Cyber and Professional Liability Insurance Application • intouch Insurance Services

Please List Any Companies That Are Not a Subsidiary of the Named Insured That You Wish to Have Covered Under This Policy (Confirm Ownership Structure, Relationship, and If Running on Same Network):

List the primary public facing websites for this insured (also attach a list of all domain names the insured owns):

Total number of employees:

Approximate number of customers (if a school, then number of students):

Percentage of your customers that are international or foreign based:

Do you have any customers that represent 50% or more of your business?

Yes

No

Provide a brief description of your business activities/professional services:

Detail any mergers and acquisitions undertaken in the last three (3) years (include retroactive dates of Cyber Liability and/or Professional Liability Coverage if applicable):

Name of Entity	Retro Date (if any)

Provide an estimated percentage breakdown of your total revenue by specific professional activity (only answer if you provide technology-based products and/or services):

Application Service Provider (ASP) services
Computer-Aided Manufacturing (CAM), Computer-Aided Engineering (CAE), Computer-Aided Design/Drafting (CAD) or real-time monitoring systems or software
Custom software development services
Data mining services
Domain Name Registration services
Electronic data processing services
ERP, CRM, supply chain or similar software and related services
Interactive electronic environments, virtual communities on-line dating and Social Networking
Intranets, extranets and intra-business networks management and related consulting services
IT systems analysis/design/integration/data migration and related consulting services
Local/long distance/fiber/satellite/cellular telecommunications services
Manufacturing, assembly, design, or development of technology or telecommunication products
Network security, audit, disaster recovery and related consulting services
Pre-packaged software development
Sale, lease or licensing of telecommunications or technology products of others (value-added resale)
Sale, lease or licensing of the software of others
Sale, lease or licensing of your telecommunications or technology products
Search engine services
Software maintenance and support services
Support services and training for software and technology or telecommunications products
Web page development, design and related consulting services
Website hosting, co-location and website administration services
Other technology or Internet service activities and/or products (please describe)

Do you actively screen website content for possible disparagement, intellectual property infringement and invasion of privacy before publishing?

Yes

No

Does your company have established procedures for editing or removing potentially libelous material, controversial material and content that infringes the Intellectual Property rights of others (copyright, trademark, trade name, trade secrets etc.)?

Yes

No

Does your company use material provided by others, such as content, music, graphics and video streams in your software or on your website?

Yes

No

Do you publish, market, disseminate or distribute content related to any of the following?

Political, Activist or Fundraising

Gambling

Adult entertainment

Religion

Sale of Restricted Items

Advertising Product Comparisons

Contact Information for Individual Responsible for Information Security Operations & Reporting:

Indicate the types and amount of confidential client, customer or employment related information you store or access through your network or through a hosted network (i.e. the cloud):

Data Type	Amount
Social Security Numbers
Financial Data (including PCI)
Protected Health Information
Other PII
Corporate Information
Other:

Note the status of your security and encryption processes protecting sensitive and confidential information, including Personally Identifiable Information (PII) and credit/debit card data:

Is all sensitive and confidential information encrypted while at rest on your servers and network databases?

Yes

No

Partial / In Progress

Is all sensitive / confidential information encrypted on endpoints, mobile devices and storage/back-up media?

Yes

No

Partial / In Progress

Is all sensitive and confidential information encrypted while in transit within your network system, to outside parties, and over wireless networks, including email and file transfers?

Yes

No

Partial / In Progress

Are you using any of the following technologies or testing on a regular basis:

Firewalls at Network Perimeter

Firewalls to Protect Sensitive Resources Inside the Network

Vulnerability Scanning

Third Party Audits of Network Security & Privacy Practices

Penetration Testing

Antivirus Software for Desktops / Laptops and Servers

Intrusion Detection/Prevent Systems

Centralized Log Collection and Management

Endpoint Detection & Response

Network Segmentation according to risk and/or function

Formal Patch Management Process

Timeframe for Critical Patch Installation (days):

Does the insured employ any of the following email protection or solutions?

Pre-Screening for malicious attachments / links

Headers notifying users of external emails

SPF

DKIM

DMARC

Advanced Threat Protection (O365 Only)

Is Remote Desktop Protocol enabled?

Yes

No

Is there use of multi-factor authentication (MFA) in your environment?

Yes

No

If yes, where?

Email Platform (O365, GSuite, etc.)

Remote Access

Administrative Privilege

Other (ie backup file access)

Are backup and recovery procedures documented and tested for all mission-critical data and systems?

