Category: Directors & Officers

New AI-specific insurance exclusions underscore risks associated with generative artificial intelligence

Anita Byer

Generative Artificial Intelligence (GAI) is a type of artificial intelligence that creates new content (text, images, audio, video) in response to basic user prompts. Many organizations are now exploring ways to leverage this transformative technology to advance operational and business objectives. But despite its seemingly limitless upside, the operational use of GAI introduces new, potentially significant liability exposures. The consequences of failing to control organizational risks associated with GAI are underscored by the fact that insurance companies are beginning to include AI-specific coverage exclusions in their commercial general liability policies.

The operational use of GAI can expand existing and generate new liability exposures. According to Verisk, a data and analytics company, these exposures may include the following.

Copyright infringement and invasion of privacy. If the datasets used to train a GAI model contain copyrighted or sensitive information (many do), such information may end up in the new content generated by GAI. This could result in claims of copyright infringement and privacy invasions.

Professional errors & omissions. AI models are increasingly being trained to dispense expert-level professional advice, but their output continues to include mistakes or “hallucinations.” If the professional guidance provided by an AI chatbot is flawed or incorrect, the organization may be exposed to claims of professional malpractice.

Products liability. GAI is increasingly being used in design and product manufacturing applications. With its current limitations, GAI may create or produce defective or poorly designed products capable of causing serious damage or injury to those who use or are otherwise exposed to them.

Bias and discrimination. AI tools have been known to recreate patterns of bias and discrimination that are present in their training datasets. GAI output that includes biased or discriminatory components may result in claims of unlawful discrimination.

Compliance and regulatory risks. GAI is increasingly being used to assist with critical compliance and regulatory functions. But as we know, GAI’s output can be flawed or incorrect. If, for example, a public company submits a false or misleading document created by GAI to the SEC, the lack of due diligence could expose the organization to D&O and professional liability claims.

Importantly, the Insurance Services Office (ISO), an advisory organization that provides standard policy forms and rating information to insurers, recently introduced Generative Artificial Intelligence exclusions for commercial general liability policies. Under these exclusions, claims for bodily injury, property damage, and personal advertising injury that arise out of GAI are not covered by insurance.

These exclusions may present a big problem for many organizations because they apply broadly to all claims arising out of “generative artificial intelligence,” which is defined as a machine-based learning system or model that is trained on data with the ability to create content or responses, including but not limited to text, images, audio, video or code. Many anticipate that general liability policies will increasingly include AI-specific coverage exclusions going forward. Organizations using generative artificial intelligence operationally must ensure that their insurance covers the new and expanded liability exposures created by GAI.

The Volunteer Protection Act protects volunteers, not nonprofit organizations

The federal Volunteer Protection Act (VPA) was enacted to protect volunteers from liability if they cause harm to another while working on behalf of a nonprofit organization. Many nonprofit organizations that rely on volunteers believe that the protections afforded by the VPA extend to the organization itself. This belief, however, is incorrect, and the consequences of this misunderstanding can be severe for nonprofit organizations.

The VPA essentially promotes volunteerism by reforming the laws to provide certain protections from liability abuses related to volunteers serving nonprofit organizations. Pursuant to the VPA, no volunteer of a nonprofit organization (or governmental entity) shall be liable for harm caused by an act or omission of the volunteer on behalf of the organization if:

  • the volunteer was acting within the scope of the volunteer’s responsibilities in the nonprofit organization at the time of the act or omission;
  • the volunteer, if appropriate or required, was properly licensed, certified, or authorized by the appropriate authorities for the activities or practice in the State in which the harm occurred, where the activities were or practice was undertaken within the scope of the volunteer’s responsibilities in the nonprofit organization or governmental entity;
  • the harm was not caused by willful or criminal misconduct, gross negligence, reckless misconduct, or a conscious, flagrant indifference to the rights or safety of the individual harmed by the volunteer; and
  • the harm was not caused by the volunteer operating a motor vehicle, vessel, aircraft, or other vehicle for which the State requires the operator or the owner of the vehicle, craft, or vessel to possess an operator’s license or maintain insurance.

