About

Services

Resources

Contact Us

articles

Articles

Since 2001, farms, greenhouses and other agricultural operations with boilers and pressure vessels have been exempt from the associated inspection regulations in Ontario. Due to growing safety concerns, this exemption is now coming to an end.
<h3>What&rsquo;s changing?</h3>
Effective July 1, 2021, boilers and pressure vessels (BPV) used exclusively for agricultural purposes must comply with:
<ul>
<li><a href="https://www.ontario.ca/laws/regulation/010220" title="" target="_blank" rel="noopener">Ontario Regulation 220/01: Boilers and Pressure Vessels</a>, under the Technical Standards and Safety Act, 2000.This regulation applies to the design, construction, maintenance, use, operation, repair and service of boilers, pressure vessels and piping in Ontario.&nbsp;</li>
<li><a href="https://www.tssa.org/en/boilers-pressure-vessels/resources/BPV-20-01-R1-Jan-5-2021-Web.pdf" aria-invalid="true" target="_blank" rel="noopener">BPV Code Adoption Document 2021</a>, (which includes amendments to <a href="https://www.csagroup.org/store/product/2701790/" title="" target="">CSA B51</a> and <a href="https://www.csagroup.org/store/product/CSA%20B52%3A18/?gclid=Cj0KCQjw4ImEBhDFARIsAGOTMj-SJrT9eaZhrewwrufs1vPuTOc9L4QmttsaNIMFLq6auItfES0u-WIaApK-EALw_wcB" title="" target="">CSA B52</a> to address Ontario requirements)</li>
</ul>
<h3>Who&rsquo;s impacted / what equipment is affected?</h3>

Revocation of the Ontario Agricultural Exemption

Few types of coverage are quite as misunderstood as Equipment Breakdown insurance. Though brokers and buyers are becoming more informed, there remains a common misconception that Equipment Breakdown only provides coverage for conventional equipment such as pressure vessels and mechanical machines. But this is not your father&rsquo;s (or your grandfather&rsquo;s) Boiler and Machinery insurance. Equipment Breakdown is an essential coverage for almost any business. While many owners and operators think losses related to equipment breakdown are covered under their Property policy, there are exclusions that Equipment Breakdown insurance is designed to fill. Not only does Equipment Breakdown insurance cover equipment that needs to be repaired or replaced, it also covers losses due to business interruption. For example, if key equipment is damaged, a company may not be able to continue their operations right away, which could have big financial and reputational impacts. Or, if a company has a refrigeration breakdown, it would be very costly to throw out spoiled product. Equipment Breakdown coverage helps companies mitigate revenue losses and get back in business as quickly as possible. So why has Equipment Breakdown coverage been widely misunderstood? A quick history lesson: Boiler and Machinery insurance was created during the Industrial Revolution to protect companies with steam boilers from the risk of explosion or other major breakdown. Over the ensuing decades, the coverage evolved to include a broader range of equipment and electronics, including computers, copiers and phone systems. Understandably, the Boiler and Machinery moniker led many people to believe that if their business didn&rsquo;t have a boiler or machinery risk, they didn&rsquo;t need the coverage. That necessitated new terminology&mdash;Equipment Breakdown insurance&mdash;which came about in the late 1990s. Today, Equipment Breakdown insurance is all-encompassing, ranging from HVAC equipment, to production machinery equipment (Computer Numerical Control &ndash; CNC - machines), to all types of electrical and technology equipment. However, there&rsquo;s still a lack of understanding about how essential this coverage is for just about every business. To keep Equipment Breakdown insurance top of mind among brokers and insureds, education is key. With the constant influx of new technologies and cutting-edge equipment, brokers need to stay up to date on the trends and have the tools and resources to provide information to clients.

