Unique Risks Need Custom Solutions

Please answer all the questions on this form. Before any question is answered please carefully read, then sign, the declaration at the end of the application form.  Underwriters will rely on the statements that you make on this form. In this context, any insurance Coverage that may be issued based upon this form will be void if the form contains falsehoods, misrepresentations, or omissions. Please therefore ensure your responses to the questions in the form are complete and correct.

Any policy that may be issued based upon this form will provide claims first made and reported coverage.

Section 1 – Your Details

1.   Applicant(s):                           

2.   Address:         

3.   Contact name and title of individual responsible to executive management for information security operations:                                

4. Contact’s telephone number and email address:         

5. Names of all subsidiary companies (if any):      

6. Please detail any mergers and acquisitions undertaken in the last 3 years (including retro-dates):

Name of Entity:            Retro Date:       

7. Website home page (including subsidiaries):       

Section 2 – Your Business

8.  Date established:        

9.   Total number of staff:             

10. Detailed description of business / Professional Services:                 

11.  Identify your corporate structure (C Corp, Partnership, S Corp LLC, Other):                      

12.  Please confirm the total revenues           a) from your most recent financial year;             

b) projected for your next financial year.            

13.   Please confirm the total revenues from your Internet activities only

                              a) for your most recent financial year;                

                                                                        b) projected for your next financial year.            

14.  Do you have any customers that represent more than 50% of your revenue: Yes    No

15.  Please list all URL addresses for all public-facing websites that are to be insured:      

Section 3 – Your Professional Services

Please complete this section for Technology Errors and Omissions coverage

16. Please provide an analysis of your revenue (by percentage) from the following:

17.  Please identify your mission critical suppliers:                    

18. Do you or will you within the next twelve (12) months perform any of the following activities (whether through a hosted website, your own website or by your customers using products or services provided by you):

i)    Storage of customer/subscriber names and addresses
       Yes     No

ii)   Storage of credit/debit card numbers
       Yes     No

iii)   Storage of credit history and ratings
       Yes     No

iv) Storage of medical records or personal health information
 Yes     No

v)   Storage of intellectual property of others

             Yes     No           If yes, please give details:                

 vi)             Storage or access to bank records/investment data or financial transactions of subscribers/customers
       Yes     No

vii)             Storage or other customer/subscriber information
 Yes     No           If yes, please give details:                            

viii) Electronic publishing, marketing, dissemination or distribution of copyrighted material of others
       Yes     No

ix) Electronic publishing, marketing, dissemination or distribution of original works
       Yes     No

            Do you provide content for third party web sites?

       Yes     No

x)   Electronic publishing, marketing, dissemination or distribution of pornography or adult entertainment material
       Yes     No

xi) Advertising the products or services of other companies on websites, via email or other electronic means for a fee or commission

       Yes     No

xii)             Provide legal, financial or personal finance advice
       Yes     No

xiii) Provide medical or health advice
       Yes     No

xiv) Provide other personal advice services such as counselling
       Yes     No

xv)             Provide website services or products to international customers/subscribers (including web-hosting or ISP)
       Yes     No           If yes, please give details:        

xvi) Registration of Domain Names for others (Domain Registrar)
       Yes     No

xvii) Sell or share individual subscriber or user identifiable information with another company

              Yes     No

19. Please indicate the end-user application of your company’s products/services by market sector:

Section 4 – Your Website

Please complete for your Internet operations (if applicable)

The information provided here will be supplemented by an online Network Security Assessment

20. Does your website contain materials designed to be downloaded?                     Yes     No

      If yes, please give details:      

21. Does your company have an established procedure for editing or removing from your Web site or Internet Service libellous or slanderous content, or content that infringes the Intellectual Property rights of others (copyright, trademark, trade name, trade secrets etc.)?              Yes     No

 If yes, please confirm whether this review procedure is carried out by a qualified attorney.

 Yes     No

22. Does your company use material provided by others, such as content, music, graphics, and video streams, in your software, or on your website?                                                           Yes     No

If yes, please confirm whether you obtain written licences and consent agreements for the use of these materials:                                                                                                         Yes     No

23. Does your company use the Internet or an intranet for political, fundraising or cause activities: for gambling; for pornography; or for the sale of prohibited, regulated or restricted items such as tobacco, other drugs or liquor, or fire arms?                                                               Yes     No          

If yes, please give details:      

Section 5 – Your IT systems

Please complete for your network

The information provided here may be supplemented by an online Network Security Assessment

24.  Do you use Microsoft Operation System environments for your public-facing systems and/or services, such as IIS (web server), or other Microsoft Operating Systems servers for database, email or DNS.                                                                                                                     Yes     No

            If yes, do you have a formal patch management process in place and have you installed the latest available  security vulnerability alert and service pack?                                     Yes     No

25. Is firewall technology used at all Internet points-of-presence to prevent unauthorized access? 

                                                                                                                               Yes     No

26. Does your company use anti-virus software on all desktops/portable computer devices and mission-critical servers and is it updated in accordance with the software provider’s requirements?

