Canadian Retailer - The Technology & e-Commerce Issue - 25

creates a potential entry point for hackers.
* Traditional data security tools such as firewalls,
anti-virus software, encryption, intrusion prevention systems and two-factor authentication
can be effective but they need to be regularly
tested, assessed and updated.
* Establish an incident response plan that sets
out what should be done in the event of a cyber
breach. Consider your communication plan as
part of an incident response plan. Test this plan.
* Establish a business continuity plan to help
mitigate damages that might arise from computer system interruption. Test this plan.
* Regularly review and recalibrate prevention,
detection and response plans and protocols.

company or its customers or business partners that
arise out of the theft, loss or compromise of confidential information. Further, it will not provide any
coverage for the costs that a company incurs to deal
with a cyber breach, a virus, malware or other similar network security breach that does not involve
the theft of money or financial instruments. For this
reason, a cyber liability insurance policy is also recommended to mitigate cyber risk exposure.
A cyber liability policy is designed to protect
insured organizations from losses arising out of
the unauthorized access to, or loss of, individuals'
personal identifiable information that the organization has in its care, custody or control.
There are two fundamental categories of coverage provided by the typical cyber policy. The first
The focus on cyber risk should not stop once covers the organization's own costs to investigate
robust security measures have been imple- and mitigate the effects of a breach, or suspectmented and an incident response plan has been ed breach, as well as to comply with applicable
developed. Measures need to be regularly tested, privacy laws, regulations and guidelines. It also
assessed for effectiveness and adencompasses the costs injusted to address changes in the "DEPENDING ON THE
curred to deal with a cyber
risk. In addition, there will almost STRUCTURE OF AN ORextortion situation and can
inevitably remain a portion of cyber GANIZATION'S INSURANCE even reimburse a company
risk that cannot be fully eliminated. PROGRAM, THERE MAY BE for lost revenue where busiTo mitigate this residual exposure, MORE THAN ONE POLICY
ness operations are intermany organizations are looking THAT COULD RESPOND TO rupted because its computer
to insurance. Depending on the COVER DAMAGES THAT
system is compromised. The
structure of an organization's insur- ARISE FROM CYBERCRIME, second category of coverance program, there may be more SUBJECT TO THE TYPE OF
age provides third-party
than one policy that could respond LOSS AND THE MEANS BY
liability protection for litigato cover damages that arise from WHICH IT TOOK PLACE."
tion or regulatory proceedcybercrime, subject to the type of
ings that arise out of a cyber
loss and the means by which it took place.
breach, paying defence costs, amounts to settle
or satisfy a judgment awarded to a third party, or
Insurance coverage for cybercrime
insurable fines levied by a regulator as a result of
Instinctually, many companies first look to an investigatory or regulatory proceeding.
their commercial crime insurance policy for
While there may be no failsafe way to guarcoverage for losses arising from cybercrime. This antee that an organization will not be impacted
is not a bad place to start, as a crime policy is de- by a cyber breach, it is generally agreed that a
signed to respond to the loss of money, securities proactive approach is better than a reactive one.
or property directly by an insured organization. Thus, when it comes to cybersecurity, it is someIn addition, the coverage has changed over the thing that every organization should be prioritizyears to adapt to new means by which theft is car- ing, developing a calibrated cybersecurity stratried out, and now encompasses various types of egy that's continually updated. An organization's
cybercrime such as computer fraud, wire transfer insurance portfolio is no different, it is a control
fraud and social engineering (available through a set that needs to be regularly reviewed and adaptpolicy endorsement).
ed to ensure that the greatest benefit and protecYet, while the expansions in crime coverage tion is being achieved.
might give the impression that the policy would
also cover losses arising out of other computer
related crime such as hacking, cyber extortion or For information about ways to protect you and your
malware, the reality is that the policy is not struc- business from the possible threat of cyber-crimes,
visit www.aon.com/default.jsp.
tured to respond to all cyber risks. The typical commercial crime policy will not cover any losses to a

www.retailcouncil.org/cdnretailer

THE TECHNOLOGY & E-COMMERCE ISSUE

| CANADIAN RETAILER | 2 5

http://www.aon.com/default.jsp http://www.retailcouncil.org/cdnretailer

Table of Contents for the Digital Edition of Canadian Retailer - The Technology & e-Commerce Issue