Cyber Risk Insurance Proposal Form
Note to the Proposer
Signing or completing this proposal does not bind the Proposer, or any individual or entity he or she is
representing to complete this insurance.
Please provide by addendum any supplementary information which is material to the response of the
questions herein, and/or complete answers to the listed questions if they do not fit in the space
provided on the application.
For the purpose of this proposal form, “Proposer” means the entity stated in 1. below and all its
subsidiaries to be covered.
All answers should be given as a group response i.e. if any subsidiary company has different
responses these should be provide separately on your headed paper.
Company Information
1. Name of Proposer_________________________________________________________________
2. Web site
3. Principal address of Proposer________________________________________________________
4. Business Description_______________________________________________________________
5. Geographical Exposure:
Prior Current Projected
Total Gross Revenue
(Local Currency)
Geographical Split of the Company’s Total Gross Revenue (%)
European Union
United States
Rest of World
6. Desired Coverage:
Cyber/Privacy Extortion MultiMedia Liability Network Interruption
7. Data Protection Procedures
a) Is there a written data protection policy and privacy policy that applies to the Company?
Yes No
If “No”, please provide details regarding data protection procedures for the Company
________________________________________________________________________
_
________________________________________________________________________
_
Cyber Risk Insurance Proposal Form
b) Are all employees provided with a copy and any update of the Company’s data protection policy
which they are required to confirm compliance with? Yes
No
If “No” please explain why not:
_________________________________________________________________________
_________________________________________________________________________
c) When was the Company’s data protection policy last reviewed and by whom?
________________________________________________________________________
_
d) Does the Company’s data protection policy comply with the data protection and privacy legislation
applicable to all jurisdiction and Industry standards/requirements, in which the Company operates?
Yes No
If “No” please provide an explanation regarding non-compliance in all applicable jurisdictions:
_________________________________________________________________________
_________________________________________________________________________
e) Have the Company’s U.S. Subsidiary(ies) signed-up for, and are they compliant with, the Safe
Harbor Program between the United States of America and the European Union? Yes No
If “No” please provide an explanation regarding non-compliance with the Safe Harbor Program:
_________________________________________________________________________
_________________________________________________________________________
f) Does the Company employ a Chief Compliance Officer, Data Protection Officer and/or In-house
Counsel responsible for data protection related matters? Yes No
If “No” who is responsible for data protection related matters?
_________________________________________________________________________
8. Data Access & Recovery
a) Does the Company use firewalls to prevent unauthorized access connections from external networks
and computer systems to internal networks? Yes No
If “Yes” are all computer systems, mobile devices and websites Firewalled or have intrusion prevention
systems on them?
_________________________________________________________________________
Cyber Risk Insurance Proposal Form
b) Does the Company use anti-virus protections and procedures on all desktops, e-mail systems and
mission critical servers to protect against viruses, worms, spyware and other malware?
Yes No
If “Yes,” how often are such protections and procedures updated:
Daily Weekly Monthly Other (Please Specify)
_________________________________________________________________________
c) Does the Company have in place procedures to identify and detect network security weaknesses?
Yes No
d) Does the Company monitor its network and computer systems for Breaches of Data Security?
Yes No
e) Does the company have physical security controls in place to prohibit and detect unauthorized access
to their computer system and data centre? Yes No
f) Does the Company collect, store, maintain or distribute credit card or other sensitive personally
identifiable data? Credit Card Personally identifiable data
If “Credit Card” is selected above, does the company comply with Payment Card Industry Data Security
Standards? Yes No
If either is selected, is the access to such sensitive data restricted? Yes No
Who has access?
_________________________________________________________________________
g) Does the Company process payments on behalf of others, including eCommerce transactions?
Yes No
If “Yes” please provide the number of clients you process such payments for and an estimated number
of transactions per client:
_________________________________________________________________________
h) Does the Company have encryption requirements for data-in-transit data-at-rest to protect the
integrity of Sensitive Data including data on portable media (e.g., laptops, DVD backup tapes, disk
drives, USB devices, etc.)?
If “Yes”, please describe where such encryption is used:
_________________________________________________________________________
_________________________________________________________________________
i) Does the Company have and maintain backup and recovery procedures for all:
i) mission critical systems? Yes No
ii) data and information assets? Yes No
If “Yes” is it encrypted? Yes No
Cyber Risk Insurance Proposal Form
j) Does the Company perform background checks on all employees and independent consultants?
