Homeland Insurance Company of New York Homeland Insurance Company of Delaware (Stock company owned by the OneBeacon Insurance Group) NETWORK SECURITY AND PRIVACY LIABILITY APPLICATION PORTIONS OF THE POLICY FOR WHICH THIS APPLICATION IS MADE APPLY ONLY TO CLAIMS FIRST MADE AGAINST THE INSURED AND REPORTED TO THE UNDERWRITER DURING THE POLICY PERIOD OR APPLICABLE EXTENDED REPORTING PERIOD. CLAIM EXPENSES ARE PART OF AND NOT IN ADDITION TO THE APPLICABLE LIMIT OF LIABILITY. CLAIM EXPENSES WILL ERODE AND MAY EXHAUST THE APPLICABLE LIMIT OF LIABILITY AND WILL BE APPLIED AGAINST THE RETENTION. THE UNDERWRITER WILL HAVE NO OBLIGATION TO PAY JUDGMENTS, SETTLEMENTS, CLAIM EXPENSES OR BREACH EVENT SERVICES AND EXPENSES ONCE THE APPLICABLE LIMIT OF LIABILITY IS EXHAUSTED BY CLAIM EXPENSES OR OTHERWISE. PLEASE READ THE ENTIRE APPLICATION CAREFULLY BEFORE SIGNING. APPLICATION INSTRUCTIONS Whenever used in this Application, the term "Applicant" shall mean the organization identified in response to Question 1 of Section I General Information. I. GENERAL INFORMATION 1. Name of Applicant: 2. Address of Applicant: City: State: Zip Code: Telephone: Website: 3. State of incorporation: Date of incorporation: 4. Authorized individual (Executive Officer) to receive notices and information regarding the proposed coverage: Name: Title: E-Mail Address: Phone: Fax: II. SPECIFIC INFORMATION 1. Please indicate below the insuring agreements that are being requested. Note: The requested coverage is not automatically provided. The terms and conditions applicable to the insuring agreements, if issued, will determine actual coverage. Insuring Agreements Requested Limits of Liability Requested Retention Requested Network Security and Privacy Liability Website Media Occurrence Liability Extortion Threat Breach Event Business Interruption Event and Network Data Event Page 1 of 10
2. Describe nature of the Applicant s business: 3. Is the Applicant owned or operated by a state, city, town or county or by an agency, authority or other governmental or quasi-governmental entity established by state or local law? Yes No If Yes, by whom? 4. Please complete the following information: Revenue Current 12 Months As of ( / / ) to ( / / ) Revenue Projected Next 12 Months As of ( / / ) to ( / / ) US Revenue Foreign Rev Total US Revenue Foreign Rev Total 5. Employees: Previous twelve (12) months: Projected next twelve (12) months: How many employees are dedicated to IT Security? III. MANAGEMENT OF INFORMATION 1. Does the Applicant employ a Chief Information Officer? Yes No 2. Does the Applicant employ a Chief Security Officer? Yes No 3. Do the above positions report to the Board of Directors? Yes No 4. Does the Applicant have a corporate-wide privacy policy? Yes No 5. Have the Applicant s privacy policies been reviewed and approved by an attorney? Yes No 6. How often are the company s policies reviewed and updated? 7. Does the Applicant maintain formal employee on-boarding and off-boarding procedures? Yes No 8. Does the Applicant have restricted employee access to private information? Yes No 9. Does the Applicant have internal training for employees concerning the handling of data security and private, personal, and sensitive information, including phishing and social engineering attacks? Yes No 10. Are employee background checks, including criminal background, completed on employees who will have access to Personally Identifiable Information? Yes No 11. In the past twenty-four (24) months, has the Applicant undergone an internal or external privacy or network security audit or assessment? Yes No 12. Have all recommendations been implemented? Yes No If No, please explain: 13. Personally Identifiable Information: Approximate number of individual records stored on Applicant s network: Page 2 of 10
14. Does the Applicant collect, receive, process, transmit, or maintain private, sensitive, or personal information as part of its business activities? Yes No If Yes, please indicate what type: Type of Data Credit/Debit Card Data Social Security Numbers Bank Accounts and Records Customer Information Confidentiality Agreements Other: Number of Records Type of Data Medical Records Employee/HR Information Intellectual property of others Medical Information Trade Secrets Number of Records i. Is any of this information regulated by HIPAA, GLB, the Data Protection Act or any other law or regulation protecting private, sensitive, or personal information? Yes No ii. Does the Applicant have written procedures in place to comply with laws governing the handling or disclosure of such information, including any Red Flag Rules? Yes No iii. Does the Applicant share private, sensitive, or personal information gathered from customers (by the Applicant or others) with third parties? Yes No iv. If Yes to the above question (iii), is permission obtained? Yes No 15. Is sensitive information collected in written form? Yes No a. If Yes, how is it disposed? 