 

While a volunteer may be protected if they cause harm to another person under these circumstances, there are exceptions. Specifically, the VPA’s limitations on the liability do not apply to any misconduct that:

  • constitutes a crime of violence or act of international terrorism for which the defendant has been convicted in any court;
  • constitutes a hate crime under the Hate Crime Statistics Act;
  • involves a sexual offense under applicable State law, for which the defendant has been convicted in any court;
  • involves misconduct for which the defendant has been found to have violated a Federal or State civil rights law; or
  • occurs while the defendant was under the influence of alcohol or drugs.

 

Note that while the VPA protects volunteers under appropriate circumstances, it does not protect the nonprofit organization itself. The law specifically states that the VPA should not be construed to affect the liability of any nonprofit organization with respect to harm caused to any person. In other words, nonprofit organizations generally face nearly identical risks as their for-profit counterparts.

Since nonprofit organizations do many of the same things for-profit businesses do (own/lease property, provide services, drive cars, etc.), nonprofit organizations must approach risk management like any other for-profit business. This includes maintaining adequate insurance coverage to protect against any exposures unique to its operations.

If you would like to learn more about reducing the risks facing your nonprofit organization, please contact us.

 

Training for Florida condominium board members is now mandatory

By Anita Byer, Setnor Byer Insurance & Risk

Get certified in Florida now!

 

A recent statutory amendment substantially changed the training and certification requirements for those serving on the board of a Florida residential condominium association. The new board member training requirement, which was optional, is now mandatory. And, instead of completing a single training session, board members must now satisfy annual continuing education requirements. These changes, which became effective July 1, 2024, are significant because a director of a residential condominium association who fails to timely comply with Florida’s amended certification and training requirements will be suspended from service on the board.

Prior to July 1, 2024, newly elected or appointed directors of a residential condominium association had 90 days to certify, in writing, that they:

  • have read the association’s declaration of condominium, articles of incorporation, bylaws, and current written policies;
  • will work to uphold such documents and policies to the best of their ability; and
  • will faithfully discharge their fiduciary responsibility to the association’s members.

 

Instead of providing this written certification to the secretary of the association, board members previously had the option of completing a division-approved educational curriculum. This alternative method of compliance, however, is no longer available to board members. Under the amended statute, board members must submit both the written certification and a certificate of completing the mandatory educational curriculum.

Though the certification requirement has not materially changed, the training requirement has. The training may still be provided by the division or a division-approved condominium education provider, but the training content must comply with new statutory requirements. Under the amended statute, the educational curriculum must be at least 4 hours long and include instruction on milestone inspections, structural integrity reserve studies, elections, recordkeeping, financial literacy and transparency, levying of fines, and notice and meeting requirements.

The amended statute also includes a new continuing education requirement for board members. One year after submitting the most recent written certification and educational certificate, and annually thereafter, directors of residential condominium associations must submit to the association’s secretary a certificate of having satisfactorily completed at least one hour of continuing education relating to any recent changes to Florida’s Condominium Act or related administrative rules during the past year.

Additionally, under the amended statute:

  • Each newly elected or appointed director must submit their written certification and complete the required training within one year before being elected or appointed or 90 days after the date of election or appointment.
  • A director of residential condominium association who was elected or appointed before July 1, 2024, must comply with the written certification and educational certificate requirements by June 30, 2025.
  • The written certification and educational certificate are valid for 7 years after the date of issuance and do not have to be resubmitted as long as the director serves on the board without interruption during the 7-year period.
  • Each director’s written certification and educational certificate must be retained by the association for inspection by the members for 7 years after a director’s election or the duration of the director’s uninterrupted tenure, whichever is longer. Note that the failure to have such written certification and educational certificate on file does not affect the validity of any board action.

 

Remember, directors who fail to timely comply with the newly expanded certification and training requirements are suspended from service on the board until they achieve compliance. Board members must understand their certification and training requirements under the amended law to avoid potentially serious problems. Setnor Byer Insurance & Risk can help associations and board members identify, manage, and insure their unique risks. Please contact our team to discuss the various risk management services we provide our condominium association clients.

