What it does
CY 00 03 is the Information Security Protection (ISP) Cyber Policy of ISO's Cyber program. The 11 21 edition replaced the earlier Information Security Protection form CY 00 10 (01 18) and absorbed the withdrawn Financial Institutions ISP form (CY 00 11) and the Media and ISP forms (CY 00 12, CY 00 13); financial institutions can be written on it.
In ISO's 2020 cyber multistate program revision, Verisk introduced a new Commercial Cyber Insurance Policy form and a new Information Security Protection Cyber Policy form that replaced all prior base coverage forms of the ISO Cyber program, together with new manual rules, loss costs and rating plan. The new forms carry the 11 21 edition (CY 00 02 11 21 and CY 00 03 11 21).
Insuring agreements
- First-party: cyber incident or information security breach expenses, cyber extortion, data restoration and business income and extra expense (the same first four agreements as CY 00 02).
- Liability, claims-made for wrongful acts on or after the Retroactive Date: network security and privacy liability, regulatory proceeding liability, payment card industry liability and media liability.
Key provisions
- First-party coverages use a discovery trigger; discovered incidents must be reported in writing as soon as practicable and no later than 60 days after the end of the policy period or extended discovery period.
- The 11 21 edition added an exclusion for recording and distribution of material in violation of laws such as the TCPA, CAN-SPAM Act, FDCPA and FCRA.
- The business income waiting-period retention can be changed with CY 20 36.
Quoting and selling notes
- Use for larger accounts, regulated data holders (healthcare, financial), and businesses with media or publishing exposure.
- Confirm the retroactive date when replacing another cyber policy, and the extended discovery and reporting options at non-renewal.
Related forms
CY 00 02; CY 20 36; replaced forms CY 00 10, CY 00 11, CY 00 12, CY 00 13.