Why equipment breakdown insurance is essential for your business

Today, boilers and pressure vessels are ubiquitous in modern society and are used across many sectors, including power generation, manufacturing, agri-food, forestry and dry cleaning. 1&nbsp;But when it comes to managing the risks associated with them, many companies still aren&rsquo;t aware of the role their insurers play with regards to inspections, their responsibilities as owners and how inspections can be beneficial to their businesses. Here are three key reasons why you not only need a jurisdictional inspection, but how it can benefit your business.
<h3>It&rsquo;s the law!</h3>
First and foremost, regular inspection of boilers and pressure vessels is the law, and it&rsquo;s important for owners and operators to stay on top of any regulatory changes. In July 2018, The Technical Standards and Safety Authority (TSSA) introduced new regulations for boilers and pressure vessels in Ontario. 2&nbsp;Previously, the insurer would issue a Certificate of Inspection directly to the client. Now, boiler and pressure vessel (BVP) owners must work directly with the TSSA, which will issue a Certificate of Inspection after the device has passed a periodic inspection and the insurer submits a Record of Inspection. Owners are required to pay a fee to the TSSA to receive their Certificate of Inspection. Ultimately, the onus is on owners and operators to comply with the law. In Ontario, if it&rsquo;s determined that the boiler or pressure vessel falls under the regulations, the owner or user is responsible for having it inspected before being put into operation (by the TSSA) and on a periodic basis after being put into service (by their insurance company). Once in operation, the insurer or third-party inspector will inspect every one, two or three years as required by the regulations. Qu&eacute;bec has similar requirements, though differs slightly in inspection frequency. In Qu&eacute;bec, if it&rsquo;s determined that the boiler or pressure vessel falls under the regulations, the owner or user is responsible for having it approved before being put into operation by the R&eacute;gie du b&acirc;timent du Qu&eacute;bec (RBQ). 3&nbsp;After being put into service, the boiler or pressure vessel is then inspected on a periodic basis by a person or body recognized by the RBQ, which issues a periodic inspection certificate. The inspection frequency varies, and may be a one, two, three or four-year cycle depending on the type of boiler or pressure vessel. Insurance companies are valuable partners in this regard. They can help companies determine if their vessel falls under the regulations and what the inspection requirements are, as well as help them comply with the regulations.
<h3>It&rsquo;s a matter of safety</h3>
In any jurisdiction, the primary reason boilers are periodically inspected is to verify compliance with safety requirements. Boilers can explode, causing property damage, injuries and deaths 4, so ensuring the safety of people who are in the vicinity of the unit &mdash;whether they&rsquo;re employees or members of the public &mdash; is job number one.
<h3>It can save you money</h3>
Beyond the critical importance of safety, regular inspections have bottom-line benefits for owners and operators. For example, a common discovery during inspections is the formation of scale on the heat transfer surfaces of the boiler. 5 Scaling reduces the rate of heat transfer across boiler tubes, and the reduced efficiencies result in increased energy costs. 6&nbsp;&nbsp;While regular maintenance and proper upkeep is imperative, an inspector&rsquo;s expertise can help ensure efficient operation and extend the life of the equipment. Though explosions are rare considering the sheer volume of boilers in operation around the world, they can also be very costly to businesses. First, there&rsquo;s the damage from the explosion itself, and then there&rsquo;s the cost of replacing the units. Insurance is the obvious way to reduce financial impacts in the event of an accident &ndash; but you need the right coverages in place. For example, it&rsquo;s important to note that losses to equipment aren&rsquo;t always covered under Property policies and there are exclusions that Equipment Breakdown insurance is designed to fill.
Sources
1&nbsp;Ontario&rsquo;s Regulatory Registry:&nbsp; <a https:="" www="" ontariocanada="" com="" registry="" view="" do="" postingid="24227&amp;language=en&quot;&quot;" href="https://www.ontariocanada.com/registry/view.do?postingId=24227&amp;language=en">Boilers and Pressure Vessels Regulatory Review</a>&nbsp;June 2, 2017 2&nbsp;TSSA:&nbsp; <a noreferrer="" noopener="" https:="" www="" tssa="" org="" en="" boilers-pressure-vessels="" resources="" documents="" bpvcoi="" bpv-regulation-change-notice-for-device-owners1="" pdf="" target="_blank" _blank="" href="https://www.tssa.org/en/boilers-pressure-vessels/resources/Documents/BPVCOI/BPV-Regulation-Change-Notice-for-Device-Owners1.pdf" aria-invalid="true" rel="noopener">Amendments to Ontario&rsquo;s Boilers and Pressure Vessels Regulation</a>&nbsp;February 2, 2018 3&nbsp;B-1.1, r. 6.1 -&nbsp; <a rel="" noreferrer="" noopener="" http:="" legisquebec="" gouv="" qc="" ca="" en="" pdf="" cr="" b-1="" 1="" 20r="" 206="" target="" _blank=""></a><a href="http://legisquebec.gouv.qc.ca/en/pdf/cr/B-1.1,%20R.%206.1.pdf" title="" target="_blank" rel="noopener"></a><a rel="" noreferrer="" noopener="" http:="" legisquebec="" gouv="" qc="" ca="" en="" pdf="" cr="" b-1="" 1="" 20r="" 206="" target="" _blank=""></a><a href="http://legisquebec.gouv.qc.ca/en/pdf/cr/B-1.1,%20R.%206.1.pdf" title="" target="_blank" rel="noopener">Regulation respecting pressure installations</a>&nbsp;Updated November 1, 2019 4&nbsp;Engineering 360:&nbsp; <a rel="" noreferrer="" noopener="" https:="" insights="" globalspec="" com="" article="" 2044="" training-and-vigilance-key-to-preventing-boiler-accidents="" target="" _blank=""></a><a href="https://insights.globalspec.com/article/2044/training-and-vigilance-key-to-preventing-boiler-accidents" title="" target="_blank" rel="noopener" aria-invalid="true">Training and Vigilance Key to Preventing Accidents</a>&nbsp;February 2, 2016 5&nbsp;The National Board of Boiler and Pressure Vessel Inspectors:&nbsp; <a rel="" noreferrer="" noopener="" https:="" www="" nationalboard="" org="" index="" aspx="" pageid="164&amp;ID=224&quot;&quot;" target="" _blank=""></a><a href="https://www.nationalboard.org/Index.aspx?pageID=164&amp;ID=224" title="" target="_blank" rel="noopener">Water Maintenance Essential to Prevent Boiler Scaling</a>, accessed August 22, 2019 6&nbsp;U.S. Department of Energy:&nbsp; <a rel="" noreferrer="" noopener="" https:="" www="" energy="" gov="" sites="" prod="" files="" 2014="" 05="" f16="" steam7_surfaces="" pdf="" target="" _blank=""></a><a href="https://www.energy.gov/sites/prod/files/2014/05/f16/steam7_surfaces.pdf" title="" target="_blank" rel="noopener" aria-invalid="true">Clean Firetube Boiler Waterside Heat Transfer Surfaces</a>, accessed August 22, 2019

Why do you need a jurisdictional inspection?

While businesses are becoming increasingly aware of the dangers of social engineering, it&rsquo;s important to remain ever vigilant because the tactics continue to evolve. Tactics like phishing remain a threat and there&rsquo;s no doubt that the impact can be substantial. That being said, the impact is generally contained to one company. Vendor Email Compromise (VEC) on the other hand is an emerging social engineering tactic that not only compromises one company, but their entire supply chain. These strikes are becoming increasingly more prevalent, as they bring the possibility of an even bigger payout for attackers. According to Armen Najarian, Chief Identity Officer of The Agari Cyber Intelligence Division (ACID) group, &ldquo;on average, a Business Email Compromise (BEC) CEO fraud attack will generally pay out in the $50,000 to $55,000 range, but a successfully executed Vendor Email Compromise (VEC) attack will pay more than double at around $125,000 on average.&rdquo; 1&nbsp; According to Agari, &ldquo;VEC is likely to overtake BEC as the single biggest potential financial fraud during the course of 2020.&rdquo; 2&nbsp; That&rsquo;s why it&rsquo;s so important to watch out for and properly educate employees &ndash; especially those that receive and process invoices.&nbsp; Here&rsquo;s what you need to know to prevent a VEC attack on your business.
<h3>What is Vendor Email Compromise (VEC)?</h3>
A VEC attack aims to take over the email account of a vendor. The attacker issues near-identical vendor invoices or billing documents to the often-larger client companies with new banking information in the hopes of diverting payments to themselves. The destination accounts are often accounts owned by the attacker, used to aggregate funds from multiple targets but, without a paper trail leading back to the attacker.
<h3>How do they do it?</h3>
<ul>
<li>The VEC group sends phishing emails to the vendor's staff that include a malicious link.</li>
<li>Once the vendors click on the link, they're redirected to a phishing login page where vendors are asked to log in using their credentials.</li>
<li>Once the vendors enter their credentials, the attacker uses those credentials to set a forwarding rule to forward all emails received by the vendors to the attacker's email.</li>
<li>The attacker then monitors the inbox for any emails regarding invoices or payments.</li>
<li>If the attacker notices emails that contain invoices or payments, they will duplicate those invoices and send a modified invoice with new banking details pointing to an attacker owned account (often a mule account).</li>
<li>The actual target customer is never phished or directly contacted.</li>
<li>The vendor's customer makes a payment to the attacker's bank account thinking that the email invoice is from the vendor.</li>
</ul>
<h3>What to look for:</h3>
<ul>
<li>Urgent requests to change bank account information or payment instructions.</li>
<li>Updating account or payment information right before the normal payment cycle.</li>
<li>Requests for one-time wire transfers or EFTs to a different bank or account number.</li>
<li>Invoices from possible spoofed or suspicious looking email addresses.</li>
<li>Invoices from representatives at the vendor organization that do not typically send invoices or are not recognized.</li>
</ul>
<h3>Prevention Techniques:</h3>
<ul>
<li>Ask for confirmation of banking information or payment changes through another method:
<ul>
<li>Telephone number published in the original intake form or published on the company's website (instead of using a phone number provided by the potentially compromised email).</li>
<li>An alternate email address from the same domain (@companyxyz.com) but not provided by the compromised email address.</li>
</ul>
</li>
<li>Consider a secondary review of payment information changes by another team member to increase the probability of identifying unusual or suspicious information.</li>
<li>Recommending preventative measures for vendors:
<ul>
<li>Disallow email auto-forwarding rules.</li>
<li>Ensure anti-phishing/suspicious email training is completed.</li>
</ul>
</li>
</ul>
Sources
1Townsend, K. (2019, November 4).&nbsp; <a https:="" www="" securityweek="" com="" vendor-email-compromise-latest-identity-deception-attack="" target="" _blank="" rel="" noreferrer="" noopener=""></a><a href="https://www.securityweek.com/vendor-email-compromise-latest-identity-deception-attack" title="" target="_blank" rel="noopener" aria-invalid="true">Vendor Email Compromise is Latest Identity Deception Attack</a>. Retrieved March 11, 2020 2Townsend, K. (2019, November 4).&nbsp; <a https:="" www="" securityweek="" com="" vendor-email-compromise-latest-identity-deception-attack="" target="" _blank="" rel="" noreferrer="" noopener=""></a><a href="https://www.securityweek.com/vendor-email-compromise-latest-identity-deception-attack" title="" target="_blank" rel="noopener" aria-invalid="true">Vendor Email Compromise is Latest Identity Deception Attack</a>.&nbsp;Retrieved March 11, 2020

