatory Proceedings
- Media Liability
First-Party Coverage:
- Cyber Incident Response Fund
- Business Interruption (including Contingent Business Interruption)
- Digital Data Recovery
- Telephone Toll Fraud
- Network Extortion
Cyber Crime (by endorsement):
- Computer Fraud
- Funds Transfer Fraud
- Social Engineering Fraud
Chubb’s Cyber ERM provides a flexible and comprehensive solution for businesses seeking to protect themselves against the ever-evolving landscape of cyber risks. By offering tailored coverage options and innovative endorsements, Chubb aims to provide long-term stability in the cyber insurance marketplace while addressing each client’s unique needs.
Chubb
Digitech ERP
DigiTech® Enterprise Risk Management (ERM)
Chubb’s DigiTech® Enterprise Risk Management (ERM) policy is a comprehensive solution designed to address the complex cyber and technology risks modern businesses face. With over 30 years of experience handling technology-driven claims and cyber incidents, Chubb offers a distinctive level of protection that can be customized to meet specific organizational needs.
DigiTech® ERM employs a three-pronged approach:
- Loss Mitigation Services: Provides access to tools and resources for proactively addressing and assessing key cybersecurity risks.
- Risk Transfer: Offers broad and sustainable coverage backed by Chubb’s A++ rated financial strength.
- Incident Response Services: Provides a team of experts to help limit exposure when an event occurs.
Competitive Advantages
- Market-leading customizable solutions for all sizes of risks and industries
- No minimum premiums
- Cybercrime coverage is available by endorsement or as a separate cover
- Expansive cyber incident response expense coverage
- Online quoting and real-time policy issuance for eligible small risks
- Industry-leading coverage designed to address evolving standards
- Easy-to-read policy form aligned with the typical cyber incident flow
- Universal coverage territory
New Endorsements (2021)
- Widespread Event Endorsement: Addresses cyber incidents with widespread impact, allowing tailored coverage for specific perils.
- Ransomware Encounter Endorsement: Provides customized coverage limits, retention amounts, and coinsurance for ransomware risks.
- Neglected Software Exploit Endorsement: Rewards good software-patching practices while gradually adjusting risk-sharing for unpatched software.
Coverage Synopsis
DigiTech® ERM offers a range of third-party liability and first-party coverages:
Third-Party Liability Coverage:
- Technology Errors and Omissions
- Cyber, Privacy, and Network Security Liability
- Payment Card Loss
- Regulatory Proceedings
- Media Liability
First-Party Coverage:
- Cyber Incident Response Fund
- Business Interruption (including Contingent Business Interruption)
- Digital Data Recovery
- Telecom Theft
- Network Extortion
Cyber Crime (by endorsement):
- Computer Fraud
- Funds Transfer Fraud
- Social Engineering Fraud
DigiTech® ERM represents Chubb’s commitment to providing cutting-edge, adaptable cyber insurance solutions that address the evolving digital risk landscape. By offering tailored coverage options, including coverage for widespread events, Chubb aims to provide greater coverage certainty and long-term stability in the cyber insurance marketplace.
Chubb
Pro ERM
Professional Enterprise Risk Management (Pro ERM℠)
Chubb’s Professional Enterprise Risk Management Policy (Pro ERM℠) is a comprehensive insurance solution designed for professional service firms operating in today’s interconnected, technology-driven world. This policy combines multiple coverages into a single package, addressing a range of exposures and reducing potential coverage gaps.
Coverage Areas:
Pro ERM℠ protects various scenarios where professional service firms can be held accountable, including:
- Providing professional services to clients
- Delivering technology services
- Producing or publishing advertising or media content
- Handling private or proprietary information
Comprehensive Protection:
The policy incorporates several crucial coverage areas:
- Professional Liability: Covers errors or omissions in professional services
- Electronic, Social, and Printed Media Liability: Addresses risks associated with advertising and media presence
- Cyber, Privacy, and Network Security Liability: Offers protection against cyber risks
- First-Party Coverage: Includes cyber incident response, business interruption, digital data recovery, and network extortion
Additional Benefits:
- Flexibility to tailor coverage to unique exposures and needs
- Access to Chubb’s cyber loss mitigation and incident response services
- Option for additional coverages through endorsements, such as Media Liability for Professional Firms and Cyber Crime
Why Choose Pro ERM℠?