Yes

No

How frequently is critical data backed up?

Daily

Weekly

Monthly

Unavailable / Not Sure

How frequently are backups tested?

Monthly

Quarterly

Annually

Unavailable / Not Sure

Where are backups stored?

Local Backup

Tape Backup

Offsite Storage

Cloud Backup

Are backups stored disconnected from the network?

Yes

No

Are backups encrypted?

Yes

No

Do you have strict user revocation procedures on user accounts and inventoried recovery of all information assets following employment termination?

Yes

No

Are end users permitted to be local administrators?

Yes

No

Do you have a formal process to train and test employees on security and privacy issues?

Yes

No

If yes, how often is this done?

Quarterly

Bi-Annually

Annually

Less Often / No Schedule

Do you have an established incident response plan for cyber and cyber-crime incidents?

Yes

No

Do you have a business continuity plan to avoid IT systems failure and business interruption losses, including alternate working procedures (co-location, outsourcing, alteration of process, redundant servers)?

Yes

No

In the event of a system interruption, what is your Recovery Time Objective (RTO)

0-4 Hours

4-8 Hours

8-12 Hours

12-24 Hours

Longer / Not Sure / Untested

Are you subject to and compliant with any of the following law & regulations governing information security?

PCI

HIPAA

GDPR

CCPA

Other

Are you compliant with all laws and regulations checked above?

Yes

No

If No, Please Provide Explanation:

Please check the boxes of the controls used to authenticate funds or securities transfer prior to transfer

D&B Report or other credit check

Approval by more than one person to initiate transfer

Confirmation of physical address

Provide training to employees concerning wire scams

Phishing Training for Employees

Verify accounts independently with bank

Call to Pre-Determined Number

Other

Confirm all changes in by a call to a predetermined number

Yes

No

Send written notice to a person at the vendor/supplier other than who made the request?

Yes

No

Require review of all change requests by a supervisor or approver?

Yes

No

Other controls:

Does your standard written client contract or service agreement contain the following? (Check all applicable.)

Hold Harmless Agreements

Disclaimer of Warranties

Indemnification Clauses

Consequential Damages Exclusion

Limitations on Liability

Force Majeure

Do you use a standard contract or service agreement with all clients?

Yes

No

Are custom service contracts reviewed by qualified legal counsel before implementing?

Yes

No

What is your average contract size in dollars?

What is the duration of your average contract?

List and provide details regarding your company’s largest contracts for the past three years:

Client Name	Description of Services	Contract Value	Duration

Does your company use Independent Contractors to whom you sub-contract work?

Yes

No

If Yes, are your Independent Contractors contractually required to carry GL and E&O insurance?

Yes

No

Are all your contracts with customers and vendors reviewed by qualified legal counsel before signature?

Yes

No

7. Prior Claims Experience & Incidents

Has the Applicant ever sustained a significant system intrusion, tampering, virus or malicious code attack, loss of data, hacking incident, data theft or similar?

Yes

No

Within the last three (3) years, has the Applicant had any actual or potential electronic payment fraud losses?

Yes

No

Within the last three (3) years, have any customers either failed to pay for or requested a refund for a product or service you provided due to an alleged problem, whether due to non-performance, dissatisfaction or otherwise?

Yes

No

Has the Applicant ever been declined for Errors and Omissions, Professional Liability or Media Liability insurance or had an existing policy cancelled?

Yes

No

During the past three (3) years, has anyone made any Claim against the Applicant for invasion of or interference with any right of privacy, wrongful disclosure of personal information, or violation of any privacy related statute or regulation?

Yes

No

In the last five (5) years has the Applicant been the subject of any cease or desist order or been the subject of official admonishments, critical directives or comments by regulators?

Yes

No

Are you aware of any circumstances that could give rise to a claim under the coverage you are applying for?

Yes

No

Coverage Type	Current	Coverage Limit	Retention	Premium	Retro Date
Cyber Liability and First Party
Cyber Crime / Extortion
Miscellaneous Professional Liability
Technology Professional Liability

Cyber & Professional Liability Insurance Application

Cyber & Technology Risk Assessment Questionnaire

1. Business To Be Insured

Check and Specify Current Coverages, Limits, and Desired Retroactive Dates:

2. Your Business Operations

3. Website Content & Media Activities

4. Network Security & Privacy Controls

5. eCrime & Wire Transfer Controls

6. Professional Services & Client Contracts

7. Prior Claims Experience & Incidents