Understanding Vendor Email Compromise Attacks

It may be called &ldquo;silent&nbsp;cyber,&rdquo; but the topic is generating a lot of noise in the commercial insurance sector.
<h3>What is silent cyber?</h3>
Silent or &ldquo;non-affirmative&rdquo; cyber refers to potential cyber-related insurance losses arising from insurance policies that weren&rsquo;t specifically designed to cover cyber risks. The policies don&rsquo;t explicitly include or exclude cyber risk, which creates ambiguity and can leave coverage open to interpretation. A standalone cyber insurance policy, on the other hand, clearly outlines what is covered (aka affirmative coverage), such as privacy, business interruption and extortion coverage, to name a few.
<h3>Why is silent cyber a rising concern?</h3>
While silent cyber isn&rsquo;t a new concept, it&rsquo;s getting more attention with the rise of cybercrime and the cost of attacks. Simply put, businesses can&rsquo;t afford to have inadequate or ambiguous cyber protection.&nbsp; According to the 2019 &ldquo;Cost of Cybercrime&rdquo; study by Accenture and the Ponemon Institute, the average cost of cybercrime to a Canadian company was $12.1 million in 2018. 1&nbsp;Globally, six in seven companies (85%) experienced phishing and social engineering cyber attacks in 2018, and three-quarters (76%) suffered web-based attacks. Cybersecurity Ventures projects that the global cost of cybercrime will hit $6 trillion by 2021, up from $3 trillion in 2015. 2 Furthermore, PwC&rsquo;s latest Global Economic Crime and Fraud Survey found that cybercrime features in the top three most disruptive crimes experienced in almost all industries reported in the survey. 3 As the frequency, scale and cost of attacks continue to rise, so too does the concern around silent cyber. It&rsquo;s more important than ever that policyholders understand their coverage so they&rsquo;re not stuck in a position of believing they have adequate coverage when in reality, they may not. A stand-alone cyber policy helps ensure that they reduce possible gaps in protection.
<h3>Are there regulations around silent cyber?</h3>
The U.K. was the first major market to take a tough stand on silent cyber. Last year, the Prudential Regulation Authority (part of the Bank of England) called on Lloyd&rsquo;s of London and the wider insurance sector to ensure the management of affirmative and non-affirmative cyber risk exposures. Following that, Lloyd&rsquo;s announced that it&rsquo;s mandating that all non-affirmative policies provide clarity regarding cyber coverage by either excluding or providing affirmative coverage.&nbsp;&nbsp; Similarly, on the policyholder side, global ratings agency A.M. Best announced it &ldquo;expects companies to be proactive and forthcoming with their own evaluation and measurement of the exposure and accumulation of their cyber liability exposure.&rdquo; 4 While regulations in Canada have yet to be tabled, insurers are reviewing how coverages can be placed through all policies&euro;&rdquo;not just dedicated cyber policies.&nbsp;
<h3>What can an insurance company do to prevent potential gaps in coverage?</h3>
Both brokers and commercial property underwriters need to become more aware of the issues relating to cyber events. That starts with detailed risk assessments to clearly understand the specific cyber vulnerabilities of an organization. For example, an industrial plant might be aware of its risk of a boiler explosion, but this type of event could also happen in a cyber-attack. A plant could be targeted by a cyber virus that disables the critical safety control systems relating to a boiler&rsquo;s operational procedure, exposing the plant to a possible explosion. This could result in a major disruption in the plant&rsquo;s daily operations &euro;&ldquo; not to mention a serious public safety risk. Education is a key factor for all brokers and underwriters, whether they specialize in property liability, or other risks ranging from D&amp;O, crime, environmental and other commercial divisions. As cyber risks continue to rise, so too does the need for explicit coverage. Stand-alone cyber policies help reduce possible gaps in protection. If you&rsquo;re unsure as to whether your operations are fully covered, contact your broker today.
Sources
1 <a rel="noreferrer noopener" href="https://www.accenture.com/_acnmedia/pdf-96/accenture-2019-cost-of-cybercrime-study-final.pdf" target="_blank" _blank="">The Ninth Annual Cost of Cybercrime </a>Study 2019 by Accenture and Ponemon Institute 22020 <a href="https://www.herjavecgroup.com/the-2019-official-annual-cybercrime-report/">Official Annual Cybercrime Report</a> by Cybersecurity Ventures, sponsored by Herjavec Group 3 <a href="https://www.pwc.com/gx/en/services/forensics/economic-crime-survey.html">PWC&rsquo;sGlobal Economic Crime and Fraud Survey 2020</a> 4Moorcraft, B. (2018, November 26). <a rel="noreferrer noopener" href="https://www.insurancebusinessmag.com/ca/guides/what-is-silent-cyber-risk-117152.aspx" target="_blank" _blank="">What is silent cyber risk? </a>Retrieved May 19, 2020
"

