Michael Gaudet 2015 PHC 7/23/2015. Key Broker Challenges

Transcription

1 Cyber 2015: The Market, Choosing Coverages and AEGIS Update Broker s Perspective Michael Gaudet Marsh FINPRO Energy, Power & Utility Industry Leader Marsh USA, Inc. Key Broker Challenges Coverage consistency Devil in the details Evolving areas Operational Technology (OT) and Information Technology (IT) Failure to supply Contingent business interruption (CBI) Physical Damage Advice on limits given lack of claims data Peer benchmarking Loss modeling 1

2 Key Broker Challenges Underwriting process Coordination of applications, assessments and calls Capacity Follow form concurrency Managing sub-limits USA, London, Bermuda Pricing volatility: what is the correct price point? Post placement services: coordination of vendors / tabletop exercise Property & casualty exclusions Cyber Coverage Spectrum for Power & Utility Clients Power & Utility Cyber Exposures Cyber Coverage Spectrum Primary Insurers & Capacity Data / privacy breach 1 st party costs Complexity of Insurance Solutions Data / privacy breach 3 rd party liability IT security breach liability Privacy regulatory Investigations cost Cyber extortion Cyber terrorism OT security liability Security breach regulatory investigations (IT or OT) Business interruption (IT or OT) Contingent BI (critical vendors) Physical damage Extended regulatory shutdown Commonly addressed Tailored solutions Evolving solutions Many domestic USA options Capacity: $300 million+ Primary options: AEGIS + 6 Capacity: $200 million Lead options: AEGIS + 3 Capacity: $300 million Evolving 2

3 Cyber Purchasing Trends Marsh power & utility client data % Purchasing Cyber Insurance Industry Subsector (29 Clients) Cyber Insurers CIC = Critical Infrastructure 25% 70 20% 21% Midstream, 2, 8% Water, 4, 14% % 10% 8% 10% 14% Gas, 6, 25% Electric, 17, 59% % % Insurers Primary CIC Insurers Primary CIC Power & Utility Cyber Limit Drivers Marsh power & utility client data Privacy concerns Breach response costs Business interruption Power generation concerns Extra expense Failure to supply Potential economic damages Regulatory concerns Cost of investigations Fines & penalties Shut down Cyber Limits Distribution <$10M $10M-$49M $50M+ $75M+ Maximum limit = $200 million 3

4 4

5 Cyber 2015: The Market, Choosing Coverages and AEGIS Update Risk Manager s Perspective Thomas McDonnell Manager, Insurance & Operational Risk FirstEnergy Corp. First Things First Our cyber risk assessment Purpose to identify FE s cyber security risks, threats and vulnerabilities Quantify Risk exposures in financial terms Document current mitigation strategies Determine reporting frequency THEN decide on risk mitigation/transfer strategies Results Top MFL quantified to a 99% confidence level w/ potential frequency intervals $48 million - $145 million financial impact outcomes 1

6 Who Was Involved in the Cyber Analysis? Corporate risk CRO (executive sponsor) CIO (executive sponsor) Cyber security IT compliance SME s IT Fossil generation Nuclear generation Wires Smart meter FE s Approach to the Marketplace All US, London and Bermuda markets vetted Markets needed to Understand the electric utility space Provide 3 rd party coverage Provide 1 st party coverage Exhibit the ability to tailor coverage Possess a long-term mentality to this coverage 2

7 The Underwriting Process Our Perspective Relatively painless upfront internal risk assessment incredibly helpful Our broker s risk assessment submission form was easy to complete Only when certain extensions of coverage were requested, did we have an extensive dialogue with underwriters Adequately prepped internal IT / cyber experts = receptive underwriting Our Coverage Analysis The basic coverage Privacy Security Regulatory defense Media Notification costs Crisis management expenses Cyber extortion 3

8 Our Coverage Analysis Utility-specific Data restoration Business interruption / extra expense Contingent business interruption Spot market coverage Regulatory coverage Why AEGIS? CLEAR understanding of our electric utility-specific risks Tailored coverage Substantial limit offering Appropriate pricing model Long-term focus And because it s our mutual 4

9 FE Approval Process CRO ultimate decision maker Concurrence from CIO very helpful (of course!) CFO briefed on the decision Board briefed on the decision Communications department briefed on the decision ALL PARTIES PERIODICALLY BRIEFED ON OUR PROGRESS THROUGHOUT 5

10 Cyber 2015: The Market, Choosing Coverages and AEGIS Update Dawn R. Simmons Vice President, Underwriting Cyber AEGIS Insurance Services, Inc. AEGIS Cyber Product Strategy Transition of cyber portfolio from Syndicate to mutual July 1, 2015 Underwriting team dedicated to AEGIS members Dawn Simmons, Vice President Ho-Tay Ma, Underwriting Officer Improve consistency in underwriting, pricing, and coverage for our members Rollout of CyberResilience+ policy form with additional clarifications 1

11 AEGIS Underwriting Process Risk assessment process AEGIS questionnaire and conference call approach AEGIS has partnered with Cylance to develop a customized evaluation process for our members Cylance was founded in 2012 by ex-mcafee Global CTO Stuart McClure and ex-mcafee Chief Scientist Ryan Permeh Cylance team has in-depth knowledge of and experience in the critical infrastructure industry AEGIS Cyber Resilience Product Overview Traditional Cyber IT Security and Privacy Liability for both 1 st party remediation costs and 3 rd party liability Privacy Regulatory Action Data Restoration IT Business Income / Extra Expense Physical Damage Excluded Cyber Terrorism / Cyber Warfare CyberResilience+ Extend coverage to include Operational Technology Failure to supply Security breaches in addition to privacy related FERC, NERC, & NRC Fines and penalties where insurable Coverage triggers Software programming errors Natural disasters Extended Coverage triggers Critical Vendor Coverage Failure to Supply Options for DIC / Wrap Coverage: Bodily Injury / Property Damage Exclusion limited to physical war * Additional Coverage: Technology E&O, Media Liability, Cyber Extortion * Additional Throw-Ins: Media Liability, Cyber Extortion, Crisis Management 2

12 AEGIS Cyber Advantage Provide best in class coverage tailored for the energy sector $50 million in dedicated capacity to AEGIS members Dedicated risk service partners with Industry knowledge and expertise to serve AEGIS members Access to AEGIS erisk Hub for loss control and risk management services 3