In this podcast, Ken Tucker of Changescape Web talks with Al Rodriguez of Webb Insurance about Cyber Liability Insurance. Al is the Commercial Lines Sales Manager. As a licensed professional, Al possesses extensive knowledge in Commercial Insurance specializing in package policies, including Cyber Insurance and Technology Liability Insurance.
| Ken Tucker: | Good afternoon, Ken Tucker here with Changescape Web. Today, I’m here with Al Rodriquez of Webb Insurance. Al is a business insurance specialist.
One of the things that I’ve been wanting to talk about for a while is what kinds of insurance do businesses need. One of the biggest emerging issues for business insurance is how you deal with cyber and technology related issues. Today, I thought we would have an expert in the subject, in terms of insurance coverage and what not, come in and talk to us about what you can expect in regard to cyber insurance and technology related issues. With that, I would like to introduce Al Rodriquez. |
| Al Rodriguez: | Hey Ken, thanks for having me. I’m happy to be here, and happy to dive into the subject. |
| Ken Tucker: | Okay. Well thanks Al. I really appreciate you taking the time, because I think this is a really important topic. In the world of technology, every business is dealing with technology today, you see stuff that’s happening on the political campaign with people’s emails being hacked, what liabilities does any of these companies have, websites are being attacked more and more. I think it’s got to be a topic that’s probably on a lot of people’s minds. With that, let’s go ahead and get started. I’ve got a few questions that I’d like to ask you and just get your feedback on those. |
| Al Rodriguez: | Sure. |
| Ken Tucker: | The first is really, can you explain what the difference is between technology and cyber liability insurance coverage? |
| Al Rodriguez: | That’s a very good question. Technology liability is for certain industries. Industries that deal with technology services, and technology manufacturing. An easier way to put it, is if you’re in the business of technology, whether … If the internet is your business, technology is the right coverage for you. Cyber liability would be for anybody else that uses the internet as a tool to conduct business. |
| Ken Tucker: | Okay. |
| Al Rodriguez: | Nowadays that would be pretty much everyone. |
| Ken Tucker: | Okay. For example, if I wrote an app for a smartphone, I’m in the technology business, I need technology coverage. |
| Al Rodriguez: | Correct, you would follow under the technology coverage. |
| Ken Tucker: | I would also probably still need the cyber- |
| Al Rodriguez: | You would. |
| Ken Tucker: | Insurance as well? |
| Al Rodriguez: | Correct. |
| Ken Tucker: | Okay. |
| Al Rodriguez: | You would. |
| Ken Tucker: | All right. Okay, great. Who needs technology insurance, versus cyber liability coverage? I know you talked a little bit about that, but can you go into a little bit more detail? |
| Al Rodriguez: | Right. Companies like yours, companies that specialize in IT services, web design, anything with data storage, backup centers, those would be the ideal businesses that would need the technology piece of the policy, as well as, the cyber liability policy. The cyber liability would be anyone that pretty much has a computer nowadays. If you use a computer for your business, whether it is to send an email, whether it is to backup some data, whether you hold personal or private third party data, you need cyber liability insurance. |
| Ken Tucker: | Okay. That’s not even … I mean, this is just the insurance aspect, we’re not even talking about the security technologies that you would need to invest in. That’s a completely different topic for another day. |
| Al Rodriguez: | Right. |
| Ken Tucker: | Next I guess I’d like to talk about is would a businesses data be covered under a general liability policy? I mean, it seems like there’s got to be a little bit of ambiguity there in terms of what people perceive as a general liability policy. |
| Al Rodriguez: | Correct, correct. A lot of people have the conception that the main general liability policy that they currently carry for their business will cover data. That’s just simply not the case. Anything defined as data is not covered under a general liability policy. Whether that be your data, like I said, third party data, any data that your holding, it’s not being covered under the basic general liability policy. You would have to endorse that onto your policy in order to have coverage for that. |
| Ken Tucker: | Okay, all right. Then I guess we ought to talk a little bit about retailers, because they do carry a lot of data typically for a lot of their customers. Can you talk about what they need to think about in terms of cyber insurance? |
| Al Rodriguez: | Yes, absolutely. As a retailer, you are responsible and liable for the data that you have. If you lose it, if it’s hacked, whatever the case may be, you could be held liable. Now a lot of us have nondisclosure agreements, or different agreements with our contractors that will make us feel safe, and say, “Well maybe I’m not responsible for that.” However, a lot of those contracts are depending upon you having certain restrictions and certain coverages, right? They’re assuming that you have cyber liability insurance, and that’s why they feel comfortable putting that into you. Having it is very important, and not assuming that, maybe your contract or your vendor might carry that liability, because they’re assuming that you’re going to carry that liability. |