 Yes     No

27.  Are system backup and recovery procedures documented and tested for all mission-critical systems?                                                                                                                      Yes     No

28.  Does your company have a written policy on Email and Internet use?

                                                                                                                                     Yes     No

29. Does your company have a published information security policy, and is there an organizational manager who is  directly responsible for information security compliance operations?

                                                                                                                                      Yes     No

30.  Are there regular security reviews of IT systems by internal audit personnel or a trusted third party?                                                                                                                           Yes     No

Section 6 – Your Risk Mitigation

31.  Does your company use Independent Contractors to whom you sub-contract work?

 Yes     No

If yes, please confirm whether you require Independent Contractors to carry professional liability insurance, and provide a description of any indemnities, hold harmless agreements etc:      

32. If Yes to 31 above :

      Does your company always use a written contract upon engagement of such Independent Contractors?                                                                                                        Yes     No          

If Yes, please attach a copy.

If No or Not always, please describe how you agree the scope of the contract with your customer:

Please provide a copy of your standard customer contract with your application.

33.  Within the last two (2) years, have any customers either failed to pay for or requested a refund for a product or service  you provided due to an alleged problem? (whether due to non-performance, dissatisfaction or otherwise)                                                                                      Yes     No

34. Has your company ever been declined for Errors and Omissions, Professional Liability or Media Liability insurance or had an existing policy cancelled?                                         Yes     No

If yes, please explain:      

35. In the last 5 years has your company experienced any claims or are you aware of any circumstances that could give rise to a claim that would have been covered by this policy?

 Yes     No

If yes, please detail separately and include any pending or prior incident, event or litigation providing full details of all relevant facts:      

36. In the last 5 years has your company been the subject of any cease and desist orders or been the subject of official admonishments, critical directives or comments by regulators?

                                                                                                                                   Yes     No

If yes, please detail separately and include any pending or prior incident, event or litigation providing full details of all relevant facts:      

Privacy Supplemental

37.       Have you indentified all relevant regulatory and industry compliance frameworks that are applicable to the organization?       Yes     No

(Please provide details of compliance applicable to your organization, with details of the latest audit carried out)

38.       Is all sensitive and confidential information that is transmitted within and from your organization encrypted using Industry-grade mechanisms?                                 Yes     No

39.       Do you have strict user revocation procedures on user accounts and inventoried recovery of all information assets following employment termination?             Yes     No

40.       Do you have established procedures for ensuring the deletion of all sensitive data from systems and devices prior to their disposal from the company?                             Yes     No

41.       Is all sensitive and confidential information stored on your organization’s databases, servers and data files encrypted?                                                     Yes     No

42.       Are access control procedures and hard drive encryption in force to prevent unauthorized exposure of data on all Laptops/ Blackberry’s, and home based PC’s?                              Yes     No

43.       Do you ensure that all wireless networks have protected access?                         Yes     No                                                                                                                                                                                                                                                                                                                                          Yes     No

44.        In response to California’s SB 1386 and other similar laws have you established a procedure for determining the severity of a potential data security breach and a notification procedure to 

            all individuals who may be adversely affected by such exposures?                   Yes     No

45.        Has the organization ever sustained a significant system intrusion, tampering, virus or malicious code attack, loss of data, hacking incident, data theft or similar?       Yes     No  

46.        Is the organization or any of its partners, directors or officers aware of, or are there any circumstances that may give, or have given, rise to a claim against the company or against this Insurance policy?                                                                                          Yes     No  

47.        During the past three years, has anyone made any Claim against the Applicant for invasion of or interference with any right of privacy, wrongful disclosure of personal information, or violation of any privacy related statute or regulation?                                           Yes    No

48.       Do you store credit card details on your network or does it go straight off to the payment processor?                                                                                                   Yes     No

49.       Have you specifically checked that your SQL servers with credit card details are programmed to prevent SQL injection attacks?                                                                                            Yes     No

50.       Is your credit card data on your SQL server always encrypted?                         Yes     No                                                                                                                                                                                                                                                                                                                               Yes     No

51.        Is all Personally Identifiable Information (PII) encrypted at rest and in transit?  Yes     No

52.        Is all Personally Identifiable Information (PII) encrypted on the network and off the network including remote devices, i.e. laptops, blackberries, disks, etc.                          Yes     No  

53.        Are all back up tapes / cassettes secure in transit? Are they picked up, shipped, and stored by reputable third parties?                                                                                        Yes     No  

Declaration

I hereby declare that I am authorized to complete this application on behalf of  the applicant and that after due inquiry, to the best of my knowledge and belief, the statements and particulars in this application are true and complete and no material facts have been misstated, suppressed, or omitted. I undertake to inform underwriters or any alteration or addition to these statements or particulars which occur before or during any contract of insurance based on the applications is effected. I also acknowledge that this application (together with any other information supplied to underwriters) shall be the basis of such contract.

I understand that underwriters will rely on the statements that I make on this form. In this context, any insurance coverage that may be issued based upon this form will be void if the form contains falsehoods, misrepresentations or omissions.

Signed:* _____________________________________           

Name:  ______________________________________

Position:*_____________________________________   Date: ___________________

*the signatory should be a director or senior officer of, or a partner in, the Applicant