Condo Media - February 2023 - 21

RISK MANAGEMENT
PLAN CONSIDERATIONS
COST-BENEFIT
ANALYSIS
WHEN I SPEAK TO BOARDS and association professionals on this topic,
I am often asked, " What can we do? "
AUDIT THE USE OF TECHNOLOGY
The fi rst thing you need to do is an audit of your association's use of any of the
following, including what exposures board members and community association
managers may have on their personal or business devices. For example, do your
association board members, employees, community association managers, or other
business partners use any of the following in the management of the association?
Any positive answers to the following warrant cyber liability/data breach coverage:
● FOBs, key cards, remote controls
● Building automation system
● Computers
● Virtual board meetings
(Zoom, WebEx, Facebook, etc.)
● Email, texting, Facebook, or
other social media
● Management software
● Laptops, smart phones, or other
smart devices
● Website
● Online banking
● Wire transfer capability
● Access to the internet
● Maintain applicant or unit owner
applications, ESA/ADA requests
● Elevators
● Security cameras
● Online card payment capability
● Any documents/records that are saved
and stored after the requirement for
maintaining them has expired
ADDRESS POTENTIAL CLAIM SCENARIOS
Is your association's risk management plan prepared to respond to the
following claim scenarios?
● Unit owner information being stolen by a hacker or disgruntled employee
● An order from a governmental agency to notify current and past unit owners and tenants
for whom information has been kept, but is subject to a data breach, and pay any fi nes or
penalties (all 50 states and Washington, D.C., have data breach laws)
● To pay costs for credit monitoring for unit owners, tenants, employees, and anyone
else where the association still stores personally identifi able information
● A laptop or fl ash drive being lost or misplaced with a unit owner's
" personally identifi able information " on it
● A hacker encrypting your computer, locking it down, and demanding a
ransom payable in Bitcoin to unlock the computer
● Your computer being invaded by a virus and compromising your entry key cards
for your building, front gate, clubhouse, elevator, and/or pool
COMPILE RESOURCES AND KNOW WHO TO CALL
● Do you know who to call if any of the scenarios listed above occur? Time is critical.
● Do you have someone to call if the computer has been compromised? Time is critical.
● Do you have access to education, webinars, and proactive risk management services
available for the board?
● Do you have someone to defend the association against claims by governmental
agencies, or civil lawsuits (at someone else's expense)?
Tip: There is one coverage under the cyber liability/data breach policy that
in and of itself is worth its weight in gold and a suffi cient reason to purchase
the coverage. The data breach response services materials include a number
to call if any of the scenarios above occur. What is provided is a coach or
claim coordinator to coordinate the claim. Most policies provide a booklet
outlining the services approved and listing approved computer forensic
experts, forensic accountants, attorneys, and other principals to assist with
various claim issues within their expertise.
COMMUNITY ASSOCIATION insurance
professionals (i.e., brokers) have been proposing
cyber liability and data breach coverage
for many years. Under a cost-benefi t analysis,
this is no longer an optional coverage for
board fi duciaries. This should be part of every
association's insurance portfolio. Board members
must understand that their primary obligation
is to protect the association's assets,
tangible and intangible, and should heed the
professional's advice regarding the proposed
insurance. Failure to obtain this coverage can
result in draconian costs. Just search, " Cyber
Liability and Data Breach Claim Costs. "
The fi rst excuse from boards and community
association managers is " cost. " The " cost " to
obtain a cyber liability/data breach response
policy is relatively inexpensive and provides
a great deal of both protection and access to
extensive risk management information, data
breach coaches, forensic computer experts, and
training videos. The typical policy is roughly between
$500 and $2,500. The key underwriting
rating factors are: (a) location, (b) limit of liability
requested, and (c) the association's annual
revenue, which, for the purpose of underwriting,
would be the total of all assessment and special
assessments in the upcoming budget year, not
capital, improvement, or reserve funds.
The second excuse is, " Why do we need
these coverages in the fi rst place? " Boards
say, " We have not seen any claims for cyber
liability or data breach in associations. Associations
are small fi sh; why would the hacker or
cybercriminal spend their time on associations?
Associations are not like retail giants, hospitals,
law fi rms, insurance agencies, oil companies, or
large fi nancial institutions. " What is happening
is that the large targets are getting smart, signifi
cantly upgrading security measures, and are
doing signifi cant training for all their employees.
In addition, we are told that hackers and cybercriminals
are lazy and go for the easy score.
The underwriting of these policies is not very
rigorous. Sometimes the key is learning the
basic sections of the policy and determining
what is covered. Most boards understand that
they are insured for any type of risk, injury, or
damage. However, the question is: Are they
self-insured or insured by an insurance policy?
If it is the former, the insured will have to pay
any attorney fees, settlements, or judgments
out of its own assets. In most states, fi nes and
penalties are not covered.
February 2023 CONDOMEDIA 21

Condo Media - February 2023

Table of Contents for the Digital Edition of Condo Media - February 2023