Insuring against potential PCI related liability

[SPC]

As a payment service provider that handles CHD on behalf of clients, we are continually reviewing our risk as card volumes continue to grow.

Whilst we will always operate our systems to a high standard that is well beyond PCI DSS mandates, we are not ignorant to the fact that a data breach remains a very real threat to our organisation and one that we cannot completely protect ourself against.

We are therefore presently discussing the possibility of further insuring against the financial liabilities that are associated with a data breach (whether futile or not). We already have professional indemnity and the various other standard policies, however these have limited applicability in a data breach scenario due to the number of exclusions that exist in standard policies.

Is anyone aware of insurance products in existance that address mitigating the costs and liabilities associated with a PCI DSS data breach situation. Unfortunately the insurance brokers we have discussed this with are not fully versed on PCI DSS (as one would expect) and therefore are only providing general advise.

When preparing the physical costs of a breach for an insurers review, we understand the direct cash liabilities that need to be be covered include:

Schemes Fine (per incident): $500,000 (if found non-compliant)
Liability from issuers: circa $25 per card re-issued
Legal defense costs: depends on size of breach

Other non-cash costs which can't be easily measured include:

Internal staff time costs
Company/Brand reputation


We are also watching the Heartland case closely to establish what liabilities a PCI DSS compliant organisation (assuming they are found to be) is still liable for if a breach occured. We are still unclear on that point as we are of the view that PCI DSS compliant != no liability.

Feedback, comments or advise on any of the above points would be appreciated.

[partpricer]

As you are following the Heartland case, you are probably aware that in the subsequent press Visa stated that Heartland was "not in compliance" at the time of the breach. Also, in their statement, the PCI Council noted that “No PCI compliant processor has ever been breached.”.

PCI DSS compliance is only a momentary measure. Visa has done an extremely good job in pointing out in all of the major breaches that the companies were not in compliance at the time of the breach. I guess if you are compromised, that is a good indication that something is lacking in your security. So, if Visa says that you are not in compliance at the point of the breach, I don't know of any insurance that is going to cover you.

Spend money on compliance efforts, spend money on certification, spend money on insurance, But, realize that you are going to be standing by yourself in the event of a breach.

[jbhall56]

Just a quick word on insurance for data breaches. Just say 'NO'!

I've dug into a number of these types of insurance policies and they are just an insurer's version of the PCI DSS and a way to generate revenue. If you miss or fail any of the requirements in the forensic examination after a breach, you're not compliant with the provisions of the policy. And trust me, these insurers will dig for anything that will deny your claim. Plus, the insurer will make you spend a lot of money on ensuring compliance over and above PCI compliance requirements.

Given that security is not a perfect science, it is highly likely that a forensic examination will reveal some sort of compliance issue and your organization's claim will be denied. As a result, your organization will have spent dollars on premiums for nothing.

One of my clients did an analysis of such a policy and found that, for the premiums and costs incurred for policy compliance over a five year period, the coverage they would have been provided was a little less than the value of the premiums plus other costs to comply. They also gauged the likelihood of a successful claim at around 5% or less based on the results of the past five years of internal audit reports for their IT area and how the issues found in those reports matched up with the insurance policy's evaluation criteria in the event of a breach.

In my humble opinion, these insurance policies are just not worth the money.

[ADail]

Also, the Card Brand fines are only one channel of risk for data breaches (and many insurance policies do not cover fines, only "damages").

In addition to the fine from your Acquirer, you could be fined by the FTC for Unfair Trade Practices, by the State versions of the FTC for the same thing (No federal preemption), and then sued by the states attorneys generals under some of the new laws like 201.CMR.17.0 or the Minnesota Plastic Card Security Act (or some such). If your breach spans consumers from several states you may have to go to court multiple times in multiple jurisdictions to deal with the consumers specific to that jurisdiction.

The whole thing is something I pray I never get first hand experience in.