The Rise and Risks of Silent Cyber

Despite the rise of automation and artificial intelligence technologies, the vast majority of business that gets conducted relies on some sort of human interaction or connection. Employees are an organization&rsquo;s greatest asset, but also remain every organization&rsquo;s weakest link when it comes to defending against a cyber breach. You can implement the latest firewall technology and employ a genius Chief Information Officer, but if all staff members aren&rsquo;t aware of the types of scams that cyber criminals are trying to pull, then chances are your organization could fall victim to a social engineering attack.
<h3>What is social engineering?</h3>
Simply put, social engineering is a form of psychological manipulation that targets the user rather than the computer itself &ndash; and it&rsquo;s proving to be very effective for cybercriminals. It plays on our universal human traits of fear, trust and conformity to get access to information, all without hacking into a system or cracking a code or password.

<blockquote>
Your first line of defense might be to invest in antivirus software and firewall (software and physical versions) with intrusion detection capabilities &ndash; and that&rsquo;s a great start. But that won&rsquo;t account for human weaknesses, like a lack of attention to detail or an all too trusting nature.
</blockquote>
<h3>The impact on your business</h3>
If organizations don&rsquo;t take measures to educate and train their employees on social engineering tactics, it&rsquo;s more likely that they&rsquo;ll fall for scams, get hacked, experience a breach and become the victim of fraudulent wire transfers. Any of these events can be incredibly costly and could impact the company&rsquo;s reputation. And this can be repeated multiple times if the bad guys find a &lsquo;good victim&rsquo;. In addition to the monetary impact, being scammed doesn&rsquo;t feel good and can take an emotional toll on your employees.
<h3>Phishing tactics</h3>
Phishing is a technique where cybercriminals send fake emails, texts or websites that look like legitimate correspondence to manipulate employees into gaining access to corporate systems or information. It uses social engineering tactics by deceptively preying on employees&rsquo; emotions and relying on them to mistakenly hand over access to target information.
A phishing breach usually occurs when a hacker gets the structure of an organization&rsquo;s email addresses and then sources a list of names of company employees, usually from LinkedIn or the company&rsquo;s own website.
Similarly, a cybercriminal could get the log in details to a company executive&rsquo;s email address and send out emails to other employees directly from that account. They could then either request sensitive information or ask them to send wire transfers on behalf of the company. In many cases, the employee receiving that email will think the request is legitimate and provide the sensitive information or transfer the funds.
Another form of phishing sees hackers send out emails &ndash; again appearing to be from a legitimate email address &ndash; containing a link or attachment.
That link can do a couple of different things: it can send them to a web page with a form which asks them to provide personal information, it can include spyware to gather information on the company (and its employees and clients), or it can include a ransomware file attachment which activates when downloaded. That file will encrypt the files on the user&rsquo;s computer and only unencrypt them when a ransom is paid to the criminal&rsquo;s bank account.
<h3>Tips to protect your business</h3>
Social engineering is something that can be mitigated if employees are well educated. Your first line of defense might be to invest in antivirus software and firewall (software and physical versions) with intrusion detection capabilities &ndash; and that&rsquo;s a great start. But that won&rsquo;t account for human weaknesses, like a lack of attention to detail or an all too trusting nature. That&rsquo;s why it&rsquo;s so important to educate employees on social engineering and phishing, and the specific tactics they should look out for. This can help foster a culture in which employees are alert and cautious with information whether they&rsquo;re online or in-person.
Encourage employees to follow the steps below to reduce the chances of social engineering impacting your organization:
<ul>
<li>Avoid opening emails from unknown email addresses</li>
<li>Create better, stronger passwords &ndash; and change them regularly</li>
<li>Avoid less than reputable internet sites, web and smartphone applications</li>
<li>Cut down on the amount of biographically accurate information you divulge online (e.g. listing your birthdate on social media)</li>
<li>Only use trusted sites when online</li>
<li>Don&rsquo;t click on links you&rsquo;re sent. Instead, open the webpage on your own by typing in the URL yourself to make sure you&rsquo;re going to a legitimate site and not a phishing scam site</li>
<li>Log out of Facebook and other social media accounts when you&rsquo;re not using them and before you close your browser window</li>
<li>Don&rsquo;t choose &ldquo;save my password&rdquo; or &ldquo;remember me&rdquo; when logging onto any type of account, as these credentials can be stolen by hackers</li>
<li>Follow the company&rsquo;s &ldquo;new vendor/account change&rdquo; protocol to verify clients before sending wire transfers above a certain predetermined threshold. This could involve requiring employees to call vendors (using the phone number in your files, not the one in the email) before making the transfer.</li>
</ul>