Florida Governor signs comprehensive condominium bill into law

By Anita Byer

On June 14, 2024, Florida Governor Ron DeSantis signed a comprehensive condominium bill into law. House Bill 1021 (Community Associations) includes numerous statutory amendments that relate to condominium governance and association management, most of which become effective July 1, 2024. That means board members do not have much time to determine if and how these amendments, including those set forth below, may affect their condominium association or its operations.

Milestone Inspections. Currently, single-family, two-family, and three-family dwellings are exempt from the milestone inspection requirements. On July 1, 2024, four-family dwellings with three or fewer habitable stories above ground will also be exempt from Florida’s milestone inspection requirements.

Official Records. Regarding an association’s official records, House Bill 1021:

  • provides that associations have a good faith obligation to obtain and recover lost or destroyed records;
  • makes e-mail addresses and facsimile numbers accessible to unit owners if consent to receive electronic notice has been provided (but prohibits selling or sharing such information to 3rd parties);
  • effective January 1, 2026, decreases from 150 units to 25 units the threshold requirement for an association to make specified records available on its website or on a mobile device; and
  • requires associations to maintain additional financial records (invoices and other documentation that substantiates receipts and expenditures).

 

Budgets, Financial Reporting, and Reserves. House Bill 1021:

  • prohibits associations from reducing the required type of financial statement (compiled, reviewed, or audited) for consecutive years; and
  • requires associations to provide unit owners with a notice that the structural integrity reserve study is available for inspection and copying within 45 days of completion, which may be provided electronically.

 

Meetings of Condominium Associations. The bill requires:

  • associations of 10 or more units to meet at least once each quarter, and at least four times each year, the meeting agenda must allow members an opportunity to ask questions of the board; and
  • notices for assessment meetings to include the cost and purpose of the assessments and a copy of any proposed contract.

 

Voting. Regarding voting in condominium associations, the bill:

  • requires associations to notify unit owners at least 90 days before an election that their voting rights may be suspended due to nonpayment of a fee or other monetary obligation; and
  • allows owners to electronically consent to electronic voting in elections.

 

Hurricane Protections. House Bill 1021 revises the requirements for the installation of hurricane protection, including:

 

Director Education. HB 1021 revises the education requirements for condominium officers and directors by requiring:

  • new directors to submit both the written certification that they have read the association’s governing documents, will work to uphold the documents to the best of their ability and faithfully discharge their duties, and submit a certificate of completion of an approved condominium education course;
  • four hours of training, including instruction on milestone inspections, reserve studies, elections, recordkeeping, finances, fines, and meetings;
  • directors to annually complete at least one hour of continuing education about recent changes to the condominium laws and rules during the past year; and
  • association directors to certify, on a form provided by the division, that all directors have completed the required written certification and educational certificate requirements.

 

Division of Condominium, Timeshares, and Mobile Homes. The bill expands the division’s post-turnover jurisdiction to include:

  • procedures and records related to various financial issues;
  • the election, removal and recall of board members;
  • maintenance of and access to association records;
  • meeting procedures (quorums, voting requirements, proxies, budget meetings, etc.);
  • conflicts of interest;
  • structural integrity reserve studies; and
  • written inquiries by unit owners to the association.

 

Pre-Sale Disclosures and Requirements. House Bill 1021 revises the form in which the prospective purchaser acknowledges receipt of specified documents, including a copy of the association’s most recent annual financial statement and annual budget.

Board members should be reviewing all new condominium-specific legislation, as well as any other applicable statutory amendments, to ensure compliance. A copy of House Bill 1021 is available here. Consultation with the association’s attorney may be necessary. Setnor Byer Insurance & Risk can help associations and board members identify, manage and insure their unique risks. Please contact our team to discuss the various risk management services we provide our condominium association clients, including our Division-Approved New Board Member Education.