16. Does the Applicant process payments on behalf of others? Yes No 17. Does the Applicant have a vendor approval process? Yes No 18. Does the Applicant require vendors to carry professional liability insurance? Yes No 19. Does the Applicant require a written contract with all vendors? Yes No a. If Yes, are all contracts reviewed by the internal legal department or an outside law firm? Yes No 20. Does the Applicant require that contracts with outside companies and vendors necessitate those companies to defend and indemnify the Applicant in the event there is any loss arising out of the release or disclosure of private, sensitive, or personal information due to the outside company or vendor s negligence? Yes No IV. NETWORK SECURITY INFORMATION 1. Does the Applicant have a written and tested: a. Disaster Recovery Plan? Yes No b. Business Continuity Plan? Yes No c. Data Loss Prevention Plan? Yes No d. Computer security policy? Yes No e. Procedure to change default credentials? Yes No f. Laptop security policy? Yes No g. Removable Media/USB Policy? Yes No h. Remote Access Policy? Yes No i. Mobile Device/Smartphone Policy? Yes No j. Breach Disclosure Policy? Yes No Page 3 of 10
How often are the above policies and Plans updated and tested? 2. Does the Applicant store sensitive data on web servers? Yes No 3. Does the Applicant store personally identifiable or other confidential information on laptops, smart phones, memory sticks or other mobile devices? Yes No 4. Is the Applicant s data below encrypted: Yes No a. If Yes, please describe the encryption technologies used for each: At-rest: In-Transit: Mobile devices: b. If No, please describe any offsetting measures: 5. Can the Applicant indentify when private, sensitive, or personal information is downloaded to a mobile memory device or sent in an email? Yes No a. At-rest Yes No b. In-Transit Yes No c. Mobile devices (laptops, smart phones, memory sticks or other mobile devices) Yes No 6. Does the Applicant use third-party technology service providers? Yes No a. If Yes, what services does the Applicant utilize: i. Hosting of Applicant s network: Yes No ii. Maintenance: Yes No iii. Website hosting: Yes No iv. Storage and back-up of electronic data: Yes No v. Storage and back-up of sensitive data: Yes No vi. Other: 7. Do network administrators maintain separate accounts for administration purposes from the accounts they use for general network connectivity? Yes No 8. Are internal applications assessed for vulnerabilities, such as SQL Injection Attacks and buffer overflows? Yes No 9. Does the Applicant use security and firewall technology? Yes No a. Are firewalls configured to examine both incoming and outgoing traffic? Yes No 10. Are border firewalls configured to restrict outbound connections (egress filtering) to only Yes No business related services? 11. Does the Applicant host services directly accessible from the public internet? Yes No a. If Yes, please indicate what services: i. E-Commerce Yes No ii. Customer Portal Yes No iii. Dynamic Data (inventory, quote, etc.) Yes No iv. General Information Yes No v. Other: Page 4 of 10
b. If Yes to above, are the publically accessible servers segmented from the internal LAN with a firewall? Yes No 12. Is it the Applicant s policy to up-grade all security software as new releases/improvements Yes No become available? 13. Is a patch management solution in place? Yes No a. Is the patch management solution capable of patching Microsoft as well Yes No as third-party application? b. How quickly are upgrades installed? 14. Is there a managed anti-virus solution in place? Yes No a. Is anti-virus software installed on all of the Applicant s computer systems, including laptops, personal computers, and networks? Yes No b. How often are updates applied? 15. Does the Applicant use intrusion detection software to detect unauthorized access to internal networks and computer systems? Yes No 16. Does the Applicant have a formal documented user and password procedure in place? Yes No 17. Does the Applicant limit access to network servers and hardware? Yes No 18. Are all servers located in a physically secure location? Yes No 19. Is physical access to the servers logged? Yes No 20. Is physical access to the servers monitored with video surveillance? Yes No 21. Does the Applicant provide remote access to its network? Yes No a. Is remote access restricted to Virtual Private Networks (VPNs)? Yes No 22. Does remote access connectivity to the network require two-factor authentication? Yes No 23. Are internal or external database access connections logged? Yes No If so, how frequently are they audited? 