2025 Excess Cyber Risk Insurance Indication

AID 1820196 · View on Simbli

Agenda Item

ii. Renewal of the District’s Excess Cyber Risk Insurance Policy (Not to exceed $143,884)

Summary: Presented by: Mr. H. Eric Hilton, Chief Legal Officer, Division of Legal Services
Request: It is requested that the Board of Education approve the renewal of the District’s Excess Cyber Risk Insurance coverage with Liberty Surplus Insurance Corporation (“Liberty”), for $143,884. This cost is an early indication of the renewal quotation. Although not anticipated, the final quotation from Liberty may exceed this figure.
Why: The DeKalb County School District (“District”) currently has an Excess Cyber Risk Insurance Policy with Liberty. The coverage was purchased in February of 2024. That short-term policy expired on July 1, 2024; at which time it was renewed for a full year. The current insurance policy will expire on July 1, 2025. Therefore, the District must select an insurance carrier to renew this coverage for the fiscal year 2026.

After conducting research, the renewal of excess cyber insurance coverage is recommended due to continuing attempts by hackers to infiltrate computer networks of state, county, and local governmental entities. Educational entities have also been targets for cyber-attacks. Since there is a high potential for loss in this area that could impact the District’s financial position, excess insurance coverage is recommended.
Details: This item requests that the Board of Education approve the renewal of the District’s Excess Cyber Liability Insurance Policy with Liberty. The Alliant Property Insurance Program (“APIP”) currently provides the underlying coverage for the District’s cyber liability. Liberty has insured the District’s Cyber Liability exposure since February of 2024 when coverage was purchased to enhance the existing coverage provided as part of the District’s property insurance through APIP.
Financial impact: This is a budgeted expense within the Risk Management budget. The cost code is 100.2600.552000.00011.7490.9990.8010.080.7498. The amount of the premium is $143,884.
Contact: Mr. H. Eric Hilton, Chief Legal Officer, Division of Legal Services, 678-676-0159

Mr. Glinton R. Darien, Jr., Director of Legal Affairs, Division of Legal Services, 678-676-0403
Effective: July 1, 2025
Status: Approved by the Office of Legal Affairs
DEKALB COUNTY SCHOOL DISTRICT

   Excess Cyber Risk Insurance Renewal
                 Indication
        July 1, 2025 to July 1, 2025




                                      May 2, 2025


Prepared by:
Alexis Tolbert, Account Executive
Brittany Palmquist, Account Manager

                                                    1
ACCOUNT SERVICE TEAM


  ACCOUNT EXECUTIVE, PRINCIPAL            LATOYA COTTON- ROBINSON, CRM, CIC, CISR
                                                           DIRECT DIAL 678.205.5949
                                        E-MAIL – LATOYA.COTTON@EPICBROKERS.COM


  ACCOUNT EXECUTIVE, PRINCIPAL                            ALEXIS TOLBERT, AIAM, CIC
                                                           DIRECT DIAL 379.205.1165
                                       E-MAIL – LATOYA.COTTON@EPICBROKERS.COM

  ACCOUNT MANAGER                                        BRITTANY PALMQUIST, CISR
                                                          DIRECT DIAL 678.957.2526
                                   E-MAIL – BRITTANY.PALMQUIST@EPICBROKERS.COM


  VICE PRESIDENT, CLAIMS MANAGER                              CHANTELLE PATTERSON
                                                            DIRECT DIAL 678.475.5706
                                                            DIRECT FAX 678.475.3858
                                   E-MAIL - CHANTELLE.PATTERSON@EPICBROKERS.COM


  RISK CONTROL                                          MICHAEL NISCHAN, CDS, CCSP
  SERVICE REPRESENTATIVES                                   DIRECT DIAL 678.475.5720
                                                                MOBILE 678.938.2012
                                                            DIRECT FAX 678.475.3852
                                       E-MAIL – MICHAEL.NISCHAN@EPICBROKERS.COM


                                                                       MIKE FOLMER
                                                            DIRECT DIAL 678.242.1377
                                                                MOBILE 678.215.8024
                                           E-MAIL – MIKE.FOLMER@EPICBROKERS.COM




                                                                                       2
EXECUTIVE SUMMARY

 Edgewood Partners Insurance Center (EPIC) is pleased to represent DeKalb County School District (DCSD) in its risk management and
 insurance programs. EPIC is committed to providing you with quality products and services that exceed your expectations.
 Accordingly, our purpose is to assist every employee and to act on your behalf with others in protecting the human and physical
 assets of DeKalb County School District and its ability to deliver education and other critical services. Like DeKalb County School
 District, EPIC measures success by how well we meet the needs of our Clients. Therefore, your input is critical in shaping the quality
 of services we bring to you.