Social engineering: your business is at risk from human blunders

Cyber attacks are a growing concern for organizations across all sectors&mdash;and with good reason. Globally, the average number of security breaches experienced by a company in the last year grew by 11% from 130 to 145, according to 2019 &ldquo;Cost of Cybercrime&rdquo; study by Accenture and the Ponemon Institute. 1&nbsp;As the number of attacks increases, so too does the cost: CyberSecurity Ventures predicts that global losses related to cyber attacks will reach US$6 trillion by 2021, up from US$3 trillion in 2015.&nbsp; 2 A new report from Aon, &ldquo;Prepare for the expected: Safeguarding value in the era of cyber risk,&rdquo; 3&nbsp;notes that business face financial loss in the form of immediate crisis expenses, regulatory fines and lost revenue from disruption to the business. There&rsquo;s also reputational risk, as an attack can erode a company&rsquo;s market value, destroy brand loyalty and limit a company&rsquo;s digital transformation, notes Aon. Businesses are wisely investing in cyber security&mdash;CyberSecurity Ventures predicts more than US$1 trillion will be spent from 2017 to 2021&mdash;but no measures are 100% effective. That&rsquo;s why it&rsquo;s also critical to have a cyber resilience plan in place, which covers how your organization withstands, responds to, and recovers from a cyber attack or data breach. While cyber resilience plans will look different at every organization, one commonality is the importance of testing those plans. A stress test allows organizations to see how quickly and effectively they react and respond to any given cyber risk. As Deloitte notes in the report, &ldquo;Five essential steps to improve cyber security,&rdquo; 4&nbsp;most organizations have a security management process in place, but few have tested it.
<figure class="wp-block-pullquote">
<blockquote>
Globally, the average number of security breaches experienced by a company in the last year grew by 11% from 130 to 145, according to 2019 &ldquo;Cost of Cybercrime&rdquo; study by Accenture and the Ponemon Institute. 1 
</blockquote>
</figure>
The report outlines key questions organizations should ask, such as &ldquo;Who should be contacted during and after an incident?&rdquo; and how quickly can you contain a security breach and restore your organization to normal operation?&rdquo; &ldquo;But answering the questions is just part of the equation,&rdquo; Deloitte states. &ldquo;Testing your answers is critical.&rdquo;
<h3>Here are four best practices for testing your cyber resilience plan:</h3>
<ul>
<li>Get everyone on the same page:&nbsp;As with any large undertaking, C-suite support is the first&mdash;and most essential&mdash;step in creating and testing a cyber resilience plan. As one cyber-security expert notes, without C-suite support, it&rsquo;s impossible for cyber-security leaders to effectively plan for and defend against threats. 5&nbsp;And since cyber security affects every employee, everyone in the organization needs to be aware of the plan and understand their roles and responsibilities.</li>
<li>Conduct a vulnerability scan:&nbsp;In the computing world, a vulnerability is a weakness in a device or system that can be exploited by cyber attackers. A vulnerability scan (or assessment) allows businesses to identify which parts of their system are the weakest and most likely to be targeted, and therefore the most relevant to the cyber resilience plan. 6</li>
<li>Carry out cyber simulations:&nbsp;As Deloitte notes, cyber simulations are interactive techniques that immerse participants in a simulated attack scenario to help organizations evaluate their response and preparedness. Some specific attacks organizations may want to test for are phishing emails&mdash;fraudulent emails designed to get people to unwittingly share passwords or financial information, or malicious attachments&mdash;documents that appear to be legitimate, but are actually a virus or malware.</li>
<li>Review and make improvements to your plan:&nbsp;&ldquo;There&rsquo;s absolutely no point running simulated attacks if they&rsquo;ll play no role in optimizing the incident response processes,&rdquo; says another cyber-security expert. 7&nbsp;Determine what worked well and what didn&rsquo;t in your response plan. Identify areas for improvement and adjust the necessary processes.</li>
</ul>
If you&rsquo;ve followed these steps but feel like you still need some support or guidance, your insurer may be able to help. The possibility of a cyber attack doesn&rsquo;t have to be overwhelming when you&rsquo;ve stress tested your plan and know it stands up.
Sources
1&nbsp;Research Report:&nbsp; <a href="https://www.accenture.com/ca-en/insights/security/cost-cybercrime-study" aria-invalid="true">"Ninth annual cost of cybercrime study."&nbsp;</a>Accenture, March 6, 2019 2&nbsp; <a href="https://cybersecurityventures.com/cybercrime-damages-6-trillion-by-2021">"Global Cybercrime Damages Predicted to Reach $6 Trillion Annually By 2021".&nbsp;</a>Cybercrime Magazine, December 7, 2018 3&nbsp;Media Release&nbsp; <a href="https://aon.mediaroom.com/csuitecyberreport">"Aon report shares C-suite insights as losses from cyber attacks set to reach all-time highs"</a>,&nbsp;accessed December 4th, 2019 4&nbsp; <a href="https://www2.deloitte.com/content/dam/Deloitte/ca/Documents/risk/ca-en-risk-cyber-5-steps.pdf">"Five essential steps to improve cybersecurity",</a>&nbsp;Deloitte, accessed December 4th, 2019 5&nbsp;Burley, Ron " <a href="https://www.cpomagazine.com/cyber-security/how-cybersecurity-leaders-can-best-navigate-the-c-suite/" aria-invalid="true">How Cybersecurity Leaders Can Best Navigate the C-Suite"</a>&nbsp;CPO Magazine, September 13, 2019 6&nbsp;" <a href="https://blog.rsisecurity.com/best-practices-for-testing-your-cyber-incident-response-plan">Best Practices for testing you Cyber Incident Response Plan"</a>&nbsp;RSI Security, February 8, 2019 7&nbsp;Reichenberg, Nimmy " <a href="https://www.siemplify.co/blog/testing-incident-response-processes/" aria-invalid="true">Putting Your Incident Response Processes to the Test"</a>&nbsp;Siemplify, July 8, 2018

How to stress test your business for cyber resiliency

Email encryption is the process of encoding your sensitive or private data so that it&rsquo;s scrambled or inaccessible to unauthorized users. Encryption helps ensure confidentiality, protect against unwanted access to your email account, and prevent the interception of sensitive or personal information. It&rsquo;s an important measure to put in place when communicating confidential information to help prevent a data breach. Afterall, if a hacker can&rsquo;t read contents of the email, they can&rsquo;t harm you with it.
<h3>What type of information should you encrypt?</h3>
Private, confidential information that should be encrypted may include bank and credit card details, financial statements, personal client information, passwords, security documents, and tax records &ndash; just to name a few. Unauthorized disclosure of this information could lead to financial loss or identity theft, so special care and preventive measures must be taken to protect it.
<h3>How does it work? 1 </h3>
Encrypted data is scrambled so that it&rsquo;s illegible to anyone who doesn&rsquo;t have the decryption key or password to &lsquo;decode&rsquo; and access the information. &lsquo;Keys&rsquo; are the digital codes that allow you to encrypt and decrypt messages. The information is coded and decoded as follows:
<ul>
<li>A public key is a digital code used to encrypt the email. The sender uses the recipient&rsquo;s public key to scramble the email message. This key is stored on a key server that&rsquo;s accessible to anyone. You cannot send an encrypted email to someone without access to their public key.&nbsp;</li>
<li>A private key is a private digital code that the recipient uses to decode the email. It&rsquo;s stored on their private computer.</li>
</ul>
There are two main types of email encryption methods: S/MIME (Secure/Multipurpose Internet Mail Extensions) and PGP/MIME (Pretty Good Privacy/Multipurpose Internet Mail Extensions). Here&rsquo;s the difference:
<ul>
<li>S/MIME:
<ul>
<li>relies on a centralized authority to pick the encryption algorithm</li>
<li>built into large web-based email companies such as Gmail and Outlook</li>
<li>key code is generated for you</li>
</ul>
</li>
<li>PGP/MIME:
<ul>
<li>relies on a decentralized authority to pick the encryption algorithm</li>
<li>offers more flexibility and control over how you want your emails to be encrypted</li>
<li>requires a third-party encryption tool</li>
</ul>
</li>
</ul>
In order for the recipient to decrypt an email encrypted by the sender, both parties must use the same encryption method.
<h3>How to encrypt your emails</h3>
Before you send an encrypted email, be sure to let the recipient know in advance that you&rsquo;re initiating an encrypted email conversation. And once all sensitive information has been shared, it&rsquo;s important to close the confidential encrypted email thread by starting a new email conversation. This way future messages won&rsquo;t be encrypted automatically, and you won&rsquo;t inconvenience the recipient with the additional step of requesting a passcode.&nbsp; For details on how to encrypt your emails, refer to these resources for helpful instructions:
<ul>
<li><a href="https://support.microsoft.com/en-us/office/encrypt-email-messages-373339cb-bf1a-4509-b296-802a39d801dc" target="_blank" rel="noreferrer noopener">Outlook</a></li>
<li><a href="https://support.google.com/mail/answer/6330403?hl=en" target="_blank" rel="noreferrer noopener">Gmail</a></li>
<li><a href="https://support.apple.com/en-ca/HT202345" target="_blank" rel="noreferrer noopener">iOS</a></li>
</ul>
<h3>Other cyber security considerations</h3>
Email encryption is a great way to help protect the sensitive data you&rsquo;re sending back and forth, but it&rsquo;s just one tactic within a company&rsquo;s overall cyber security strategy. In addition, it&rsquo;s important to carry out robust cyber exposure analysis and work with your broker to implement proactive risk management solutions.&nbsp;
Source
1January 2, 2019. Panda Security Media Center. <a rel="noreferrer noopener" href="https://www.pandasecurity.com/en/mediacenter/panda-security/how-to-encrypt-email/" target="_blank">&nbsp;&ldquo;How to Encrypt Email (Gmail, Outlook, iOS, Yahoo, Android, AOL)&rdquo;</a>. Retrieved October 26, 2020

