Cyber Risk and Privacy

What is insured?

Insurance coverage is available to university units and departments to recover financial costs incurred as a result of lost or stolen data, violation of privacy laws, intellectual property infringement and social media risk.

Coverage extends to:

• Business interruption
• Data Recovery
• Cyber Extortion
• Media Content privacy violations
• Crisis management
• Notification/credit monitoring
• Liability for damages to third parties

Coverage does not extend to personal property of employees, visitors or students.

What do I do if I have a claim?

• Units are required to report potentially serious incidents immediately (within 24 hours) to Information and Technology Services (ITS) in accordance with the university’s Incident Reporting Policy (SPG 601.25).
• Although units are required to report only serious incidents to IIA, low- and medium-severity incidents should be reported in instances where there are possibly recoverable losses.
• The Information and Infrastructure Assurance (IIA) Office will follow its standard protocol to manage the incident response, address security concerns, and recommend appropriate remediation per applicable incident response procedures. In addition, IIA will:
  • Notify Insurance and Claims Administration immediately upon report of a potentially covered incident including the following information as applicable:
    • All reasonably obtainable information with respect to time, place, nature and circumstances. In instances where there are multiple incidents (e.g., compromised accounts) all with the same origin or source, it is the responsibility of the unit to aggregate the incidents into one incident report.
• All demands, summonses, notices or other papers filed by a court, administrative agency or investigative body should be provided concurrently to the Office of the General Counsel and Insurance and Claims Administration.
• The reporting unit is responsible for tracking and reporting the applicable dollar amounts for a claim on the Proof of Loss form. This form must be forwarded to Insurance and Claims Administration accompanied by documentation substantiating the amount of loss being claimed.
• RMS will process the claim, and act as a liaison between the affected university departments and the insurance company. IIA will receive the final disposition related to each claim.

Is there a deductible?

No deductible is charged for coverage.