Cliff Rudolph's Insurance Blog

2010 flew by, and in its wake… change.

In contrast to 2009, many might have considered 2010 dull. 

Hooray for dull!

However, this morning I received a notice from linkedin stating that 105 of my contacts started something new.  That’s almost 1/5 of my clients, vendors, and professional sphere of influence.  I’d say 2010 was a year of change.

As the father of twin boys who just turned 2, change is a daily occurrence.  The only thing that remains constant is a lack of sleep.  However as a family, and without ever verbally acknowledging it, we did a better job of being thrifty.  We watched our spending closely, we put money in the bank, and credit cards were paid down- never to be used again.  Group buying sites like Tippr and Groupon became household names as did subscribe and save on Amazon (I got an extra 15% off diapers by enrolling as an Amazon mom). 

WikiLeaks changed our perceptions of the “news”, the Tea Party was given national attention, Healthcare and Financial Reform were passed, Apple found a way to make tablets cool, Conan left the Tonight Show, Toyota became synonymous for bad engineering, and Tiger became infamous. 

2010 flew by, and in its wake… change.

At Parker, Smith & Feek our motto is “Different by Choice, Unique by Tradition”.  No where is this more evident than in how we deliver service to our clients.  We embrace change and are constantly looking for ways to improve.  Whether it was our adoption of social media, our delivery of the Risk Management Center, or hosting webinars and dedicated website on Health Care Reform, 2010 markedly changed how we delivered service to our clients. 

Welcome 2011, maybe you could bring some sleep...

 for a change.

Insuring the Cloud

Cloud Computing, it’s as if the term was coined just to keep insurance companies in a fog.  

Early in 2010 I was introduced to Michael Abrahamsson.  Michael is the CEO of Ilait, a market leading cloud computing and hosting wholesaler based in Sweden and a Board Member of Eurocloud.  Ilait was looking to expand and deploy their services into the US and Michael had been referred to me to assist with placing insurance. 

Insuring a provider of cloud computing services can be extremely difficult.  Just communicating the exposure to insurance company underwriters who may not be familiar or understand the risk can be very challenging.  Cloud computing typically consists of services such as Saas, utility computing, web services, platform as service, managed service providers, service commerce platforms, and internet integration.  Exposure to loss comes in the form of business interruption/service interruption, data privacy breach/loss, and other financial loss due to the performance of service/product. 

In a 2010 report from the Cloud Security Alliance the most significant threats to cloud computing were highlighted: 

• Abuse and Nefarious Use of Cloud Computing
• Insecure Application Programming Interfaces
• Malicious Insiders
• Shared Technology Vulnerabilities
• Data Loss/Leakage
• Account Service & Traffic Hijacking
• Unknown Risk Profile

These are many of the same exposures to risk as most other technology organizations, but due to the nebulous nature of cloud computing, mitigating loss can be challenging.  Communicating how an organization effectively manages this risk is what enables us to offer our clients the most competitive insurance premiums available. 

However, organizations providing cloud computing services are not the only ones at risk.  In fact, organizations that utilize cloud computing services must understand, and should consider contractually transferring this risk to the service provider, and/or insurance.   

It is critical to understand that outsourcing cloud computing services is not the same as outsourcing or transferring risk.  Be wary of cloud computing service contracts that include a hold harmless provision within the indemnity agreement that strongly favors the service provider.  Furthermore, requiring adequate professional liability /E&O insurance limits can be challenging considering the significant number of other parties that may also be affected.

Finally, if utilizing cloud computing services be aware that your organization will be held responsible for State and Federal Laws related to data privacy and compliance to HIPAA,  SOX, PCI and FISMA (for more information on data privacy you can read my article here).  An indemnity agreement written or approved from your legal counsel is the first step to a strong risk management strategy, but if you are responsible for PII (Personal Identifiable Information), a comprehensive data privacy insurance policy should be strongly considered.  Selecting a cloud computing service provider that has strong security controls and implementing strong contractual risk transfer will be reflected in lower insurance premiums.

Due to the significant amount of data being computed/ stored within the cloud, it will always be a target of fraud and abuse. However, the scalability, cost, and efficiency will inevitably lead to greater use.  Taking the proper steps to mitigate loss and transfer risk via contract and/or through an insurance policy will reduce risk to an organizations balance sheet, and will make it much safer to harness the power of the cloud.