DEPARTMENT: Office Of Risk Management
FILE TYPE: Consent Action
TITLE
title
Authorization To Renew Cyber Security Insurance With American International Group, Inc (AIG) Specialty Insurance Company
end
PURPOSE/ACTION REQUESTED
Authorize the renewal and purchase of cyber security insurance contract with AIG Specialty Insurance Company.
SUMMARY
Dakota County has had a cyber security insurance policy since October 2019. In the intervening years, public sector entities have faced escalating levels of cyber security attacks. Cyber security criminals have increasingly turned to utilizing ransomware when attacking both public and private sector entities. The increased levels of attacks and the payouts by insurance carriers has led to a very difficult cyber insurance market. However, in the last 12 months, there has been a reduction in the attacks and the costs of the attacks. This has provided for some softening in the cyber insurance market, bringing with it a reduction in premiums. A market analysis indicated that rate decreases of five percent have been common for policy renewals in 2024.
Staff from the Office of Risk Management and Information Technology worked with the County's insurance broker, Arthur J. Gallagher, and the County’s current cyber insurer, AIG, proactively over the last 12 months to identify opportunities to tighten IT security controls that would reduce the County’s cyber threat and in turn, reduce the cyber insurance premium. One specific area of tightened controls involved reducing the number of domain level admin accounts which was a critical risk identified by our insurance carrier.
The County's coverage was marketed on a limited basis since many cyber security insurers do not write policies for public sector entities. AIG Specialty Insurance Company, the County’s incumbent insurer, responded with a renewal quote that reflects a reduction in annual premium from $127,300 to $102,500 (19%). This is a significantly higher reduction than the market trend of 5 percent and largely reflective of the collaboration between Risk and IT to identify key security controls to improve in advance of the renewal. AIG has been the County’s insurer since 2019, is an industry recognized leader in the Cyber insurance sector with stringent control standards and while they are not currently writing any new public sector clients, they recognize Dakota County as a good client. Consistent with the renewal in 2023, the deductible on the policy was maintained at $100,000. The aggregate limit of the policy remains the same as the expiring policy at $3,000,000.
The attachments provide a summary of the insurance coverage provided as well as a table depicting the cyber insurance premium trends for the past five years.
RECOMMENDATION
recommendation
Staff recommends the Board authorize the Enterprise Finance and Information Services Director to renew the cyber security insurance contract with AIG Specialty Insurance Company (AIG) for the policy period October 31, 2024, through October 31, 2025.
end
EXPLANATION OF FISCAL/FTE IMPACTS
The required funds, $102,500, are contained in the Office of Risk Management 2024 adopted general liability insurance budget.
☐ None ☒ Current budget ☐ Other
☐ Amendment Requested ☐ New FTE(s) requested
RESOLUTION
body
WHEREAS, Dakota County purchases insurance to cover financial risks that can result in significant costs and are unpredictable in nature; and
WHEREAS, there has been a substantial increase in cyber security attacks on public sector entities over the last several years; and
WHEREAS, an evaluation of the cyber security marketplace for competitive pricing was completed; and
WHEREAS, based on the evaluation of the marketplace, staff is recommending the purchase of cyber security liability insurance with a limit of liability of three million dollars with American International Group, Inc (AIG) Specialty Insurance Company.
NOW, THEREFORE, BE IT RESOLVED, That the Dakota County Board of Commissioners hereby authorizes the Enterprise Finance and Information Services Director to purchase the following insurance to be paid at the current rates from the Office of Risk Management insurance budget:
American International Group, Inc (AIG) Specialty Insurance Company
Cyber Security Insurance
October 31, 2024, through October 31, 2025
Premium not to exceed $102,500
end
PREVIOUS BOARD ACTION
23-489; 10/24/23
ATTACHMENTS
Attachment: Cyber Insurance Renewal Summary
Attachment: Summary of Cyber Insurance Policy Coverage
BOARD GOALS
☒ A Great Place to Live ☐ A Healthy Environment
☐ A Successful Place for Business and Jobs ☐ Excellence in Public Service
CONTACT
Department Head: Jenny Groskopf
Author: Jenny Groskopf