Using indemnification agreements and additional insured status to allocate risk

By Anita Byer, Setnor Byer Insurance & Risk

Risk allocation involves identifying who is responsible for what and for how much. Business and commercial contracts, for example, typically require one party to assume the liability of another party. These risk transfers are increasingly being used in all kinds of agreements, including those with clients, landlords, sub-contractors, suppliers and vendors.

Since assuming responsibility for the acts of another is a significant undertaking, it is important to understand the nature and extent of the risk being assumed, and the consequences to your business in the event of a loss. This requires a basic understanding of indemnification agreements and Additional Insured status.

Indemnification

An indemnification agreement generally requires one party (the indemnitor) to assume the liability of another party (the indemnitee). In the event of a loss that is specified in the contract, the indemnitor agrees to compensate the indemnitee for their loss. It is important to understand that these provisions commonly require the indemnitor to assume liability that would not otherwise exist.

For example, construction contracts routinely include broad indemnification provisions that transfer liability for not only bodily injury or property damage, but also for pollution, design flaws, delays and other perils not typically understood or contemplated by the indemnitor. Therefore, the indemnitor must understand all the risks being assumed.

Additional Insured Status

Fortunately, insurance coverage is available to cover assumed (or transferred) risks, so indemnitors can use insurance to finance some of their assumed risks. But indemnitees often request or require their indemnitors to not only purchase insurance, but to also name them as an Additional Insured so they can directly access benefits under the indemnitor’s policy.

Though Additional Insured status can be used to finance indemnification obligations, it is important to know that there are limitations. For example,

  • Additional Insured status only protects against losses covered by the insurance policy, regardless of what the indemnification agreement requires.
  • Indemnitees must satisfy the policy’s requirements, such as meeting the definition of an Additional Insured and having a written contract.
  • An indemnitee’s protection may be compromised by shared coverage limits and a lack of control over the terms and conditions of an indemnitor’s policy.
  • Certificates of Insurance cannot be used to create or modify coverage under an insurance policy, regardless of what they say.

 

Before entering any contract that includes indemnification obligations and requires additional insured status, ask yourself the following questions.

  • What are the terms and implications of the indemnification provision?
  • Is the indemnitor required to obtain additional insured status for another?
  • Is the language of the additional insured endorsement adequate, covering the indemnitor’s responsibilities or must additional measures be taken to ensure that contractual obligations are properly financed?

 

When used properly, indemnification agreements and various insurance coverages can be combined to effectively allocate and finance assumed risks. Since the process of allocating and transferring risk in any business transaction is always significant and often complex, businesses should consult an experienced and licensed professional before signing on the dotted line. Please contact us to learn more about allocating and transferring risk effectively and affordably.

Florida changes milestone inspection requirements for condominiums

By Anita Byer, Setnor Byer Insurance & Risk

Numerous changes were recently made to Florida’s mandatory milestone inspection requirement for condominium associations. This statewide requirement was enacted last year to ensure aging condominium buildings that are three stories or more in height remain safe for continued use. Its fundamental purpose was to prevent a repeat of the tragic 2021 building collapse in Surfside, Florida. Now, condominium associations must determine the applicability and implications of Florida’s amended mandatory milestone inspection requirement.

Senate Bill 154 made quite a few changes to the milestone inspection requirement. Some were made for purposes of clarification. Others were made to address issues and ambiguities that were revealed after the law was enacted. All the changes, however, need to be reviewed and understood by board members statewide because any one of them could have significant implications for their condominium association.

For example, the new deadline to complete a building’s initial milestone inspection will be relatively meaningless to some associations, but crucial to others. Under the amended law, if a condominium building that is three or more stories in height reached 30 years of age before July 1, 2022, its initial milestone inspection must be done before December 31, 2024. But, if a building reaches 30 years of age on or after July 1, 2022, and before December 31, 2024, its initial milestone inspection must be done before December 31, 2025.