 Today, we are presenting DCSD with an early indication of the July 1, 2025 to July 1, 2026 Excess Cyber Liability Insurance Renewal
 Pricing. We are proud to announce a flat renewal per expiring. The APIP program currently provides coverage for the District’s
 Cyber Liability (Underlying) coverage. Which was presented with the property at a nice decrease overall for the marketplace.

 Here are the trends we examine in the Guide:

 Data Collection: Cyber insurance coverage for wrongfully collected information—collecting personal information without the
 individual giving proper consent—is unsettled at best. Data collection is the most consistent coverage aspect that needed
 negotiation throughout 2024, and the trend is likely to continue this year.

 Security Tools: In 2024, multiple carriers started offering some cybersecurity tools directly, positioning their cyber insurance
 product as a backstop to protecting businesses. This trend will continue in 2025.

 CISO Coverage: Coverage for chief information security officer (CISO) liability can be found in both cyber policies and well-
 brokered directors and officers (D&O) policies. Some carriers are now offering a stand-alone policy to cover CISO personal
 liability.

 Third-Party Risks: Cyber insurance carriers are looking for clients to have a robust third-party risk management program that
 includes strong contractual language, cybersecurity certifications from vendors, and requirements for vendors to purchase
 cyber or technology errors & omissions (E&O) insurance.

 An annual survey of cyber insurance carriers, we asked underwriters about the current risk environment, their risk appetite,
 and future pricing expectations.

 Although ransomware remains the most significant threat for underwriters, our survey reveals privacy violations and data
 breaches have gained prominence compared to last year. Here are a few other takeaways from the survey:

 37% of underwriters believe cyber risk will increase greatly in 2025, fewer than last year.
 48% of underwriters predict an increase in premiums.
 53% of underwriters expect cyber coverage to expand slightly.
 26% (versus 12% last year) of underwriters expect scrutiny to decrease this year.




                                                                                                                                          3
EXECUTIVE SUMMARY

  As done last year listed below is a marketing summary for your review. We appreciate the partnership, and it has
  been a pleasure working alongside the district to assure all needs are met. We look forward to your bind request
  and any questions or concerns you may have in the near future.

  Carrier                                         Response


  Liberty Surplus Insurance Corporation           Quoted flat per expiring
  (Incumbent)
  AXA/ XL                                         Declined not able to compete with current rate/terms

  Zurich                                          Declined. Not within their appetite
  Resilience                                      Declined. Requires fully completed Cyber application as well as
                                                  additional time to underwrite.
  Travelers                                       Declined. Not within their appetite.

  Coalition                                       Not Competitive. Would require at least a $500K SIR.




                                                                                                                     4
EXCESS CYBER LIABILITY


COMPANY:          Liberty Surplus Insurance Corporation                        POLICY TERM          07/01/2025 to 07/01/2026
POLICY #:         TBD                                                          PREMIUM:             $138,000 Pure Premium
                                                                                                    $ 350 Wholesale Broker Fee
                                                                                                    $5,534 Surplus Lines Tax (4%)
                                                                                                    $143,884 Total Premium




Retroactive Date: Follows APIP Cyber Underlying Policy
Coverage Form: Follow Form- Claims Made & Reported

Coverage & Limits: $2,000,000 Each Member Aggregate
                   $2, 000,000 Policy Aggregate

            Underlying             Layer        Insurer       Limits           Retention                Policy Period
            Insurance

                                   Primary      Beazley       $2,000,000       Follows APIP Cyber       07/01/2025 to 07/01/2026




            Sub- Limits (Per Member and Policy Aggregate                            Dedicated Limits In Excess of APIP Core

            Breach Response/ Notification Expense Costs                                      $500,000 (Non- Beazley Vendors)
                                                                                              $1,000,000 (Beazley Vendors)