24. Are user accounts automatically locked out after a specified number of invalid logon Yes No attempts? a. How many failed attempts? b. How long before the account is locked out? 25. Is wireless network connectivity available? Yes No a. What security requirements are employed? i. WEP ii. WPA - PSK (Pre-Shared Key or password-based authentication) iii. WPA EAP (Extensible Authentication Protocol or user-based authentication) 26. How often is private/personal/sensitive/valuable information archived? Page 5 of 10
a. How long is the information stored? b. Is the information stored in an off-premises secondary site? Yes No 27. Does the Applicant terminate all associated computer access and user accounts when an employee leaves the company? Yes No 28. Are the Applicant s internal networks, databases, and computer systems subject to third party audit and monitoring? Yes No a. If Yes, when was the last audit? b. Have all improvements and recommendations been implemented? Yes No c. If No, please explain: 29. Does the Applicant have a secondary site available if the primary site becomes inoperative? Yes No 30. How long before the second site becomes operational? 31. Is the Applicant Payment Card Industry (PCI) Data Security Standard compliant? Yes No a. If Yes, please select level of compliance: 1 2 3 4 V. MEDIA INFORMATION 1. Do employees have access to information or training about intellectual property rights? Yes No 2. Does the Applicant utilize third parties to create content for its media and advertising activities? Yes No a. Are third parties required to execute indemnity and hold-harmless agreements and provide proof of insurance? Yes No 3. Does the Applicant have a procedure for responding to or taking down displayed content that is libelous, defamatory, plagiarizing, infringing, or in violation of a third party s privacy rights? Yes No 4. Does the Applicant have a qualified attorney review all content prior to posting on the Internet? Yes No VI. CURRENT INSURANCE INFORMATION Coverages Does the Applicant currently purchase? (Yes) (No) Current Limit of Liability Current Retention Network Security and Privacy Liability or similar coverage $ $ $ Website Media Occurrence Liability or similar coverage $ $ $ Extortion Threat or similar coverage $ $ $ Breach Event or similar coverage $ $ $ Premium Current Carrier Page 6 of 10
Business Interruption Event and Network Data Event or similar coverage $ $ $ VII. CLAIMS AND REPRESENTATIONS/PRIOR KNOWLEDGE OF FACTS/CIRCUMSTANCES 1. Has the Applicant suffered any known intrusions, unauthorized access, or been a target of a security or virus incident of its networks or computer systems in the most recent past twenty-four (24) months? Yes No a. If Yes, how many such events occurred? If any damage was caused by any such events, including lost time, lost business income, or costs to repair any damage to networks or computer systems or to reconstruct data or software, describe the damage that occurred, and state value of any lost time, income and the costs of any repair or reconstruction: 2. During the past five (5) years, has the Applicant or any individual or entity proposed for coverage submitted any claims or losses or given notice of any fact, circumstance, situation, transaction, event, act, error, or omission which the Applicant or such individual or entity had reason to believe might or could reasonably be foreseen to give rise to a claim or loss that might fall within the scope of insurance with any insurer or self-insurance instrument of which the requested coverages would be a direct or indirect replacement? Yes No If yes, please provide details: NOTE: WITHOUT PREJUDICE TO ANY OTHER RIGHTS OR REMEDIES OF THE UNDERWRITER, IT IS AGREED THAT ANY CLAIM OR LOSS REQUIRED TO BE DISCLOSED IN RESPONSE TO THIS QUESTION 2 IS EXCLUDED FROM THE PROPOSED INSURANCE, AND THAT ANY CLAIM OR LOSS ARISING FROM ANY FACT, CIRCUMSTANCE, SITUATION, TRANSACTION, EVENT, ACT, ERROR, OR OMISSION REQUIRED TO BE DISCLOSED IN RESPONSE TO THIS QUESTION 2 IS EXCLUDED FROM THE PROPOSED INSURANCE. 