The situation 

A visibly concerned client contacts you and asks the following question: “Am I covered for data that is lost or corrupted?” In the same breath, he tells you that his transactional website suffered a cyber attack, and he was forced to take his business off-line until he could assess potential losses. Due to the size of his company (20 employees) and his line of business (flowers, plants and horticultural products), your client never imagined that he would be the target of a cyberattack … until today.

What does the Civil Code say? 

Your client’s worries are understandable. Under the Civil Code of Québec¹ his business may be held liable if it has not taken the reasonable means at its disposal to protect its clients.  

Fortunately, the web hosting provider’s investigation determined that the security and integrity of the personal data held by your client’s business were not compromised. Moreover, the website was down for less than two hours. However, the fact remains that business was disrupted, potential sales were lost, and users suffered an inconvenience that should have been avoided. Not to mention the stress it caused your client. 

What is your ethical responsibility with respect to cyber insurance? 

This story raises several questions. Would the client’s existing policy have covered the data loss or corruption, or would a cyber security endorsement added to the policy have done so? Should you suggest cyber insurance to your client? And if so, how do you ensure that you have properly analyzed his needs, and the coverages required? 

Two principles govern your ethical obligations in this area:

• The duty to advise (s. 27 of the Act respecting the distribution of financial products and services): “Insurance representatives must inquire into their clients’ situation to assess their needs. They must ensure to appropriately advise their clients regarding matters that fall within the sectors in which they are authorized to act; if they can, they shall offer their clients a product that meets their needs.” 
• The obligation to have the required knowledge and abilities (s. 17 of the Code of ethics of damage insurance representatives): “Before accepting a mandate, a damage insurance representative must take into account the limits of his abilities and knowledge and the means available to him. He must not undertake or continue a mandate for which he does not have the necessary skills, without obtaining the proper assistance.” 

With this in mind, here are five best practices that allow you to properly fulfill your advisory role, bridge the information gap between you and your client—who often lacks specialized knowledge on cyber insurance—and add value to the service you provide as a professional. 

2. Understanding the client’s business practices 

Unsurprisingly, the human factor is and continues to be the reason for 90% of security breaches³. Since the majority of cyber attacks and claims result from exploiting vulnerabilities for which solutions exist, a good starting point when evaluating the client’s needs is to ask about their current business practices.

Asking questions is the royal road to success. Here are a few examples of such questions: 

• Do you have a cyber security policy and are your clients aware of it? 
• Do you carry out supplier-recommended software updates? 
• Do you periodically back up the data hosted on your desktops and online?
• What type of data do you keep? Is it sensitive data?⁴ 
• Have you determined who can access which computers and the data they can access? 
• Do you require strong passwords and two-step authentication? 
• Do you encrypt your data as well as the contents of your desktops and laptops? 
• Do you have a secure website that encrypts the data exchanged between the client’s browser and your transactional website?
• Do you use a spam filter and a firewall? 
• Do you periodically do penetration testing?
• Do your employees receive regular training on preventive measures they should implement?

These questions and their answers allow you to identify many of your client’s needs, both in terms of the best business practices to implement as well as the need to purchase cyber insurance, if applicable. You are acting as an effective advisor by reminding your clients that every practice they use to shield their operations, hardware and IT infrastructure from attack is an undeniable asset that will lower their risks and protect their stakeholders. These practices could even help lower their insurance premiums. 

4. Explain using real-life cases  

Since a business’s reliance on technology (such as e-commerce solutions) and on digital services (such as cloud computing) exposes the client to cyber security risks, tell your client this story, about a real-life incident that befell an SMB in Quebec [article in French only]. In the spring of 2021, a ransomware attack paralyzed the company just as they were about to purchase a cyber risk insurance policy. The policy cost $20,000; the company evaluated that the attack cost them $250,000. 

And just to show that no one is safe, the ransomware attack that paralyzed Colonial Pipeline, a company that transports almost 45% of fuel consumed on the eastern U.S. seaboard, resulted in the total interruption of the pipeline’s operations, a state of emergency declaration, and a ransom payment of $4.4 million.