CYBER LIABILITY COVERAGE

Understanding Your Cyber Liability Coverage: Why You Should Consider Increasing Your Limits

In today’s digital world, nonprofit organizations face increasingly sophisticated cyber threats, making it critical to ensure they have adequate protection through Cyber Liability insurance. While the Christian Brothers Risk Pooling Trust offers Cyber Liability coverage to its members, many organizations might not fully understand the limits of their current policies and why it is crucial to consider increasing those limits. This article aims to clarify what Cyber Liability insurance is, why it is vital for nonprofit organizations, and why reviewing your coverage limits and having a reactive plan in place should be top priorities.

What Is Cyber Liability Insurance?

Cyber Liability insurance is a specialized form of coverage designed to protect organizations from the financial impact of cyberattacks, data breaches, and other cyber-related incidents. These incidents can include the theft of sensitive data, ransomware attacks, business interruption due to system downtime, and damage to an organization's reputation. In the event of a cyberattack, Cyber Liability insurance helps cover the costs associated with legal fees, data recovery, breach notification to affected individuals, regulatory fines, and even public relations efforts to mitigate reputational damage.

Why Cyber Liability Insurance Is Important for Nonprofits

For nonprofit organizations, the consequences of a cyberattack can be especially severe. These organizations often hold sensitive data on donors, employees, and beneficiaries, making them prime targets for cybercriminals. Without the right coverage, a single cyberattack could drain resources, damage the organization’s reputation, and hinder its ability to fulfill its mission.

Nonprofit organizations are often seen as easy targets by cybercriminals because they may lack the robust cybersecurity infrastructure that larger, for-profit companies have in place. Cybercriminals know that nonprofits handle sensitive information, such as donor financial data, employee records, and potentially confidential information about those they serve. The impact of a cyberattack on a nonprofit can be devastating, not only financially but also in terms of lost trust and damaged relationships with donors and stakeholders.

Moreover, nonprofits often operate on tight budgets, meaning the costs associated with responding to a cyberattack—including legal expenses, data restoration, and regulatory penalties—could severely impact their financial health. Cyber Liability insurance provides a critical safety net to help cover these costs, allowing nonprofits to recover more quickly and continue their mission with minimal disruption.

Why You Should Consider Increasing Your Cyber Liability Limits

Many organizations may not realize that their current Cyber Liability policy limits are insufficient to cover the full cost of a significant cyberattack, meaning their organization could quickly exceed those limits and be left to cover the remaining costs out of pocket.

Cyberattacks have grown more expensive over the years. According to a 2023 IBM report, the average cost of a data breach in the United States is $9.44 million. For nonprofit organizations, even smaller-scale attacks can result in hundreds of thousands of dollars in expenses. Without adequate limits on your Cyber Liability insurance, your organization could face financial hardship in the wake of an attack.

To avoid this situation, we strongly encourage members of the Risk Pooling Trust to work with our team to understand our coverage and limits provided. We can offer help to your organization with opportunities for excess Cyber Liability coverage, which is most likely needed. Adding coverage can significantly increase your policy limits, providing your organization with a larger financial buffer in the event of a major cyber incident. This additional protection can make a critical difference in helping your organization recover quickly and with minimal financial strain. Christian Brothers Services understands the importance of this coverage and we are currently researching opportunities to develop members solutions in the future.

Cyber-attacks are increasing and becoming more sophisticated

According to the U.S. Government Accountability Office:

2023 saw the highest number of reports of attacks, with 91% resulting in data exfiltration along with a steady decline of file encryption.
The education sector experienced a steep rise in ransomware attacks, with an 84% increase over the first six months of 2023, largely driven by one “cyber gang” called Vice Society.
In 2023, $158K was the median ransom payment.
Social engineering attacks (phishing emails) have steadily increased over the past five years and continue to catch unaware employees leading to data access or fraudulent financial activities.
On average, organizations lose over four days of downtime dealing with a cyber-attack, with a recovery period lasting around 30 days.

Planning for a Cyberattack: Are You Prepared?

