Do Your Vendors Have The Right Insurance To Pay For The Damages They May Cause To Your Business?

When you enter into a contract with a vendor, you generally impose insurance requirements on the vendor and an indemnification obligation. But consider whether your current contracts have insurance requirements that would cover the following:

When a computer repair technician damages your inventory data records, does the technician have insurance to pay for the cost of reconstructing those electronic records and your loss of business income? When you are sued for copyright or trademark infringement because your advertising firm plagiarized another company's ideas in its marketing for you, does the advertising firm have insurance to defend and indemnify your company from the suits? When a service provider accidently discloses confidential information and you have to comply with the privacy laws, will the service provider pay for the significant notification and compliance costs? Unfortunately if your purchasing contracts contain the standard insurance boilerplate that merely requires the vendor to maintain Commercial General Liability insurance (CGL), there will probably be no insurance coverage to pay for any of these claims. The standard CGL policy expressly excludes coverage for electronic data, including information and programs stored on a computer.

The absence of coverage stems from the historical fact that the CGL was created in a bricks and mortar world where most of the damages a vendor could cause involved tangible property or bodily injury. In today's cyber world, however, the damages a service provider can cause are more likely to be intangible property, electronic data or economic damage, and therefore not covered by the CGL. The vendor must have an Errors and Omissions policy and cyber risk products to adequately protect your business.

We recommend that you review your contracts with vendors to make a modern day assessment of the risks posed to your business. We suspect that too many of those contracts only require a Commercial General Liability policy.

If a provider has access to your computer system, we recommend that the contract...