| Ken Tucker: | Okay, interesting. Let’s talk a little bit about how cyber liability and social media are related. |
| Al Rodriguez: | Yes, social media is actually the fasting growing communication channel in the world. Most of us use some sort of social media, information is exchanged at lightning speeds, exposed to the world. As we all know, often we see very little controlled over what is said, how it’s presented, which gives arise to the liability of a business. You may not think so, but you could be liable for what your employees are posting on social media, whether that’s Facebook, LinkedIn, Twitter, especially if they’re doing it during work hours. A lot of small businesses use social media to market themselves, which is a great way to market yourself, but there also comes a big risk, and it is all that information that you’re putting out there, you could be liable for. You do have to be very careful who you’re entrusting that social media to, what is being posted, to make sure you’re not offending anyone, or make sure you’re not causing any harm and you’re liable, you’re not making comments that you would later regret, or anything of that sort. Yeah, it is … They go hand in hand. Like I said, it’s growing a lot faster that you can control it. |
| Ken Tucker: | Okay. Yeah, absolutely. I mean, we work with a lot of folks who do social media. A lot of times it’s a very small team of people, or just a single individual who might be doing social media that we’re working with. It’s really important to even factor that into your social media policy, so that you just already have clear expectations in terms of the tone, and the voice, and what you’re actually going to talk about and not. That leads me to a follow up question, and I don’t know if you’ve thought much about this or not, but what about in the area of reviews? Online reviews are really important, a lot of people go out there and write a lot of online reviews. Can you talk to me about how cyber insurance might relate to that? |
| Al Rodriguez: | Yes. Again, anything that you post online now, it’s pretty much there forever. There’s always going to be ways of tracking that, and even though you delete a post or whatever, there’s still ways that you can grab that info. Being extremely diligent in to knowing what’s being posted about your business, how to respond to that, is so, so key. You could get a bad review, something you don’t agree with. The best way would be to address it in a very positive manner, and showing people that as a business owner, as a manager, you are handling those issues in a professional way without slandering the other party, without making derogatory comments towards anybody, because it could be a potential liability claim against you and your business. That’s when cyber liability would come in, and in case something like that were to happen, cyber liability could help with a cost, with a defense cost, or any sort of cost arising from a lawsuit or from a claim. |
| Ken Tucker: | Wow. I just wonder how many businesses out there, especially on the small end of the scale have really thought about that. Which really I guess does lead me to another question, and it may be pretty obvious by now based on our conversation, but does a small business really need to have cyber liability? |
| Al Rodriguez: | Short answer, yes, would be yes. We just mentioned about how businesses are using social media to market themselves, because it is a very economic way to do things. When you do that, you have to make sure that you’re covered for certain stuff. When people think of cyber liability, they’re thinking of foreign parties that are going to come in and hack you, and so you think you’re not big enough, “Who’s going to want to hack my small business?” Well, part of that is true, and statistically speaking, you’re probably not … It’s not going to happen to you. However, we have to think about what’s being said, what’s being posted. Cyber liability could even help you with replying to an email. Maybe, and I’ve done this, you hit reply all instead of replying to the one party, and- |
| Ken Tucker: | That’s a great point. |
| Al Rodriguez: | You’re disclosing information that it wasn’t intended for everybody to know, it was just for that one party. Cyber liability could have coverage for that, and could give you protection for that, in case that ever were to happen. It doesn’t have to be that a foreign entity is hacking your server, or hacking your computer per say. It could be something as simple as replying to the wrong person with very sensitive information, right? |
| Ken Tucker: | Yeah. |
| Al Rodriguez: | Yeah, that’s a big risk. |
| Ken Tucker: | Interesting. Before you mentioned just replying to an email, I was going to ask about email marketing, because that’s another thing that a lot of small businesses, if they’re not using social media they may be doing some form of email marketing. Yes, the short answer is, yes. |
| Al Rodriguez: | Yes, absolutely. |
| Ken Tucker: | I will tell you, we put security plugins on a lot of our websites to just monitor brute force attacks to try and force their way in by guessing password and login credentials, and I have to say it would shock you to see how much small businesses are really actually being attacked. I would encourage every small business to really think about that. |