Some associations will also need to know that the 25-year milestone inspection for buildings located within three miles of the coastline is no longer mandatory. Instead, local agencies responsible for enforcing milestone inspections have the option to set a 25-year inspection requirement for buildings three stories or more in height if justified by local environmental conditions, including proximity to seawater.

The milestone inspection requirements for condominium buildings three or more stories in height were also amended to:

  • Limit milestone inspections to buildings that include a residential condominium;
  • Provide that milestone inspection requirements apply to buildings owned by mixed-use condominiums and clarify that all owners of a mixed-use condominium building are responsible for ensuring compliance and sharing costs;
  • Authorize local enforcement agencies to extend the inspection deadline for a building upon a petition showing good cause that the association has contracted with an architect or engineer to perform the milestone inspection and it cannot reasonably be completed before the deadline;
  • Permit local enforcement agencies to accept an inspection and report that was completed before July 1, 2022, if it substantially complies with the milestone requirements; however, associations must still comply with unit owner notice requirements. (Note: If a local enforcement agency accepts a previous inspection as a milestone inspection, the deadline for a subsequent 10-year re-inspection is based on the date of a previous inspection.);
  • Provide that the condominium association is responsible for all inspection costs attributable to the portions of the building for which it is responsible under the governing documents of the association;
  • Require associations to give unit owners notice about the inspection deadlines, electronically or by posting on the association’s website, within 14 days after they receive the initial milestone inspection notice from the local enforcement agency;
  • Require the milestone inspector to submit a phase two progress report to the local enforcement agency within 180 days of submitting the phase one inspection report; and
  • Clarify that an association must distribute a copy of the summary of the inspection reports to unit owners within 45 days of its receipt.

Given the potential significance of all the recent changes to Florida’s mandatory milestone inspection requirement, association board members should consider consulting a licensed professional to ensure compliance and avoid violations. Board members should also review their association’s Directors and Officers (D&O) insurance policy to confirm sufficient coverage as mistakes are more likely to happen whenever the law changes. Please contact our team to discuss the various risk management services available to our condominium association clients.

Florida condominiums preparing for initial structural integrity reserve study

By Anita Byer, Setnor Byer Insurance & Risk

Florida condominium associations are now required to complete a structural integrity reserve study for buildings that are three or more stories high. This new requirement was enacted during a special legislative session in response to last year’s Champlain Towers collapse in Surfside, Florida. The hope is that structural integrity reserve studies, coupled with Florida’s new milestone inspection requirement, will ensure aging buildings remain safe for continued use.

Structural integrity reserve studies must be completed at least every 10 years for each building on the condominium property that is three or more stories high. The deadline for existing associations to complete their initial structural integrity reserve study is December 31, 2024. The failure to complete the study as required by law is considered a breach of the board’s fiduciary duty.

So, what exactly is a structural integrity reserve study? It’s a study of the reserve funds that will be needed for future major repairs and replacement of the common areas based on a visual inspection. The visual inspection portion of the study must be performed by a Florida-licensed engineer or architect and must:

  • identify the common areas being visually inspected;
  • state the estimated remaining useful life and the estimated replacement cost or deferred maintenance expense of the common areas being visually inspected; and
  • provide a recommended annual reserve amount that achieves the estimated replacement cost or deferred maintenance expense of each common area being visually inspected by the end of the estimated remaining useful life of each common area.

The study must include the following items as they relate to the structural integrity and safety of the building.

  • Roof, floor, windows and foundation
  • Load-bearing walls or other primary structural members
  • Fireproofing and fire protection systems
  • Plumbing and electrical systems
  • Waterproofing and exterior painting
  • Any other item that has a deferred maintenance expense or replacement cost that exceeds $10,000 and the failure to replace or maintain such item negatively affects any of the foregoing items, as determined by the licensed engineer or architect performing the visual inspection portion of the study.

The new law makes it difficult for associations to avoid their obligation to maintain the structural integrity of buildings that are three or more stories high. For example, developers must complete a study before control of the association can be turned over to unit owners. And, beginning December 31, 2024, unit-owner controlled associations will not be able to vote to use reserve funds that are allocated to structural integrity for any other purpose.

