This article highlights several strategies for maximizing the value of a cyber insurance purchase. The first part of the article, which appeared in the May 2017 issue of Pratt’s Privacy & Cybersecurity Law Report, highlighted the need for an organization to reevaluate its insurance coverage as part of a comprehensive strategy for addressing emerging cyber risks and outlined several ‘‘big picture’’ considerations relevant to any organization contemplating a cyber insurance purchase. This second part focuses on several strategies to consider when negotiating a cyber insurance purchase and seeking to customize the policy to align with an organization’s particular business needs.

Look Beyond Your Immediate Concerns -

Peforming a holistic risk assessment involving input from a cross-functional team is a critical first step when contemplating any cyber insurance purchase. Performing such an analysis will allow the purchaser to identify the particular risks and losses facing the business, prioritize among those threats, and pinpoint the specific items that ‘‘must’’ be covered to ensure that a cyber insurance purchase provides meaningful protection and value to the organization. But the intricacies associated with a detailed (commonly technical) risk assessment should not be confused with the language you ultimately need in your cyber insurance policy. The specific risks and losses identified in the risk assessment merely serve as guideposts and reflect the starting point when evaluating proposed policy language. Instead, negotiating policy language that covers not only your immediate concerns – but provides the broadest overall coverage possible – should always be the goal when purchasing cyber insurance for your organization.

Originally published in the Pratt’s Privacy & Cybersecurity Law Report in June 2017.