Re: Cybersecurity Insurance

["Hagan, Sean" <sean.hagan () YC EDU>]

We’ve had coverage for several years now – originally used a broker like MSU Denver and ended up with AIG, and now via 
our state’s risk retention pool.  Coverage limit of $30M, but that’s aggregate for all claims for the year.

Some companies provide added value to your cyber liability coverage with packet shunning devices or security awareness 
training materials (or other elements).  RiskAnalytics (formerly via AIG) and Bandura Cyber (currently via AIG) are two 
vendors that come to mind.  We’ve used both and have been pleased with the value and functionality.

In terms of determining coverage amount, I have no idea how our financial and risk group came up with that.  It’s 
considerably higher than what some of our peers have, but if you operate off the assumption of a cost of $200 per lost 
record (according to IBM, the average was $233 for US orgs in 2018) and you have, say, 150,000 records, you can see how 
those costs would quickly eat through your coverage assuming a major system of record were compromised.



From: The EDUCAUSE Security Community Group Listserv <SECURITY () LISTSERV EDUCAUSE EDU> On Behalf Of Hart, Michael
Sent: Friday, June 7, 2019 1:01 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: Re: [SECURITY] Cybersecurity Insurance

MSU Denver decided to obtain coverage.  Our president tasked our General Counsel office with leading the effort.  They 
went through a broker, who gave us a number of quotes from different providers.

From: The EDUCAUSE Security Community Group Listserv <SECURITY () LISTSERV EDUCAUSE EDU<mailto:SECURITY () LISTSERV 
EDUCAUSE EDU>> On Behalf Of Colleen Keller
Sent: Friday, June 7, 2019 12:13 PM
To: SECURITY () LISTSERV EDUCAUSE EDU<mailto:SECURITY () LISTSERV EDUCAUSE EDU>
Subject: Re: [SECURITY] Cybersecurity Insurance

Hi Lance,

You may want to check out the resources on the Cyber Insurance topic page in our library.
https://library.educause.edu/topics/cybersecurity/cyber-insurance<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flibrary.educause.edu%2Ftopics%2Fcybersecurity%2Fcyber-insurance&data=02%7C01%7Cmhart20%40MSUDENVER.EDU%7Cea4e6152c3c7490e6f1f08d6eb73d382%7C03309ca417334af9a73cf18cc841325c%7C1%7C0%7C636955280125763407&sdata=XQBg940LW5lmNcaYjjkxHHscaukfjSruOFQIkupGd5M%3D&reserved=0>
Please let me know if you have any questions, thank you.

Colleen Keller Electronic Resources Librarian


EDUCAUSE<https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.educause.edu%2F&data=02%7C01%7Cmhart20%40MSUDENVER.EDU%7Cea4e6152c3c7490e6f1f08d6eb73d382%7C03309ca417334af9a73cf18cc841325c%7C1%7C0%7C636955280125773396&sdata=w5lEmk%2B%2FUgLzxgNtmw7UHLRf%2B3SmcEUvV348SKjm4UQ%3D&reserved=0>
Uncommon Thinking for the Common Good
direct: 303.939.0309 | main: 303.449.4430 | 
educause.edu<https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.educause.edu%2F&data=02%7C01%7Cmhart20%40MSUDENVER.EDU%7Cea4e6152c3c7490e6f1f08d6eb73d382%7C03309ca417334af9a73cf18cc841325c%7C1%7C0%7C636955280125773396&sdata=w5lEmk%2B%2FUgLzxgNtmw7UHLRf%2B3SmcEUvV348SKjm4UQ%3D&reserved=0>
 | Twitter: @EDUCAUSEreview



From: The EDUCAUSE Security Community Group Listserv <SECURITY () LISTSERV EDUCAUSE EDU<mailto:SECURITY () LISTSERV 
EDUCAUSE EDU>> On Behalf Of Lance Hourany
Sent: Friday, June 7, 2019 12:03 PM
To: SECURITY () LISTSERV EDUCAUSE EDU<mailto:SECURITY () LISTSERV EDUCAUSE EDU>
Subject: [SECURITY] Cybersecurity Insurance

Are any of your institutions currently protected by cybersecurity insurance?  If so, can you briefly state how you 
determined the amount of insurance coverage you landed on.

Thank you,

Lance

[IT_PMSU_2C-rgb_12]
Lance Hourany
Interim Chief Technology Officer
Lph5 () stmarys-ca edu<mailto:Lph5 () stmarys-ca edu>
Office 925-631-4767
Cell 925-788-5299
[Green, SSMC square logo]