Information Technology Disaster Mitigation
In this third and final part of the article, we'll discuss some mitigating factors, specifically the last wall of defense; insurances, their average costs, usual coverage limitations, and how to reduce their costs.
Five categories of coverage are available to most small businesse and large businesses alike:
Assets
Business continuity (aka. business interruption)
Electronic Data Processing
Power & Communications
Cyber peril coverage
Assets coverage is one of the most popular insurance among small businesses, however it inner workings are often not thoroughly understood. For instance, elements that one should take into consideration are whether you have included the value of tenant's improvements performed over time at your location in your insurance limit. In addition, you should make sure that you are covering the value necessary to the purchase of brand new equipment, as you will most likely not have the leisure to go bargain hunting in the event of a disaster. Other considerations include a careful review of your business software licenses acquired over time. In most instances, software makers will ship you new media at insignificant costs if you can accurately document legal ownership.
As a consequence, use a system to manage software licenses accurately in order not to have to insure software assets at their purchase prices, but rather at media costs. (FYI: ActivSupport's IT Help Desk solution provides this type of system.) And finally, as a general rule of thumb, stay away from insurance coverage's that are offered with leases they are usually not cost-effective. Premiums for assets coverage run for about $2,500 for each $1 Million of coverage.
Business continuity insurance is not nearly as common as assets coverage, however if you have not reviewed this element for some time, or think that you do not need it, consider this fact: 90% of small and medium size businesses hit by a major catastrophic event never recover because of a lack of cash cushion. Given its cost, you need to define an insurance limit that is reasonable but not over killed. This coverage replaces the cash needed to keep you afloat while your business is shut down. Be conservative in estimating the length of a potential shutdown. It will probably take you 2-3 times longer than you would think. The coverage limit is developed based on the following 3 elements: loss of net profits or increase in net loss + continuing expenses such as payroll + extra expenses such as the cost of temporary leases and rent. Now would be a good time to review your location lease as well; find out whether you would need to pay for continuing rent in a disaster situation, even if the space is not usable. In this case you may want to make sure your coverage includes the Extra Expenses feature listed above. An important refinement of the coverage is Extended Indemnity Period to pay for the loss of income you suffer even once you are back in business. You may be back in business, but that doesn't mean all of your previous customers have come back. It is likely that your revenues will be down following your return to business and you can insure this continuing income loss. Also, you might want to consider extending the coverage to include increased rebuild times due to building code changes if you own a building, and losses caused by power interruptions discussed below. Business continuity coverage premiums run for $5 to $7K per $1Million. Extended coverage runs at about $2.5K per $1Million.
Electronic Data Processing covers damage to computer related property including hardware, software and data. The key to this coverage is that it covers a broader range of losses than provided for common business property. These include losses specific to sensitive electronic equipment such as power surges and in some cases virus attacks. While nothing beats a good back up system, the potential cost of extracting data from Hard Drives and re-creating data sets can be extensive. Don't forget to include the anticipated cost of data recovery in your EDP limit. EDP coverage runs for a typical $3K to $6K per $1 Million but can vary greatly based on specifics. Electronic data processing coverage might be offered as part of assets coverage, some policies don't make a distinction between the two.
A Power & Communications coverage plan can come in handy even when businesses are not directly affected by a catastrophic event. It does not take great observation skills to realize that the income stream of today's businesses increasingly rely on their uninterrupted ability to communicate and operate powered equipment in a continuous fashion. As we've seen in the recent history of deregulated telecommunication and energy industries, Internet Service Providers and Telephony providers go out of business. They forget to provision service for your new location, or enact rolling black outs. In addition, most infrastructures are designed according to a hub and spoke schema. With this type of schema, they are increasingly vulnerable to adverse conditions when approaching customer premises (the last mile). To illustrate this point; on 9/11/01 WorldCom customers in the area of the World Trade Center lost the ability to communicate, not because their buildings were physically hit, but instead because their provider had located their own network operations at the World Trade Center. A very simple refinement to your business continuity coverage can prevent uninsured losses due to loss of power and communication services. In addition, you should consider equipment breakdown coverage to insure against both the cost of making unexpected repairs to equipment that breaks down, and the resulting loss of revenue that could occur if your business is shut down due to an equipment breakdown. To obtain Power & Communications coverage, you should pad 10% of the premium for business continuity coverage on top of your insurance budget.
Cyber Peril coverage or E-property policy is a relatively new type of coverage. As such, it is rather expensive. The argument made to distinguish Cyber Peril from other risks is that in most situations, catastrophic cyber losses do not damage assets. Distributed DNS, viruses, hackers, and unauthorized access to data are among some of the losses covered under this type of policy. Underwriters may require you to perform a security audit at your own cost before providing coverage. FYI; ActivSupport does provide this type of security audit service. Premiums for Cyber Peril coverage are high, from $15K to $30K per $1Million.
In addition to these five types of policies, Differences in Conditions (DIC) Coverage might be considered in addition to your standard "all-risk" or Special Cause of Loss Form Coverage. A DIC policy can be used to add coverage for earthquake and flood if needed. (FYI... doesn't cover wear & tear) Typically, DIC Coverage premiums range from $10K to $13K per $1 Million.
Finally, a few elements that can help minimize the cost associated with securing appropriate coverage as part of a disaster recovery plan. Lower your costs by installing fire sprinklers in the building, by increasing the coverage deductible based on the likelihood of a given type of a catastrophic event occurring and its impact on your business, and by having a good disaster recovery plan in place. These are all major cost factors that may affect your premiums. You should be aware that as much as 20% to 25% of the premium is subjective. For small and mid-size businesses that subjective portion usually accounts for 10% of the premium. Still, given the rising costs of doing business and securing proper coverage for your business, we are likely talking about thousands of dollars. A proper disaster recovery plan can therefore pay for itself in premium reductions alone. To accomplish this you need to help your insurance broker tell the "story" to the insurance underwriter; in a nutshell why you are running superior operations and are prepared in the event of a disaster.
As a final thought, keep in mind that the question is not whether a disaster will ever strike? It is just a matter of time before it does. The question is; do you want to be part of the 90% of small and medium size businesses that never recover when a major disaster strikes.
Read on about Disaster Recovery Planning:
IT Disaster Legal Factors
IT Disaster Prevention
IT Disaster Mitigation
All of the insurance coverage mentioned in this article can be secured through Mr. Bob Marrone (Phone: 510-832-8000 x135), an excellent insurance agent that we have worked with for over 6 years and helped us write this article.
Subscribe to our comprehensive news feed
