From the Desk of H. K. White, ACEC Business Insurance Trust Chair

Elsewhere in this issue, you read David Kennedy's great news of how ACEC Member Organizations (MOs) can expect a second Royalty from The ACEC BIT in 2011. I wish I could take full credit for this happening in the second year of my term as the ACEC BIT Chair—but of course I can't. The credit belongs to ACEC member firms who take to heart the loss-control and risk management support exclusive to the ACEC Business Insurance Trust’s insurance programs. Your encouragement of participation is its own reward!

The royalties result not only from favorable claims experience but also from growth. The BIT Program is experiencing significant new business, and much of it has come from writing larger firms. I am pleased that the owners of those businesses have realized the benefits of participation. No firm is too large—or too small—for inclusion!

You keep hearing that the BIT Program is Insurance designed by engineers, for engineers. That wouldn't be possible without the close cooperation between Member Organizations and the insurance experts from Marsh.

Thanks to all the MOs for providing the BIT’s representatives from Marsh access to the Board of Directors meetings all across the country. Clearly, those individuals are the ACEC BIT’s most loyal supporters and represent great referrals within their states. As an example, Allen Watson, incoming President of the Houston Chapter of ACEC Texas provided the following testimonial:

I would like to thank another valued contributor, Past Chair Wayne Shuler, whose term as an ACEC BIT Trustee will end in July, as will mine. We need someone to take those seats! I would appreciate any and all Member Organization Executives submitting to me or David Kennedy their recommendations. Preferred candidates should be firms' principal officers who have been active at the state level.

Finally, the BIT Trustees are looking forward to meeting with you all at the ACEC Fall Conference in Las Vegas. Lots of exciting things will be happening regarding the ACEC BIT—the kind of things that shouldn't stay in Vegas! Four out of our seven Trustees will be available to share new developments and answer any questions you have. Stop by our booth to learn more.

H. Kenneth White
The ACEC Business Insurance Trust Chair

Is Your Firm Prepared for a Data Breach?

The number—and cost—of data breaches are on the rise across the country. Learn how you can protect your firm from the risks and expenses associated with a data breach.

By Jeff Connelly, ACEC Business Insurance Trust (BIT) Program Manager, Marsh U.S. Consumer

How data breaches—whether intentional or accidental—occur within engineering firms vary: laptops get stolen; emails are unencrypted; computers get infected with a virus; hackers hack into the system; security software fails; former employees intentionally distribute information. The reasons are endless.

The results, however, are almost always the same. Sensitive information, such as customer or employee Social Security numbers, are exposed. The data breach can lead to identity theft, reputational damage to the company, and lawsuits. Additionally, there are significant expenses, paperwork, and time involved in complying with state and federal notification regulations.

No company is immune from a data breach, not even the U.S. Securities and Exchange Commission (SEC), which in May 2011, accidentally exposed the Social Security numbers and payroll information of approximately 4,000 SEC employees. In this case, an email that was sent by a contractor at the department's National Business Center, which manages payroll, human resources and financial reporting for dozens of federal agencies, was not properly encrypted and the software in place to catch such errors failed.

Not only is the number of data breaches nationwide on the rise, so too is the average cost associated with each record breached. According to the Ponemon Institute's annual studies, the per-record cost of a data breach rose by more than 47 percent from 2005 to 2009.

Although organizations of all sizes are at risk of a data breach, 85 percent of the breaches that have occurred are within small businesses. Unfortunately, these are the organizations that are often the least prepared to handle the fallout from a data breach.

If a data breach happened to your firm, what would you do? Does your firm have a procedure in place for complying with federal (and possibly state) notification laws? Can you spare the expense and time required to deal with the breach and its effects?

Prevention tips

Many cases of lost or stolen data could have been prevented with simple security measures, such as:

• Laptop security. Laptops have become a target for thieves because they're easy to move and hide. To guard against this risk, keep laptops locked up at all times. Don't leave them in an unlocked car or even in a meeting room. Never check a laptop in your baggage, and consider purchasing a theft alarm system specifically made for laptops.
• Security for physical backup media. Backing up files is a critical security step. If your firm uses physical media as a backup, make sure it's secure. For starters, identify the data on the backup media to help determine what type of security measure is appropriate. Then establish security procedures for moving the backup media to the secure storage site, including a sign-in/sign-out procedure and two-person control.
• Electronic encryption programs. Data encryption programs can also improve the security of information. Encryption programs can be used with physical media (such as tapes or memory sticks), as well as at the application, database, operating system or network level. Data can also be encrypted via backup software.

Data breach insurance

The rising number and costs associated with data breaches are causing many engineering firms to look for data breach insurance. Most often, this coverage is part of business owners' liability insurance.

Data breach coverage can help your firm:

• Adhere to state/federal regulations by paying for notification expenses;
• Quickly restore its reputation and trust by covering public relations and good faith advertising expenses;
• Protect its viability if sued (and found liable for damages) as a result of the breach; and
• Gain confidence and control by providing valuable advice on preparing for and reducing the potential for a data breach occurrence.

When researching providers of data breach insurance, look for an insurer with an established track record of providing this type of coverage for engineers' unique needs. The ACEC Business Insurance Trust team, for instance, offers data breach coverage designed specifically for engineers through The Hartford Insurance Company.

Don't wait until it's too late

Regardless of the source, a data breach can be devastating to a company and its reputation. Don't wait until after a problem arises to manage this exposure. A number of risk management strategies can be implemented today to protect your organization from the threat of a future data breach. Protect yourself and your organization today with data breach coverage from a trusted, reputable insurer.

AR Ins. Lic. #245544
CA Ins. Lic. #0633005
Brokered and/or administered by Marsh US Consumer, Inc., d/b/a in CA Seabury & Smith Insurance Program Management.

The ACEC Business Insurance Trust (BIT) and Marsh US Consumer, Inc. receives compensation from The Hartford for their endorsement and promotion of the commercial insurance products and services of The Hartford. ACEC BIT Trustees are not licensed insurance producers or agents. All Hartford insurance products and services are sold through licensed Marsh sales professionals.