All tabletop exercises
Crisis·Starter·Executive audience
The insurer says the claim may not be covered
The prompt — read this to the room
Three weeks after a ransomware attack, your company has spent 1.8 million on forensics, overtime and lost revenue. The insurer's coverage letter arrives. It reserves its rights and cites two problems. The application you signed last year stated that multi-factor authentication was enforced for all remote access, but the attacker came in through a legacy VPN account without it. And a war and state-actor exclusion may apply, because a government advisory linked the ransomware group to a hostile state. Finance needs to know what to book this quarter.
Total duration
1 h 30 min
People to involve
5
Best fit
Any sector
Who to involve
Most important first.
- CFO / Finance
- Legal counsel
- CISO / Head of security
- CEO / Managing director
- CIO / CTO
What it tests
- Understand what a reservation of rights means and what the company must do to protect the claim
- Assemble an accurate, defensible record of the security controls in place at the time of the attack
- Decide how the financial exposure is reported internally and to auditors while coverage is uncertain
- Identify the changes to the insurance application and renewal process that would prevent a repeat
Outline of activities
- 1The coverage letter: what it says, and what it does not
- 2Facts about the VPN account and the MFA statement on the application
- 3The attribution question and the war exclusion
- 4Money: what to book, what to tell the auditors, what to tell the board
- 5Next steps with the broker, coverage counsel and the renewal
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…