3. Is the Applicant or any individual or entity proposed for coverage aware of any fact, circumstance, situation, transaction, event, act, error or omission which the Applicant or such individual or entity has reason to believe may or could reasonably be foreseen to give rise to a claim or loss that may fall within the scope of the proposed insurance? Yes No If yes, please provide details: NOTE: WITHOUT PREJUDICE TO ANY OTHER RIGHTS OR REMEDIES OF THE UNDERWRITER, IT IS AGREED THAT ANY CLAIM OR LOSS ARISING FROM ANY FACT, CIRCUMSTANCE, SITUATION, TRANSACTION, EVENT, ACT, ERROR OR OMISSION REQUIRED TO BE DISCLOSED IN RESPONSE TO THIS QUESTION 3 IS EXCLUDED FROM THE PROPOSED INSURANCE. VIII. ATTACHMENTS Please attach copies of the following documents for the Applicant and all entities seeking coverage: 1. Last audited or accountant-prepared financial statement with notes Page 7 of 10
IX. FRAUD WARNINGS Any person who knowingly and with intent to defraud any insurance company or another person, files an application for insurance containing any materially false information or conceals for the purpose of misleading, information concerning any fact material thereto, may be guilty of committing a fraudulent insurance act, which is a crime and subjects the person to criminal and civil penalties. NOTICE TO ALABAMA AND MARYLAND APPLICANTS: Any person who knowingly or willfully presents a false or fraudulent claim for payment of a loss or benefit or who knowingly or willfully presents false information in an application for insurance is guilty of a crime and may be subject to fines and confinement in prison. NOTICE TO ARKANSAS, MINNESOTA, AND OHIO APPLICANTS: Any person who, with intent to defraud or knowing that he/she is facilitating a fraud against an insurer, submits an application or files a claim containing a false or deceptive statement is guilty of insurance fraud, which is a crime. NOTICE TO COLORADO APPLICANTS: It is unlawful to knowingly provide false, incomplete, or misleading facts or information to an insurance company for the purpose of defrauding or attempting to defraud the company. Penalties may include imprisonment, fines, denial of insurance, and civil damages. Any insurance company or agent of an insurance company who knowingly provides false, incomplete, or misleading facts or information to a policy holder or claimant for the purpose of defrauding or attempting to defraud the policy holder or claimant with regard to a settlement or award payable from insurance proceeds shall be reported to the Colorado division of insurance within the department of regulatory agencies. NOTICE TO DISTRICT OF COLUMBIA APPLICANTS: WARNING: It is a crime to provide false or misleading information to an insurer for the purpose of defrauding the insurer or any other person. Penalties include imprisonment and/or fines. In addition, an insurer may deny insurance benefits, if false information materially related to a claim was provided by the applicant. NOTICE TO FLORIDA APPLICANTS: Any person who knowingly and with intent to injure, defraud or deceive any insurer files a statement of claim or an application containing any false, incomplete, or misleading information is guilty of a felony of the third degree. NOTICE TO KENTUCKY APPLICANTS: Any person who knowingly and with intent to defraud any insurance company or other person files an application for insurance containing any false information, or conceals for the purpose of misleading, information concerning any fact material thereto, commits a fraudulent insurance act, which is a crime. NOTICE TO LOUISIANA, NEW MEXICO AND RHODE ISLAND APPLICANTS: Any person who knowingly presents a false or fraudulent claim for payment of a loss or benefit or knowingly presents false information in an application for insurance is guilty of a crime and may be subject to civil fines and criminal penalties. NOTICE TO MAINE, TENNESSEE, VIRGINIA AND WASHINGTON APPLICANTS: It is a crime to knowingly provide false, incomplete or misleading information to an insurance company for the purpose of defrauding the company. Penalties may include imprisonment, fines, or a denial of insurance benefits. NOTICE TO NEW JERSEY APPLICANTS: Any person who includes any false or misleading information on an application for an insurance policy is subject to criminal and civil penalties. NOTICE TO OKLAHOMA APPLICANTS: Any person who knowingly and with intent to injure, defraud or deceive any insurer, makes any claim for the proceeds of an insurance policy containing any false, incomplete or misleading information is guilty of a felony. NOTICE TO OREGON AND TEXAS APPLICANTS: Any person who makes an intentional misstatement that is material to the risk