How to encrypt email

A data breach is a business emergency that has to be managed quickly and effectively to mitigate losses and stay on the right side of compliance. When such an event happens, many organizations call in a data breach coach: the &ldquo;first responder&rdquo; who leads the response and recovery. Typically, a data breach coach is a lawyer who specializes in cyber security and privacy law. Acting as a project manager, they guide an organization on the best course of action, with help from a team they assemble from a variety of disciplines. The team can include experts from IT, forensics, legal, regulatory and communications, all of whom may be needed to help manage the breach. 1 Why work with a data breach coach? As in many other crisis-management situations, your in-house staff may not have the expertise to handle a data breach, or you may want to keep your key staff focused on their regular responsibilities. Having a legal expert take the lead is beneficial, as they understand laws regarding notification requirements and have experience working with regulators on issues like fines and penalties. One legal expert also noted that as lawyers, data breach coaches are able to guard your information with solicitor-client privilege, which can add an extra layer of protection and security to your communications. 2 There are three key areas that data breach coaches manage:
<ol>
<li>Breach Investigation: A data breach coach can help you hire a computer forensics company to investigate the cause and scope of breach. Forensic teams work to identify the type of hack, approaches used, the source and timeline, and determine how best to recover compromised data. 3 They also preserve all the necessary evidence and can work with the data breach coach to identify potential legal and compliance issues. 4</li>
<li>Notification Requirements:&nbsp;A data breach coach will analyze the facts uncovered by forensics to determine what steps to take in a legal context and help your business remain compliant. Legal obligations may include providing notice of the breach to affected individuals and regulators, depending on what information was compromised. For example, in Canada, a breach involving &ldquo;real significant harm&rdquo; to individuals needs to be reported to the Office of the Privacy Commissioner of Canada.&rdquo; Real significant harm is determined based on the sensitivity of the information involved in the breach and probability for misuse. 5&nbsp;</li>
<li>Crisis Communications:&nbsp;A data breach coach can secure crisis communications professionals to ensure any communications regarding a data breach are carefully planned and managed. This can reduce risks such as reputational harm to your business.&nbsp; 6&nbsp;The team can determine how those affected by the breach should be alerted, what statements to make to the public and the media, and how to communicate with authorities. They can also provide contact information and handle inquiries from customers and the media.&nbsp; 7,8</li>
</ol>
In the event of a data breach, it&rsquo;s important to respond quickly and correctly. If your organization doesn&rsquo;t have the internal resources to handle legal and compliance issues, or have expertise in crisis communications, having a data breach coach take the lead is a smart move. They are an invaluable source of information and expertise, and can help take the load off your shoulders in a time of crisis.
Sources: 1 <a rel="noreferrer noopener" href="https://www.siskinds.com/data-breach-frequently-asked-questions/" target="_blank">&ldquo;Data Breach: Frequently Asked Questions,&rdquo;</a> Siskinds, May 2020 2,6 <a rel="noreferrer noopener" href="https://www.forbes.com/sites/forbestechcouncil/2019/07/29/why-your-company-should-secure-a-breach-coach/?sh=244dc8006b76" target="_blank">&ldquo;Why Your Company Should Secure A Data Breach Coach,&rdquo;</a> Forbes, July 29, 2019 3,4 <a rel="noreferrer noopener" href="https://securecyberdefense.com/digital-forensics-identifying-the-who-what-when-and-how-of-cyberattacks-2/" target="_blank" aria-invalid="true">&ldquo;Digital Forensics: Identifying the Who, What, When and How of Cyber Attacks,&rdquo;</a> Secure Cyber Defense 5 &ldquo; <a rel="noreferrer noopener" href="https://www.priv.gc.ca/en/privacy-topics/business-privacy/safeguards-and-breaches/privacy-breaches/respond-to-a-privacy-breach-at-your-business/gd_pb_201810/#_Part_6" target="_blank">What you need to know about mandatory reporting of breaches of security safeguards,&rdquo; </a>Office of the Privacy Commissioner of Canada, Oct. 2018 7 <a rel="noreferrer noopener" href="https://www.pushkinpr.com/blog/crisis-communications-plan-data-breaches/" target="_blank">&ldquo;A Crisis Communications Plan for Data Breaches,&rdquo;</a> Pushkin PR 8 <a rel="noreferrer noopener" href="https://medium.com/@crisisPR/why-your-company-needs-a-data-breach-communications-plan-6dd3488bb3e3" target="_blank">&ldquo;Why Your Company Needs a Data Breach Communications Plan,&rdquo; </a>Medium, March 9, 2020

Do you need a data breach coach?