One of the most important things your organization can do to mitigate the impact of a cyberattack is to have a reactive plan in place. Imagine this scenario: It’s Monday morning, and you turn on your computer only to be greeted by a ransom demand from a cybercriminal. Your files are encrypted, your systems are offline, and your organization’s critical data is being held hostage. What do you do next?

Without a plan, this situation could spiral out of control, leading to panic, delays, and costly mistakes. That is why every organization—especially those with limited Cyber Liability coverage—should have a well-developed response plan ready to go in the event of an attack. This plan should outline the steps your team will take to respond quickly and effectively, minimizing damage and ensuring a swift recovery.

To better educate your employees on how they can help prevent a cyberattack, CBS Risk Management Services has developed a Cyber Security Awareness Toolkit and over 18 different online training modules, Members of the Risk Pooling Trust can utilize for free.

Risk Controls to Protect Your Organization

There are basic controls that will better protect you from cyber hackers.

Create a cyber incident response plan (templates available upon request). Be prepared to respond in case of a data breach.
Educate staff through phishing email simulations, participation in training, and understanding of their role in cybersecurity.
Understand your risk
- What sensitive data does your organization have?
- Who has access to this data?
- How are you protecting it?
Review your IT plan
- Do you have backups of data that are secure and disconnected from the network
- Do you require multi-factor authentication to log into email, data, etc.
- Is your staff being tested on phishing emails?
- Is your data being scanned for vulnerabilities?
- Do you have endpoint detection response software in place?

Did you Know…

According to Gallagher Risk Management, these are the core cyberthreats facing nonprofits:

Ransomware: Use of malicious software to disrupt computer operations, gather sensitive information, or gain access to private computer systems
Social engineering/funds transfer: The psychological manipulation of people performing harmful actions or divulging confidential information
System failure: Unplanned network outage caused by system error
Human error: While these incidents may lack malicious intent, the human element is uncontrollable
Insider threats: Employees and volunteers entrusted to access and process sensitive data resorting to criminal activity

Key Components of a Cyberattack Response Plan

If your organization doesn’t already have a cyberattack response plan in place, now is the time to create one. The following are essential steps that should be included in any effective reactive plan:

Incident Response Team: Designate an internal team responsible for managing cyber incidents. This team should include IT staff, legal counsel, public relations personnel, and other key decision makers.
Immediate Actions: Establish a clear protocol for what to do in the first 24-48 hours following a cyberattack. This could include disconnecting affected systems from the network, assessing the scope of the attack, and notifying relevant stakeholders.
Communication Plan: Ensure you have a strategy in place for communicating with employees, donors, beneficiaries, and other key stakeholders during and after an attack. Transparency is crucial to maintaining trust.
Legal and Regulatory Compliance: Be prepared to notify affected individuals and comply with any legal or regulatory reporting requirements, such as notifying data protection authorities or law enforcement.

Data Recovery: Work with your IT team or a third-party vendor to restore encrypted or compromised data from backups and begin restoring your systems.
Public Relations: Have a plan for managing the public relations fallout from a cyberattack. Consider working with a PR firm that specializes in crisis communication.
Notify Us: Risk Pooling Trust members should contact Christian Brothers Risk Management Services immediately after an incident to initiate the claims process. We will ensure you understand what services your policy covers, such as legal assistance, forensic investigations, and breach notification.

Protect Your Organization with the Right Coverage and a Solid Plan

Cyberattacks are a growing threat, and no organization—nonprofit or otherwise—is immune. By understanding the limits of your current Cyber Liability coverage, working with us to secure excess coverage, and having a reactive plan in place, you can better protect your organization from the potentially devastating impact of a cyberattack.

At Christian Brothers Risk Management Services, we are here to help you navigate your Cyber Liability policy and ensure that you have the protection you need. Contact our team today at 800.807.0300 or via email to review your policy, discuss excess coverage options, and learn more about how to strengthen your organization’s cyber defense.

Remember, the time to prepare is before an attack happens—not after.

rmscustomerservice@cbservices.org

800.807.0300