REPORT/RECOMMENDATION TO THE BOARD OF SUPERVISORS
OF SAN BERNARDINO COUNTY
AND RECORD OF ACTION
June 27, 2023
FROM
VICTOR TORDESILLAS, Director, Department of Risk Management
SUBJECT
Title
Renewal of County’s Cyber Liability Insurance Program
End
RECOMMENDATION(S)
Recommendation
1. Approve the renewal of the County’s Cyber Liability Insurance Program, which includes the following layers, with total coverage limits of $30,000,000 in excess of $1,500,000 self-insured retention, for a total premium of approximately $2,054,280, for the one-year period of July 1, 2023, through July 1, 2024:
a. A primary layer of $5,000,000 in excess of $1,500,000 self-insured retention, for a premium of approximately $565,062 with Indian Harbor Insurance Company.
b. A secondary layer of $5,000,000 in excess of $5,000,000 primary layer, for a premium of approximately $452,050 with Starr Insurance Company.
c. A third layer of $5,000,000 in excess of $10,000,000 of underlying insurance, for a premium of approximately $373,392 with Ironshore Insurance Company.
d. A fourth layer of $5,000,000 in excess of $15,000,000 of underlying insurance, for a premium of approximately $261,374 with Berkley Insurance Company.
e. A fifth layer of $10,000,000 in excess of $20,000,000 of underlying insurance, for a premium of approximately $402,402 with Lloyds.
2. Authorize the Director of the Department of Risk Management to execute the binding order on behalf of the County.
(Presenter: Victor Tordesillas, Director, 386-8621)
Body
COUNTY AND CHIEF EXECUTIVE OFFICER GOALS & OBJECTIVES
Operate in a Fiscally-Responsible and Business-Like Manner.
FINANCIAL IMPACT
Approval of this item will not result in the use of additional Discretionary General Funding (Net County Cost). The total premium of approximately $2,054,280 will be paid from the Department of Risk Management’s (DRM) liability funds and will be recovered through Board of Supervisors (Board) approved rates charged to County departments and Board Governed Special Districts. Sufficient appropriation and revenue are included in DRM’s 2023-24 Budget.
BACKGROUND INFORMATION
The DRM administers the County’s self-insurance programs for public liability and workers’ compensation claims and procures excess insurance policies for additional protection, including a Cyber Liability Insurance Program. The Cyber Liability Insurance Program provides first party coverage for County losses, mitigating costly expenses related, but not limited to breach response, crisis management, and a ransomware type of cyber-attack. This program also includes coverage for third party losses related, but not limited to defense, awards, and fines.
The County has established contracts with four insurance brokers, Alliant Insurance Services, Inc, Arthur J. Gallagher & Co., James & Gable Insurance Brokers, and Willis Towers Watson Insurance Services. The Insurance brokers are responsible for conducting a thorough analysis of all current insurance programs to identify coverage overlaps and/or coverage deficiencies, and to compare and evaluate current programs against available insurance markets to determine if the current placements are the most cost-effective alternatives.
On June 14, 2022 (Item No. 74), the Board approved the renewal of the County’s Cyber Liability Insurance Program, for a total premium of approximately $1,792,453, for the period of July 1, 2022, through July 1, 2023.
Approval of Recommendation No. 1 will provide a new one-year coverage period of July 1, 2023, through July 1, 2024, for a total premium of approximately $2,054,280. This represents an increase of $262,313 or approximately 14.6% over last year’s final premium cost of $1,791,967. Several factors contributed to this increase, including the hardening of the insurance market, an increase in the severity and complexity of ransomware incidents, and breaches affecting private and public entities during the previous year. The County has implemented several measures to mitigate these risks. These measures include conducting annual Cyber Security Training, annual Anti-Phishing Security Awareness Training, and management of threat intelligence with partners at the federal level.
The recommended renewal of the Cyber Liability Insurance Program will provide terms similar to last year’s policies with total coverage limits of $30,000,000. The self-insured retention (SIR) will increase from $500,000 to $1,500,000 per occurrence and the 20% co-insurance on ransomware will be eliminated. The DRM recommends the renewal of the County’s Cyber Liability Insurance Program to provide coverage for the following risks: third party liability, media, privacy and cyber security, privacy regulatory defense, awards and fines, first-party business interruption and extra expenses, data recovery, cyber extortion and/or ransomware, data breach response, and crisis management.
A final premium amount will not be available until closer to the actual renewal date due to the complexity of the negotiations the County’s broker engages in with multiple insurance carriers on behalf of the County to develop the insurance coverage. Recommendation No. 2 will authorize the Director of Risk Management to execute the binding order on behalf of the County, ensuring a timely renewal process with no lapse in coverage.
PROCUREMENT
On November 16, 2021 (Item No. 62), the Board approved contracts with insurance brokers, including Arthur J. Gallagher & Co. Insurance Brokers of California, Inc. (Arthur J. Gallagher & Co.), for the period of December 11, 2021 through December 10, 2026. DRM contracts with multiple brokers to leverage the experience each holds in a specific market. Arthur J. Gallagher & Co. was selected to be the County’s insurance broker for this program due to their experience and expertise in this market. Arthur J. Gallagher & Co. approached new and existing markets for quotes, successfully obtaining a proposal for the Cyber Liability Insurance Program, for the period of July 1, 2023, through July 1, 2024.
REVIEW BY OTHERS
This item has been reviewed by County Counsel (Laura Crane, Principal Assistant County Counsel, 387-5455) on June 12, 2023; Purchasing (Leo Gomez, Purchasing Manager, 387-2063) on June 2, 2023; Human Resources (Diane Rundles, Assistant Executive Officer, 387-5570) on June 2, 2023; Finance (Ivan Ramirez, Administrative Analyst, 387-4020) on June 16, 2023; and County Finance and Administration (Paloma Hernandez-Barker, Deputy Executive Officer, 387-5423) on June 16, 2023.