- Consolidated Coverage: Eliminates the need for multiple policies
- Client Requirements: Meets professional liability insurance requirements often mandated by clients
- Broad Protection: Covers liability arising from the firm’s actions and subcontractors’ work
- Data Security: Addresses the duty to safeguard proprietary and personal information
- Competitive Advantage: Can serve as a marketing asset when bidding for contracts
Chubb’s Strengths
Chubb has established itself as a leader in professional liability insurance due to:
- Strong financial stability, as evidenced by high ratings from independent analysts
- Reputation for fair claims handling and superior service
- Offering some of the broadest coverage available in the market
Pro ERM℠ is suitable for professional service firms of all sizes, including consultants, business process administrators, marketing firms, applied arts professionals, printers, staffing firms, travel agents, and trustees. By combining comprehensive coverage with Chubb’s expertise and support services, Pro ERM℠ offers an enterprise-wide solution to address the complex risks modern professional service firms face.
Chubb
Pro ERM Small Biz
Pro ERM For Small Business
Chubb’s Professional Enterprise Risk Management (Pro ERM) is an insurance solution designed for small businesses. It was introduced in 2019 and is now available on Chubb Marketplace. This product offers comprehensive professional liability coverage tailored to various service providers and small business owners.
Key Features
- Experience: Chubb boasts over 20 years of experience in the Errors & Omissions (E&O) market.
- Customization: The company offers custom solutions based on industry class.
- Claims Handling: Chubb employs dedicated E&O claims adjusters and was rated #1 in Professional Liability Claims Service in the 2020 Advisen Survey on Claims Satisfaction.
- Coverage: The specialized coverage form includes optional Cyber coverage.
Target Industries
Pro ERM caters to a wide range of service providers, including but not limited to:
- Appraisers
- Consultants (Management, HR, Marketing)
- Event planners
- Graphic design firms
- Staffing agencies
- Tax preparation services
- Travel agents
Premium Examples
The document provides examples of businesses that have purchased Pro ERM, with premiums ranging from $700 to $4,000 based on revenue and industry. For instance:
| Business Type | Annual Revenue | Approximate Premium |
| Graphic Design Firm | $80,000 | $700 |
| Tax Consulting Firm | $500,000 | $3,000 |
| Call Center Services | $2,400,000 | $4,000 |
Policy Features
The Pro ERM policy includes several notable terms and conditions:
- Reporting Provision: Claims should be reported “as soon as practicable” after knowledge by a control group member.
- Technology Services: The definition of Professional Services includes Professional Technology Services.
- Defense Cost Allocation: 100% defense cost allocation for covered claims worldwide.
- Defense and Settlement: The policy includes an 80/20 clause in the Insured’s favor.
Chubb’s Pro ERM solution aims to provide comprehensive and flexible coverage for small businesses across various service industries, leveraging the company’s extensive experience in professional liability insurance.
Chubb
Vulnerability Outreach
Cyber Vulnerability Outreach
Stay Ahead: Be Informed, Act Swiftly Against Vulnerabilities
In today’s rapidly evolving digital landscape, businesses face constant cybersecurity threats. The Cybersecurity Infrastructure Security Agency (CISA) reports that 50% of known exploited vulnerabilities (KEVs) are exploited within two days of identification and 75% within a month. This emphasizes the critical need for robust vulnerability management programs to address potential threats swiftly.
Vulnerability Management Outreach
Chubb’s Cyber Intelligence Team offers a comprehensive Vulnerability Management Outreach program to protect policyholders. This service includes:
Outreach Program: Proactive notifications to policyholders and brokers about critical vulnerabilities detected, including:
- Initial email communication detailing exposures and remediation steps
- Personalized support through email and phone calls
Breaking Alerts: Timely notifications (usually within 24 hours) to all policyholders and brokers about newly discovered high-risk vulnerabilities
Additional Cyber Vulnerability Management Solutions
Chubb Cyber policyholders have access to several complimentary services:
- Vulnerability Alert System: Biweekly emails about newly identified software vulnerabilities, provided in partnership with SecAlerts
- External Vulnerability Monitoring: Daily cybersecurity performance measurements via BitSight and Security Scorecard platforms
Policyholders can also access the following solutions at preferred pricing:
Network Vulnerability Scan and Consulting: Comprehensive vulnerability testing with expert guidance (by NetDiligence)
Penetration Testing and Attack Surface Management: Evaluation of internal and external systems by offensive security experts (by NetSPI)
Vulnerability Management Platform: Software for discovering, prioritizing, and remediating vulnerabilities across IT environments (by Tanium)
Chubb’s Vulnerability Management Outreach program offers a proactive approach to cybersecurity, helping businesses stay ahead of potential threats. By combining timely alerts, personalized support, and access to advanced tools and services, Chubb empowers its policyholders to maintain a strong security posture in an increasingly complex digital landscape.