Since this is a new requirement, condominium associations are strongly encouraged to consult with licensed professionals to avoid unintentional violations. Board members should also review their association’s Directors and Officers (D&O) insurance policy to confirm sufficient coverage. Setnor Byer Insurance & Risk can help condominium associations and board members identify, manage and insure their unique risks. Please contact our team to discuss the various risk management services we provide our condominium association clients, including our Division-Approved New Board Member Education.

5 things condominiums need to know about Florida’s new “milestone inspection” requirement

By Anita Byer, Setnor Byer Insurance & Risk

Florida enacted a new “milestone inspection” requirement for condominium associations to ensure aging buildings remain safe for continued use. The hope is that a statewide mandatory structural inspection requirement will prevent a repeat of last year’s tragic collapse in Surfside, Florida. Here are five things every condominium association board member needs to know about Florida’s new milestone inspection requirement.

1. What is a milestone inspection? A “milestone inspection” is a structural inspection of a building, including its load-bearing walls and primary structural systems, by a licensed architect or engineer. Its purpose is to confirm the life safety and adequacy of the building’s structural components and determine its general structural condition as it affects building safety. A milestone inspection should include, to the extent reasonably possible, a determination of any necessary maintenance, repair or replacement of any structural component of the building.

2. When is a milestone inspection required? Condominium associations must have milestone inspections performed for each building that is three stories or more in height by December 31 of the year in which the building reaches 30 years of age, and every 10 years thereafter. If the building is located within three miles of a coastline (direct contact with the open sea), a milestone inspection is required by December 31 of the year in which the building reaches 25 years of age, and every 10 years thereafter. A building’s age is based on the date the certificate of occupancy was issued.

Note that if a milestone inspection is required and the building’s certificate of occupancy was issued on or before July 1, 1992, the building’s initial milestone inspection must be performed before December 31, 2024.

3. What is a phase one milestone inspection? A milestone inspection consists of two phases. For phase one, a licensed architect or engineer performs a visual examination of a building, including its major structural components, and provides a qualitative assessment of the building’s structural condition. If no signs of substantial structural deterioration are found, then a phase two inspection is not required. “Substantial structural deterioration” means substantial structural distress that negatively affects a building’s general structural condition and integrity. It does not include surface imperfections (cracks, sagging, signs of leakage, peeling of finishes, etc.) unless they are a sign of substantial structural deterioration.

4. When is a phase two milestone inspection required? A phase two milestone inspection must be performed if any substantial structural deterioration is identified during phase one. The inspection may be as extensive or as limited as necessary to fully assess areas of structural distress in order to confirm that the building is structurally sound and safe for its intended use and to recommend a program for fully assessing and repairing distressed and damaged portions of the building. The phase two inspection may involve destructive testing at the inspector’s direction, though preference must be given to locations that are the least disruptive and most easily repairable.

5. What happens after a milestone inspection? Upon completion of a phase one or phase two milestone inspection, the architect or engineer must submit a sealed copy of the inspection report to the condominium association, along with a separate summary of material findings and recommendations. A copy must also be furnished to the appropriate local building authority. The inspection report must include all the information required by the statute. Condominium associations must then distribute the inspector’s summary to each unit owner and post a copy in a conspicuous place on the condominium property. Associations required to maintain a website must also make the full report and the inspector’s summary available online.

The new law makes each condominium association responsible for arranging milestone inspections and ensuring compliance with the law’s requirements. Associations are also responsible for all costs associated with the inspection. Since this is a new requirement, condominium associations are strongly encouraged to consult with licensed professionals to avoid unintentional violations. Board members should also review their association’s Directors and Officers (D&O) insurance policy to confirm sufficient coverage. Because when it comes to safety, there’s no room for error.

Setnor Byer Insurance & Risk can help condominium associations and board members identify, manage and insure their unique risks. Please contact our team to discuss the various risk management services we provide our condominium association clients, including our Division-Approved New Board Member Education.