| Al Rodriguez: | Absolutely. |
| Ken Tucker: | Regardless of the type of websites you have, if you’ve got a website, if you do … If you have any online presence, if you use any form of electronic communication, you’re going to need to consider cyber insurance. |
| Al Rodriguez: | Absolutely, absolutely. |
| Ken Tucker: | Okay. Is cyber liability insurance, is it affordable? |
| Al Rodriguez: | That’s a very good question. A lot of people think that they’re going to have to second mortgage their house, or anything like that, to afford this coverage, and the reality of it, it’s no. It’s very affordable. As we move forward and time goes on, insurance companies are aware of this. What they’re doing, is a lot of them are already starting to provide some sort of cyber liability coverage within the general liability policy. They’re able to endorse it for some sort of data coverage, data breach, anything like that. The cost of it really, annually is going to be minimum. You don’t need a separate policy, aside from your regular general liability, you just need to endorse your general liability to make sure that it covers that scenario. A basic general liability, it’s not going to cover you. That’s why it’s important to contact your carrier, or when you’re shopping around for insurance, make sure that there is some sort of coverage in there for you. It depends again on the business that you’re in, how much coverage you need. If you’re a small diner, right? You’re probably not going to have the coverage that an attorney’s office might have, right? Just because it’s different kind of scenarios. Now- |
| Ken Tucker: | That’s right, yeah. |
| Al Rodriguez: | Both industries are exposed to it, and could fall victim of some sort of attack, or some sort of data breach. However, the claim could be very different, but a general liability policy won’t cover that, so we have to make sure that it’s added on to your policy. Short answer is, yes it’s very affordable, it’s not going to break the bank, and it’s readily available. I mean, endorsing the policy, and it’s effective immediately. |
| Ken Tucker: | Okay. Does the type of data have any implication here in terms of what coverage you really need to think about? I mean, a lot of small businesses, the information that they might have on their website, they don’t have client data stored on their website. Even in QuickBooks, they may be using a third party processing system for credit card processing for example, so they may not actually store, and hopefully they aren’t storing any credit card information or anything like that, but if you’re in the healthcare industry where you’ve got HIPAA regulations, or if you’re in a situation where PCI compliance is an issue, does that have stronger implications or different implications for cyber insurance? |
| Al Rodriguez: | It does, of course. It depends on the risk, how big of a risk. The lesser of that risk, like you just mentioned, so the smaller retailers that are using a third party, probably don’t need as much, or as complex coverage, as a risk that would handle medical information and hereby needs to follow HIPAA laws and HIPAA rules. Yeah, the coverage would differ at that point. However, you still need some sort of coverage. Just because you use PayPal, or you use a third party, doesn’t mean that you’re immune if that information were ever to become public. You still hold some degree of liability in there. That’s why it’s important to at least have something in there, but yes, it depends on the risk of the business that you would tailor that coverage into. It’s not like a cookie cutter coverage, it just really depends on your business, and how much of that data is actually being exposed, as well as, who’s handling that data. |
| Ken Tucker: | Okay, awesome. All right, great. Well thanks Al, I mean I learned a lot, this was really helpful for me. Hopefully other folks are going to find this valuable too, because this is a … I would assume this is an emerging area within the insurance space, and it’s obviously something that’s going to be commanding a lot more attention over time, and I think it’s something that all small businesses, and all large businesses, and everybody in between really should start to consider, and probably use this opportunity in listening to this podcast to go back and review their policies and make sure that everything’s all good. |
| Al Rodriguez: | Absolutely, absolutely. We always encourage that. Know what your coverages are, know what you’re buying, and if you’re unsure, you can always ask your agent. A lot of agents, not all of them, will be happy to review them. There’s usually no cost to that, having a third party doing so. If they do have some sort of a cost, the agent next to them they’re probably not going to charge you anything, right? Having an independent set of eyes look at that if you don’t feel comfortable with it, it’s a very good idea. Yes, always make sure that you know what you’re buying, what’s covered, and what’s excluded. Looking at that exclusion list is very important as well. |
| Ken Tucker: | Okay, awesome. Well thanks so much Al, this was great, and I look forward to another session with you sometime where you can help us be educated on another topic around insurance and your expertise. |
| Al Rodriguez: | Absolutely, thank you for having me. |
| Ken Tucker: | Thank you. |