Cannabis Cyber Liability Insurance

What Does Cannabis Cyber Liability Insurance Cover?

Cyber policies combine first-party coverage for the business's own costs after an incident with third-party coverage for claims brought by others. The exact mix is set by each policy, since the NAIC describes cyber policies as highly customized.

The Federal Trade Commission's small business guide to cyber insurance lists what each side may include.

First-Party Coverage

• Legal counsel to determine notification and regulatory obligations
• Forensic investigation of the breach
• Recovery and replacement of lost or stolen data
• Customer notification and call center services
• Lost income from business interruption
• Crisis management and public relations
• Cyber extortion and fraud
• Fees, fines and penalties related to the incident, where insurable

Third-Party Coverage

• Payments to consumers affected by the breach
• Litigation and regulatory inquiry costs
• Settlements, damages and judgments
• Claims for defamation and copyright or trademark infringement

Why Is Cyber Risk Different For Cannabis Businesses?

Cannabis businesses collect sensitive identity data at the point of sale, depend on software vendors for sales and state-required tracking, and have already seen industry-wide breaches and outages. Every state has a breach notification law that can apply after an incident.

Sensitive data. Retailers verify age and, in medical programs, patient status at each sale, and point-of-sale systems often store that information. In January 2020, researchers reported that a cannabis point-of-sale vendor's unsecured cloud storage bucket exposed about 85,000 files covering more than 30,000 people, including scanned government IDs, signatures and patient attestation forms, according to Security Magazine.

Vendor dependence. A single software failure can reach hundreds of licensees at once:

• In January 2017, an attack on a major seed-to-sale and retail software provider disrupted about 1,000 retail clients in 23 states. Some dispensaries closed for the day and others switched to manual sales, according to Marijuana Business Daily.
• When Washington launched a new state traceability system in February 2018, someone accessed the database and downloaded four days of delivery records, including vehicle details, IEEE Spectrum reported.

Notification law. According to the National Conference of State Legislatures, all 50 states, the District of Columbia, Guam, Puerto Rico and the Virgin Islands require private businesses to notify individuals of breaches involving personally identifiable information. Cannabis operators also answer to their state cannabis regulator, which may require its own incident reporting.

Which Cannabis Businesses Commonly Carry It?

Dispensaries and delivery services commonly carry cyber coverage because they handle consumer and patient data at volume. Multi-state operators, manufacturers, distributors, cultivators and labs often carry it for system outages, payment fraud and vendor failures.

• Dispensaries and delivery services: ID scans, patient records, loyalty programs, online ordering and point-of-sale systems.
• Multi-state operators: several states' notification laws and regulators can apply to one incident.
• Manufacturers and brands: wholesale accounts, websites, email lists and funds transfer fraud exposure.
• Distributors and cultivators: manifests, inventory and seed-to-sale reporting that stop when systems go down.
• Testing labs: client data and the integrity of reported results.

Cyber losses often overlap with business interruption and directors and officers exposure, so operators often review these lines together.

How Are Limits Typically Structured?

Cyber policies usually carry an overall aggregate limit with sublimits for specific coverages and a retention the business pays first. The GAO reported that insurers have added specific limits on ransomware coverage as attacks have grown.

• Aggregate limit: the most the policy pays for all covered incidents in the policy period.
• Sublimits: smaller caps inside the aggregate for items such as ransomware, social engineering fraud or regulatory penalties. The GAO's May 2021 cyber insurance report found insurers reducing limits for riskier sectors and adding specific ransomware limits.
• Retention: the amount the business absorbs before coverage applies, sometimes paired with a waiting period for business interruption.
• Standalone or endorsement: the NAIC notes cyber is sold both as standalone policies and as part of package policies. Endorsements on other policies may carry lower limits.

The GAO also reported insurers tightening terms and exclusions on cyber-specific policies, so two policies with the same limit can respond very differently.

What Do Carriers Ask For When Quoting Cyber Liability?

Carriers use a cybersecurity risk assessment during underwriting. The GAO found that small businesses may answer a questionnaire of as few as four questions, while larger businesses face a more detailed review that has grown more stringent.

Common areas of inquiry include:

• Revenue, locations and the number of customer and patient records held
• Point-of-sale, seed-to-sale and payment vendors, and what data each holds
• Multifactor authentication on email, remote access and admin accounts
• Backups and how quickly systems can be restored
• Employee training on phishing and payment verification procedures
• Prior incidents and claims

Frequently Asked Questions