            Business Interruption resulting from a System Failure                                       $500,000


            Dependent Business Interruption resulting from a Security Breach                            $750,000


            Cyber Extortion Loss                                                                        $750,000


            Data Recovery Loss                                                                          $750,000


            Business Interruption resulting from a Security Breach                                      $750,000


            Dependent Business Interruption resulting from a System Failure                             $100,000


            Fraudulent Instruction                                                                       $75,000


            Funds Transfer Fraud                                                                         $75,000


            Telephone Fraud                                                                              $75,000


            Computer Hardware Replacement (Bricking)                                                    $200,000

                                                                                                                                    5
EXCESS CYBER LIABILITY

   Sub- Limits (Per Member and Policy Aggregate                           Dedicated Limits In Excess of APIP Core

   Invoice Manipulation                                                                          $100,000


   Reputation Loss                                                                               $200,000


   Claims Preparation Cots For Reputation Loss Claims Only                                          NIL


   Criminal Reward                                                                                  NIL


   Cryptojacking                                                                                    NIL




   Group 1 Sub-limits subject to Qualifiers:
   • Breach Response Costs
   • Business Interruption System Failure
   • Business Interruption Security Breach
   • DBI System Failure
   • DBI Security Breach
   • Cyber Extortion Loss
   • Data Recovery Costs
   • Computer Hardware Replacement
   • Reputational Loss
       -Group 1, As a condition precedent to the coverage specified in Group 1, the Insured must have satisfied the
      following conditions prior to the occurrence of such incident. Claim or Loss:
         a. Enforce Multifactor Authentication for all remote and privileged access
         b. Close all RDP ports if not in use
         c. If RDP ports are in use:
                1. Restrict RDP access by IP addresses via firewall rules and only allow trusted IP addresses to access the port
                2. Place all RDP services behind a VPN and protect them using Two- Factor Authentication



   Group 2 Sub-limits subject to Qualifiers:
   • Fraudulent Instruction
   • Telephone Fraud
   • Funds Transfer Fraud
   • Invoice Manipulation
      -Group 2, As a condition precedent to the coverage specified in Group 2, the Insured must have satisfied the
      following conditions prior to the occurrence of such incident, Claim or Loss:
       a. Provided formal training to employees with respect to computer crime and social engineering
       b. Required multiple forms of verification for all fund transfers and all changes to client, vendor or supplier details
       such as routing numbers, account numbers and phone numbers.


   Endorsements &              •   Sanction Limitation and Exclusion Clause-1
   Exclusions:                 •   Warranty Endorsement
                               •   Pending & Prior Litigation Endorsement
                               •   Following Specified Sublimit- With Conditions
                               •   Disclosure- Terrorism Risk Insurance Act


                                                                                                                                   6
EXCESS CYBER LIABILITY


  NOTES        •   Quote terms, conditions, and premiums subject to change depending on
                   the APIP cyber program’s underlying aggregate program limit
               •   BI and DBI coverages subject to $750K aggregate sublimit, as per
                   underlying Beazley policy




                                                                                          7
PREMIUM SUMMARY RECAP


   Coverage                                           Policy Period                         Premium

   Excess Cyber Liability ($2M xs
                                            07/01/2025 to 07/01/2026                       $143,884
   $2M)

   Total                                                                                   $143,884




  Companies/ A.M. Best’s Rating                                                 Payment Plan

  Liberty Surplus Insurance Corporation/ A.M. Best Rated A (Excellent)          Paid In Full Upon Binding
  Financial Size Category: XV ($2 Billion Or Greater)




 The cost reflected below is an early indication of the renewal quotation expected to be received June 1st . Should the final
 quotation totals exceed that provided below, APIP is not bound by that which is reflected in this indication.


 NOTES:
 • This indication is based on the current loss experience, market conditions, increases in underwriting information and is
   subject to change if this insured’s loss ratio deteriorates further and/ or if the markets suffer a catastrophic event.
 • Coverage outlined in this Proposal is subject to the terms and conditions set forth in the policy.
 • Please refer to the Policy for specific terms, conditions and exclusions.
 • Change in total Insurable Values (TIV) will result in adjustment in premium.




                                                                                                                                8