Yes No
k) Does the Company require remote users to be authenticated before being allowed to connect to
internal networks and computer systems? Yes No
9. Outsourcing Activities
a) Does the Company outsource any part of its network, computer system or information security
functions? Yes No
If “Yes” who is the security outsourced to? And does the Applicant periodically audit the functions of
the outsourcer to insure that they follow the Applicant’s security policies?
_________________________________________________________________________
b) Does the Company outsource any data collection and/or data processing? Yes No
If Yes”, please provide details of the data collection or data processing functions which are
outsourced:
_________________________________________________________________________
_________________________________________________________________________
c) Does the Company require the entities providing data collection or data processing functions
(Outsourcers) to maintain their own data protection liability insurance? Yes No
d) Does the Company require indemnification from Outsourcers for any liability attributable to them?
Yes No
e) How does the Company select and manage Outsourcers?
_________________________________________________________________________
f) Does the Company require all Outsourcers to comply with the terms of the Company’s data
protection policy? Yes No
10. Other important information
a.) IT security plan , BCP plan
b.) Total No. of IP address, no. of active IP addresses
c.) What kind of data is stored ? Do you collect corporate info. Please provide details
d.) How will Insured deal with a DDoS attack and what processes are in place with the vendors to
maintain network performance?
e.) Confirmation regarding Dependency on IT
a- IT should be available 24/7, availability target rate 99.9%
b- IT should not be interrupted for more than 4 hrs a time
c- IT may support 24 hr of interruption or more
11. Claims Information
Cyber Risk Insurance Proposal Form
a) Has the Company been the subject of any investigation or audit in relation to data protection by a
Data Protection Authority or other regulator? Yes No
If “Yes”, please provide full details:
_________________________________________________________________________
b) Has the Company ever been subject to a Data Subject Access Request? Yes No
If “Yes”, please provide full details:
_________________________________________________________________________
c) Has the Company ever been subject to an Enforcement Notice by a Data Protection Authority or
any other regulator? Yes No
If “Yes”, please provide full details:
_________________________________________________________________________
d) Is the Company after due inquiry aware of any actual or alleged fact or circumstance which may
give rise to a claim under this policy? Yes No
Additional Details:
Nationality: Indian Non - Indian
If Non-Indian, please specify Country: .........
Type of Organization
Corporations Governments Non Governmental Organizations Society
International Organization Trust Partnership Cooperatives Section 25 Company
PAN card number (10 character number):
Sources of funds: Please tick appropriate box
Salary Business Others (please specify)
Declaration:
1. I/we herby confirm that all premiums have been/will be paid from bonafide sources and no
premiums have been/will be paid out of proceeds of crime related to any of the offence listed in
Prevention of Money Laundering Act, 2002.
2. I understand that the Company has the right to call for documents to establish sources of
funds.
3. The insurance company has right to cancel the insurance contract in case I am/ have been
found guilty by any competent court of law under any of the statutes, directly or indirectly
governing the prevention of money laundering in India.
Cyber Risk Insurance Proposal Form
SIGNING THIS PROPOSAL DOES NOT BIND THE PROPOSER TO COMPLETE THIS
INSURANCE.
Declaration
The undersigned, authorized to sign and bind alone on behalf of the company, hereby declares that the statements and
particulars in this Proposal Form are true and no material facts have been misstated or suppressed. A material fact is
one that would influence the acceptance or assessment of the risk.
The undersigned agrees that this Proposal Form, and any attachment or any information submitted therewith and any
and all other information supplied or requested, shall form the basis of any insurance agreement effected thereon. The
undersigned further undertakes to inform the insurer of any material alteration to any information, statements,
representations or facts presented in this proposal form, occurring before or after the inception date of the insurance
agreement.
This Proposal Form is binding for the company and will form the basis of the data protection
insurance policy concluded with Insurance Company
This Proposal Form is subject to final approval by Insurance Company
The undersigned confirms to have been fully informed about all coverage details including all applicable sublimits. He/she further
confirms to have received, carefully read and understood the standard data protection insurance policy wording.
Signature: Date:
Name: Title/Function:
Declaration:
The content of this form along with product benefits, terms/conditions and exclusions have been
clearly explained to me. I/we have understood these and confirm to abide by the policy terms &
conditions.
Signature of the Proposer: _____________
Name & Signature of agent/intermediary: ___________________
Code:
Vernacular Declaration (Certification in case the proposer has signed in vernacular/thumb
print):
The content of this form along with product benefits, terms/conditions and exclusions have been
clearly explained by me in vernacular to the proposer who has understood and confirmed the same.
Signature/Thumb impression of the Proposer: ______________
Name & Signature of agent/intermediary: ____________________