In the event of a cyber-attack, properly prepared businesses take immediate action, whether it&rsquo;s putting their IT team on the case, or calling in experts like a cyber breach coach. While having a response plan in place is vital to mitigate risks such as business interruption, regulatory fines, or legal costs, there&rsquo;s another critical side to the cyber security coin: prevention.&nbsp; With shifts in our work lives and technology usage, new cyber risks have emerged. For example, a recent study found that 82% of IT leaders believe their company is at greater risk of phishing attacks when employees are working remotely.&nbsp; 1&nbsp;In addition, with many employees using personal devices for work, IT professionals are worried about security risks such as downloading unsafe apps, malware infections and software updates. 2 In this changing landscape, it&rsquo;s crucial for businesses of all sizes to take a proactive approach to cyber protection. Having the right safeguards in place can help prevent a range of cyber losses &mdash; from data breaches and theft of intellectual property, to financial losses stemming from social engineering, ransomware, and other attacks.&nbsp; Here&rsquo;s a look at key measures that can help protect your business from cyber losses: Employee training programs and simulations: Human error&mdash;meaning an unintentional action or lack of action that allows a cyber incident to take place&mdash;is behind nearly all successful data and security breaches. 3&nbsp; That&rsquo;s why employee training and education is so vital: it can help you avoid cyber incidents and strengthen your organization&rsquo;s overall cyber security culture.&nbsp; 4&nbsp; The Canadian Centre for Cyber Security recommends organizations consider education and training topics such as: creating unique passphrases and complex passwords for all accounts; using the internet and social media safely in the workplace; using approved software and mobile applications; and identifying malicious emails.&nbsp; 5 You can then put that training to the test with attack simulations. These allow you to see how employees would respond to different types of attacks, in real-world situations. For example, a phishing test sends employees a fake malicious email and/or a fake website to see if they&rsquo;ll open attachments and/or click on the links, or if they report the suspicious email. 6 Vulnerability scans and penetration tests: On the IT side, you can test your organization&rsquo;s defenses with vulnerability scans and penetration tests. Vulnerability scanners are automated tools that allow organizations to check if their networks, systems and applications have security weaknesses that could expose them to attacks.&nbsp; 7 Common vulnerabilities include substandard backup and recovery; weak authentication management; and poor network monitoring, among others.&nbsp; 8 Penetration testing, also known as a &ldquo;pen test&rdquo; or &ldquo;ethical hacking,&rdquo; goes beyond vulnerability scanning. Using a mix of automated tools and manual techniques, a penetration test identifies vulnerabilities and then attempts to exploit those vulnerabilities.&nbsp; 9 To illustrate the difference between vulnerability scans and penetration testing, a cyber security firm uses this analogy: A vulnerability is like walking up to a door, checking to see if it&rsquo;s unlocked, and stopping there. A penetration test not only sees if the door is unlocked, but also opens the door and walks right in. 10 Cyber security consultants:&nbsp;While cyber breach coaches help organizations deal with the aftermath of a cyber-attack, cyber security consultants are often hired to build the right defenses. These experts provide a range of services, including IT systems auditing, system monitoring, building firewalls and helping organizations stay compliant with government regulations.&nbsp; Cyber security consultants are typically involved with every employee contact point for company data, including devices, applications, data storage and internal networks. Knowing how staff interact digitally allows these experts to identify potential weaknesses and plan for how to protect against them. 11 As risks evolve, a proactive approach to cyber protection is crucial. When planning your defense strategy, it&rsquo;s important to consider insurance coverage that&rsquo;s specifically designed to address the unique and emerging risks to your business.&nbsp;
Sources
1,2&nbsp;Tessian,&nbsp; <a href="https://www.tessian.com/blog/hybrid-working-cybersecurity-risks/" target="_blank" rel="noreferrer noopener">&ldquo;How hybrid-remote working with affect cybersecurity,&rdquo;</a>&nbsp;Sept. 2020 3&nbsp;Hacker News, &ldquo; <a href="https://thehackernews.com/2021/02/why-human-error-is-1-cyber-security.html" target="_blank" rel="noreferrer noopener">Why human error is #1 cyber security threat to businesses in 2021</a>,&rdquo; Feb. 4 2021 4,5&nbsp;Canadian Centre for Cyber Security,&nbsp; <a href="https://cyber.gc.ca/en/provide-employee-awareness-training" target="_blank" rel="noreferrer noopener">&ldquo;Provide employee awareness training,</a>&rdquo; Feb. 16 2021 6&nbsp;Dashlane,&nbsp; <a href="https://blog.dashlane.com/phishing-test/" target="_blank" rel="noreferrer noopener">How to run an effective phishing test at work</a>, March 7 2020 7, 9&nbsp;Rhino Security Labs, &ldquo; <a href="https://rhinosecuritylabs.com/penetration-testing/need-vulnerability-scan-penetration-test/" target="_blank" rel="noreferrer noopener">Do I need a vulnerability scan or penetration test?</a>&rdquo; 8&nbsp;Logsign, &ldquo; <a href="https://www.logsign.com/blog/what-are-the-types-of-cyber-security-vulnerabilities/" target="_blank" rel="noreferrer noopener">What are the types of cyber security vulnerabilities</a>?&rdquo; 10&nbsp;Control Scan,&nbsp; <a href="https://www.controlscan.com/penetration-tests-vulnerability-scans-different/" target="_blank" rel="noreferrer noopener">&ldquo;Penetration tests vs. vulnerability scans: What&rsquo;s the difference?&rdquo;</a> 11&nbsp;EC-MSP, <a href="https://www.ecmsp.co.uk/it-blog/cybersecurity-consultant-for-business" target="_blank" rel="noreferrer noopener">&nbsp;&ldquo;What can a cyber security company do for your business?&rdquo;</a>