New reporting requirement for Florida condominium associations

By Anita Byer, Setnor Byer Insurance & Risk

Did you know that a new reporting requirement for Florida condominium associations recently became law? It was enacted during a special legislative session in response to last year’s Champlain Towers collapse in Surfside, Florida. As a result, condominiums are now required to provide specific information about the buildings located on association property to the Division of Florida Condominiums, Timeshares and Mobile Homes. This must be done on or before January 1, 2023.

This information reporting requirement dovetails with Florida’s new mandatory structural inspection requirement for condominium buildings that are three or more stories high. According to the Florida Legislature, the imposition of a statewide structural inspection program for aging condominium buildings is necessary to ensure they remain safe for continued use. To further this goal, condominium associations must provide the following information to the Division.

  • The number of buildings on the condominium property that are three stories or higher in height.
  • The total number of units in all such buildings.
  • The addresses of all such buildings.
  • The counties in which all such buildings are located.

In addition to providing this information to the Division on or before January 1, 2023, condominium associations must also notify the Division of any changes within six months. This information, which must be provided in the form and manner set forth by the Division, will be used to create a list of condominium associations with buildings that are three stories or higher in height. The resulting list must be searchable by county and posted on the Division’s website.

Since this is a new requirement, condominium associations may want to consult with a licensed professional prior to the reporting deadline. Board members should also review their association’s Directors and Officers (D&O) insurance policy to confirm sufficient coverage. Mistakes are more likely to happen whenever you are doing something for the first time.

Setnor Byer Insurance & Risk can help condominium associations and board members identify, manage and insure their unique risks. Please contact our team to discuss the various risk management services we provide our condominium association clients, including our Division-Approved New Board Member Education.

Every Month Should Be Cybersecurity Awareness Month

By Anita Byer, Setnor Byer Insurance & Risk

October may officially be Cybersecurity Awareness Month, but that doesn’t mean businesses can afford to take the rest of the year off. Gone are the days when cybersecurity was seen as an ancillary function. Today, businesses should be thinking of cybersecurity as an essential core function, because that’s precisely what it has become. A single cybersecurity incident can threaten a business’s operations, reputation, bottom line, and in some cases, its very survival.

Protecting against cyber risks, like other operational risks, requires a holistic approach. According to the Department of Homeland Security’s Cybersecurity & Infrastructure Security Agency (CISA), businesses need to develop and maintain a culture of cyber readiness. This is obviously easier said than done, but it’s not impossible. CISA recommends incorporating the following essential elements to increase the likelihood of successfully creating a culture of cyber readiness.

Your Leaders. Workplace culture often reflects leadership, so any changes must start at the top. Ownership and management must invest the time, money and resources needed to effectively drive cybersecurity strategies, policies and procedures.

Your People. Making people part of the first line of defense against cyberattacks reduces vulnerabilities and drives a culture of ownership. Personnel must be trained to recognize cybersecurity risks, like phishing, password hacks and malware.

Your Systems. Cybersecurity requires knowing which devices are connected to your network, which applications are in use, who has access to these, and the security measures in place. A cyber-ready business proactively keeps its systems up-to- date and secure.

Your Surroundings. Access to your digital environment, like access to your physical workplace, must be limited. Setting access privileges and establishing operational procedures requires knowing who operates on your technology and with what level of authorization and accountability. User and access management is a complex, yet crucial component of cybersecurity.

Your Data. Information that is stored, processed or transmitted must be protected. Identify and backup all critical and sensitive data and have plans in place to recover and restore systems, networks and data in the event of an attack.

Your Crisis Response. Plan, prepare and conduct drills for cyber-attacks and incidents, like a fire drill. This involves having incident response plans and procedures, trained staff, assigned roles and responsibilities, and incident communications plans.

While a culture a cyber readiness can significantly enhance cybersecurity, it isn’t foolproof. Every business should have Cyber Perils Insurance Coverage to protect against various cyber threats and liability exposures, including the cost of complying with data breach notice laws. Please contact us if you would like more information about insurance specifically designed to protect against cyber threats and data security breaches.