may be found guilty of insurance fraud by a court of law. NOTICE TO PENNSYLVANIA APPLICANTS: Any person who knowingly and with intent to defraud any insurance company or other person files an application for insurance or statement of claim containing any materially false information, or conceals for the purpose of misleading, information concerning any fact material thereto, commits a fraudulent insurance act, which is a crime and subjects such person to criminal and civil penalties. NOTICE TO PUERTO RICO APPLICANTS: Any person who knowingly and with the intent to defraud, presents false information in an insurance request form, or who presents, helps or has presented a fraudulent claim for the payment of a loss or other benefit, or presents more than one claim for the same damage or loss, will incur a felony, and upon conviction will be penalized for each violation with a fine of no less than five thousand dollars ($5,000) nor more than ten thousand dollars ($10,000); or imprisonment for a fixed term of three (3) years, or both penalties. If aggravated circumstances prevail, the fixed established imprisonment may be increased to a maximum of five (5) years; if attenuating circumstances prevail, it may be reduced to a minimum of two (2) years. Page 8 of 10
X. DECLARATIONS AND SIGNATURES The undersigned, as authorized agent of all individuals and entities proposed for this insurance, declares that, to the best of his/her knowledge and belief, after reasonable inquiry, the statements in this Application and any attachments or information submitted with this Application (together referred to as the "Application") are true and complete. For Florida accounts, the preceding sentence is replaced with the following: The undersigned, as authorized agent of all individuals and entities proposed for this insurance, represents that, to the best of his/her knowledge and belief, after reasonable inquiry, the statements in this Application and any attachments or information submitted with this Application (together referred to as the Application ) are true and complete. The information in this Application is material to the risk accepted by the Underwriter. If a policy is issued it will be in reliance by the Underwriter upon the Application, and the Application will be the basis of the contract. The information contained in and submitted with this Application is on file with the Underwriter and, along with the Application, will be considered physically attached to, part of, and incorporated into the policy, if issued. For North Carolina, Utah and Wisconsin accounts, this Application and the materials submitted with it shall become part of the policy, if issued, if attached to the policy at issuance. The Underwriter is authorized to make any inquiry in connection with this Application. The Underwriter's acceptance of this Application or the making of any subsequent inquiry does not bind the Applicant or the Underwriter to complete the insurance or issue a policy. The information provided in this Application is for underwriting purposes only and does not constitute notice to the Underwriter under any policy of a claim or loss or a potential claim or loss. If the information in this Application materially changes prior to the effective date of the policy, the Applicant will immediately notify the Underwriter, and the Underwriter may modify or withdraw any quotation or agreement to bind insurance. RETURN COMPLETED APPLICATION PLUS ANY ATTACHMENTS AND OTHER INFORMATION TO YOUR INSURANCE AGENT OR BROKER. NOTICE TO NEW YORK APPLICANTS: Any person who knowingly and with intent to defraud any insurance company or other person files an application for insurance or statement of claim containing any materially false information, or conceals for the purpose of misleading, information concerning any fact material thereto, commits a fraudulent insurance act, which is a crime and shall also be subject to a civil penalty not to exceed five thousand dollars and the stated value of the claim for each such violation. Date Signature* Title Chief Executive Officer *This Application must be signed by the chief executive officer of the Applicant acting as the authorized representative of the individual(s) and entity(ies) proposed for this insurance. Page 9 of 10
Produced By: Agent: Agency: Agency Taxpayer ID or SS No.: Agent License No.: Address City: State: Zip Code: Submitted By: Agency: Agency Taxpayer ID or SS No.: Agent License No.: Address City: State: Zip Code: NOTE: FOR NEW HAMPSHIRE APPLICANTS, PRODUCER S NAME AND SIGNATURE ARE REQUIRED. Page 10 of 10