Chubb
Systemic Events
A Better Way to Define and Insure Systemic Cyber Events
In this document, Chubb discusses its approach to defining and insuring systemic cyber events, addressing the growing concern of catastrophic cyber attacks that could cause widespread damage.
Definition of Systemic Risk
Chubb defines a systemic cyber event as one that inflicts widespread harm to many customers due to shared elements or commonalities, often exploiting a single point of failure.
Market Response and Challenges
The cyber insurance market has been adapting to the increasing frequency of ransomware attacks but has been less explicit in addressing systemic risk. Chubb identified three main problems:
- Lack of coverage clarity for the insured
- Inadequate pricing of the risk
- Insufficient focus on tracking and monitoring exposure
Chubb’s Solution
To address these issues, Chubb developed a policy with:
- Clear definition of widespread cyber events
- Transparent pricing for systemic coverages
- Alignment with modeling firms for consistent exposure assessment
Coverage and Exclusions
Chubb’s policy covers widespread events, excluding those involving war or infrastructure impairments. War and infrastructure are clearly defined to provide contract certainty.
Reinsurance Implications
The document suggests a shift from quota share to event excess of loss basis for reinsurance, similar to catastrophe excess of loss reinsurance for property.
Market Reaction and Adoption
Chubb introduced this language nearly two years ago, and many clients understand and support the approach. The company believes its model can be an example for other insurers.
Catastrophic Risk Statistics
- Malware attacks increased by nearly 40% in 2022 compared to 2021
- Over 25,000 software vulnerabilities were discovered in 2022
- Potential losses from a single systemic cyber event are estimated to range from $2.8 billion to $1 trillion
Chubb’s Cyber ERM Approach
Chubb’s approach includes:
- Loss Mitigation Services
- Incident Response Services
- Risk Transfer (insurance coverage)
Competitive Advantages
Chubb highlights its experience, customizable solutions, and innovative coverage designed to address evolving regulatory, legal, and cyber security standards.
Widespread Event Endorsement
Chubb offers a Widespread Event Endorsement that addresses events with widespread impact, allowing for tailored coverage, limits, retentions, and coinsurance for specific perils.
Chubb presents a comprehensive approach to defining and insuring systemic cyber events, aiming to provide clarity, appropriate pricing, and effective risk management for this growing threat in the digital landscape.
Chubb
Email: Digital Door
Email: Is the Digital Door Propped Open For Identity Hijackers?
This document discusses the growing threat of Business Email Compromise (BEC) attacks and the importance of Multi-Factor Authentication (MFA) in preventing them.
The Threat of Business Email Compromise
BEC attacks involve cybercriminals hijacking or impersonating corporate email accounts to defraud companies. In 2019, the FBI received over 467,000 complaints, resulting in more than $3.5 billion in losses. These attacks often target businesses of all sizes and can involve:
- Impersonating executives to request urgent fund transfers
- Redirecting legitimate invoice payments to criminal-controlled accounts
- Exploiting personal transactions like real estate purchases
Why BEC Attacks Succeed
- Reliance on email as the primary communication method
- Trust in familiar senders and urgency of requests
- Social engineering techniques exploiting human behavior
- Inadequate security measures, particularly weak passwords
Multi-Factor Authentication as a Solution
MFA is presented as an effective defense against BEC attacks. It requires two or more proofs of identity, typically involving:
- Something you know (e.g., password)
- Something you have (e.g., smartphone)
- Something you are (e.g., biometrics)
Implementing MFA
The document emphasizes that MFA is:
- Available for most popular web services
- Often easy to set up and use
- Highly effective in preventing unauthorized access
Additional Security Measures
- Microsoft Secure Score: A tool to measure and improve overall security posture
- Encouraging partners and vendors also to implement MFA
- Ongoing vigilance and security awareness
Chubb stress that implementing MFA is one of the most critical and cost-effective cybersecurity controls businesses and individuals should adopt. By adding this extra layer of security, organizations can significantly reduce their risk of falling victim to BEC attacks and other forms of cybercrime.
Chubb
SEC Cyber Regs
Preparing Companies for the New SEC Cyber Regulations
Chubb outlines its approach to helping public companies navigate the new SEC Cyber Regulations, which took effect on December 18, 2023. The regulations require publicly traded companies to report material cyber breach events within four business days of discovery.
Chubb’s Offerings:
- Comprehensive cyber insurance and Directors and Officers (D&O) liability coverage
- Access to expert guidance, including Cyber Incident Response Coaches
- Risk reduction services, such as cyber security tools and incident response preparation
- Global reach, with the ability to issue local D&O liability policies in over 40 countries
SEC Rule Components:
- Disclosure of Material Cybersecurity Incidents
- Disclosure of Cyber Risk Management and Strategy
- Disclosure of Cybersecurity Governance
Mullen Coughlin LLC Partnership:
- Provides legal expertise on the SEC ruling
- Offers assistance in assessing compliance and developing appropriate policies and procedures
- Specializes in data privacy and security law
Recommendations for Public Companies
- Consult with legal advisors to understand the SEC Rule’s impact
- Develop playbooks for assessing the materiality of cybersecurity threats
- Conduct privileged assessments of current compliance posture
- Revise existing policies and procedures to align with SEC Rule requirements
- Document diligence and compliance from a governance standpoint
This document emphasizes Chubb’s commitment to offering comprehensive risk management solutions tailored to the evolving regulatory landscape. It highlights the importance of a holistic approach to risk, combining insurance coverage with expert guidance and preventive measures.
Chubb
Directors Risk
Cyber Loss Mitigation for Directors
Chubb provides guidance for company directors on managing cyber risks and responding to cyber incidents.
Overview
- Cyber risk has become a significant potential loss exposure for almost any company, including for-profit and nonprofit organizations.
- Directors have legal and fiduciary duties to oversee cyber risk management.
Legal Duties and Regulations
- Directors have a fiduciary duty of care regarding cyber risk oversight.
- The SEC’s “Disclosure Guidance” outlines cybersecurity disclosure obligations for public companies.
- The FTC’s “Red Flags Rule” requires companies to adopt identity theft protection programs.
- The NIST “Framework for Improving Critical Infrastructure Cybersecurity” provides guidelines for critical infrastructure industries.
- Industry-specific standards exist for sectors like financial services and healthcare.
Risk Management Practices
- Assign a senior officer responsible for cyber risk management.
- Identify and evaluate the most significant cyber risks.
- Regularly assess the effectiveness of the cyber risk management program.
- Ensure adequate resources are allocated to cybersecurity.
- Implement proper incident response procedures.
Director Oversight
- Boards should delegate cyber risk oversight to a committee (e.g., enterprise risk or audit committee).
- Directors should receive regular updates and metrics on cyber incidents and risk management activities.
- Consider retaining outside experts or adding a cyber expert to the board for enhanced oversight.
Incident Response
- Directors should focus on understanding the scope and impact of cyber events.
- Oversee proper disclosure practices following a significant cyber incident.
Insurance
- Directors and Officers (D&O) liability insurance and specific cyber insurance policies are important for managing cyber risk.
- D&O policies generally cover claims against directors and officers related to cyber incidents.
- Cyber insurance policies provide third-party and first-party coverage for various cyber-related losses.
The document emphasizes the importance of directors maintaining an oversight role rather than directly managing cyber risk while ensuring the company has adequate resources, expertise, and processes in place to address this critical issue.
Secure Your Digital Future Today
Learn More about Chubb Coverage & Pricing
No Spam. Promise!
What is Cyber Insurance
Cyber insurance is a specialized insurance product designed to protect businesses against the financial losses and disruptions that can arise from cyber-related incidents, such as data breaches, ransomware attacks, and other cyber threats. This type of insurance typically covers costs related to data recovery, legal fees, notification of affected parties, regulatory fines, and business interruption losses. Businesses need cyber insurance to mitigate the financial impact of cyber-attacks, ensuring they can quickly recover and continue operations while minimizing the potential damage to their reputation and customer trust.
What does cyber insurance cover?
Cyber insurance typically covers costs related to data breaches, including data recovery, legal fees, notification of affected parties, and regulatory fines. It may also cover business interruption losses and expenses related to restoring business operations.
Why is cyber insurance important for SMBs?
Small businesses, often with potentially weaker security measures, are prime targets for cyber attacks. Cyber insurance is a crucial tool in managing the financial burden of such attacks, ensuring they can recover quickly and sustain minimal operational disruption.
How is the cost of cyber insurance determined?
Factors such as the size of the business, the industry, the amount and type of data handled, and the company’s existing cybersecurity measures influence the cost of cyber insurance. Higher-risk businesses or those with poor security practices may face higher premiums.
What are the exclusions in a cyber insurance policy?
Standard exclusions in cyber insurance policies include claims related to pre-existing breaches, acts of war or terrorism, and the failure to maintain minimum security standards. It’s essential for businesses to review policy details to understand specific exclusions and limitations.