Cyber loss prevention: How to mitigate cyber risks to your business

Having a strong online presence is a necessity for any modern business. No matter what size you are or what industry you&rsquo;re in, having the capability to communicate with customers and carry out transactions online is now customers&rsquo; standard expectation. While most businesses are now savvy to the threats posed by a cyber breach or hack, many may not be aware of the new European privacy regulations introduced in May 2018 that are creating a whole new set of risks for companies that do business in the EU, either physically, or online.
<h3>What is the General Data Protection Regulation?</h3>
The General Data Protection Regulation (GDPR) is a set of data protection rules for all companies that either (a) have an "establishment" in the European Union (EU) and "process" "personal data" in the context of the activities of that establishment, or (b) have no establishment in the EU but they process the personal data of individuals that are in the EU and such processing relates to (1) offering goods or services to an individual in the EU or (2) monitoring the behaviour of individuals, where that behaviour occurs in the EU (all words and phrases in quotations are defined in the GDPR). The rules aim to give consumers more control over their personal data, reshape the way organizations approach data privacy and create a more level playing field for businesses. The GDPR has extra-jurisdictional effect and applies regardless of where a company is physically located. If your activities fall within (a) or (b) in the paragraph above, the GDPR applies to your company. In today&rsquo;s connected marketplace, GDPR has a very wide reach. GDPR requirements are, in many respects, more stringent and comprehensive than similar North American regulations, including the Personal Information Protection and Electronic Documents Act (Canada). The definition of personal data in the GDPR is broad, and the requirements around how to collect, use and disclose personal data in a compliant manner are, in general, more restrictive. For example, under the GDPR a notification regarding most personal data breaches must be sent to the appropriate supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of the breach. Further, in many cases, breach notifications must also be sent to affected individuals without undue delay.
<h3>What are the consequences of non-compliance?</h3>
Companies that fail to comply with the GDPR could face significant financial penalties of up to &euro;20 million or 4% of annual global turnover (whichever is greater) for the most serious infringements, such as violating the Privacy by Design concepts or having insufficient customer consent to process personal data. Less serious breaches of the GDPR, including not having records in order and not notifying the supervising authority and data subject about a breach, could lead to a fine of up to &acirc;&sbquo;&not;10 million or up to 2% of annual worldwide turnover (whichever is greater).
<figure class="wp-block-pullquote">
<blockquote>
Companies that fail to comply with the GDPR could face significant financial penalties, the insurability of which remains a bit of a grey area in most jurisdictions. Although a robust cyber insurance policy may cover a company&rsquo;s exposure to privacy breaches under GDPR, PIPEDA and other privacy legislation, criminal penalties are almost never insurable.
</blockquote>
</figure>
<h3>Can insurance provide protection for GDPR fines / penalties?</h3>
Companies that fail to comply with the GDPR could face significant financial penalties, the insurability of which remains a bit of a grey area in most jurisdictions. Although a robust cyber insurance policy may cover a company&rsquo;s exposure to privacy breaches under GDPR, PIPEDA and other privacy legislation, criminal penalties are almost never insurable. Getting a good understanding of your own GDPR related risks is an important first step. Reducing your risk of being fined can be achieved through GDPR compliance.
<h3>If GDPR applies to your company, here are some things to consider</h3>
What personal data are we collecting and where are we storing it?&nbsp;The first step for any company is to understand exactly what personal data it collects and uses, and where it physically stores that personal data, so that it can then develop a GDPR compliance program. Why are we collecting the personal data? &nbsp;Under GDPR, all companies are required to be able to explain how the personal data they collect will be used. Companies also need to be able to send that information to the individual if requested to do so. Do we have adequate consent to collect, use and disclose personal data?&nbsp; GDPR contains strict consent requirements regarding the collection, use and disclosure of any personal data. Companies should ensure that they&lsquo;re compliant with such consent requirements. What cyber risks do we face? &nbsp;&shy;&shy;In addition to the myriad of other consequences that will arise from a data breach, the GDPR contains strict notification requirements with respect to data breaches. This is just one more reason to proactively analyze your cyber weak spots and to take steps to mitigate any risks. What do we do if the worst case scenario does happen?&nbsp; Having a data breach response strategy in place is essential. Make sure your key team members know exactly what to do and who to call as soon as you&rsquo;re aware of the breach. Every minute counts. Compliance is crucial but can be challenging in the murky and often complex world of online business. Being insured adds another, much-needed, layer of security against data breaches, but as we&rsquo;ve noted above, privacy regulations are adding a whole new set of risk factors. So, when it comes to speaking to your insurance broker about renewing your cyber insurance policy, you may want to add &lsquo;GDPR risks&rsquo; to your list of questions.

Collecting personal data from EU residents

When a data breach happens, businesses have a lot to lose. IBM&rsquo;s global Cost of a Data Breach report found that in 2020, companies spent an average of US$3.86 million per breach. The costs include time and effort dealing with the breach, lost revenue due to system downtime, reputation losses, regulatory fines, and legal costs 1.&nbsp; While many companies work hard to ensure their data security is tight, cyber criminals are notorious for being one step ahead.&nbsp;That means it&rsquo;s vital to be prepared for &ldquo;when&rdquo; a data breach happens, not &ldquo;if.&rdquo; To manage data breaches, battle-ready businesses will want to put together a dedicated response team and implement their own plan of attack. Here are five steps to include in the plan:&nbsp;
<h3>Identify how the breach happened and what was leaked.</h3>
First, you need to determine how the attack took place and what data was affected, which can be done using root-cause analysis and forensics 2. Common causes of data breaches include stolen or weak passwords, application vulnerabilities, malware, employee error, and malicious internal acts. By identifying the root cause of the breach and investigating what was leaked, you&rsquo;ll be able to carry out the next steps more effectively 3,4.
<h3>Contain the breach.</h3>
Take steps to contain the breach in as short a time as possible to minimize further damage and risk. An effective course of action is: stopping the unauthorized practice; shutting the system down that was breached; changing passwords immediately; limiting access of individuals suspected of causing the breach; recovering the records; and correcting weaknesses in physical or electronic security 5,6.
<h3>Notify those affected.</h3>
Notify your customers, business partners, vendors, or other parties whose data was affected by the breach. Include the date of the breach; details on what was compromised; and what action, if any, the recipient needs to take 7. Not only do you need to notify individuals of any breach of the security of safeguards involving their personal information, but if the breach is believed to be of &ldquo;significant harm&rdquo;, your organization must also report the breach to the Privacy Commissioner of Canada 8. The Personal Information Protection and Electronic Documents Act (PIPEDA) defines &ldquo;significant harm&rdquo; to include bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record, and damage to or loss of property 9. Notification to impacted individuals and the Privacy Commissioner should take place as soon as possible when the organization determines a breach has occurred.
<h3>Conduct a security audit.</h3>
Managing a data breach doesn&rsquo;t stop once you&rsquo;ve patched things up. A smart next step is to conduct a data-security audit, which allows you to identify threats and vulnerabilities in your company&rsquo;s IT infrastructure and security systems. The steps in an audit generally include: establishing the scope of the audit; creating a master list of all the assets that require protection; defining threats to your data; assessing the risk of each threat; and creating a list of security measures you need to implement 9,12.
<h3>Prepare for future attacks.</h3>
If your company is attacked once, there&rsquo;s a strong possibility it will happen again, as cyber criminals are enticed to try again if they&rsquo;ve already succeeded 13.&nbsp; The vulnerabilities uncovered in your security audit will help you put the right data-security systems and procedures in place, whether it&rsquo;s performing better data backups, conducting cyber-security awareness training, or acquiring more appropriate security technology 14.&nbsp; As you firm up your data-security measures, consider your insurance coverage as a critical component in your plan. Some insurers even offer breach preparation and crisis management services. Contact your broker and ensure you&rsquo;re properly covered in the event of a data breach or other cyber-attack.&nbsp;
Sources
1 <a href="https://www.capita.com/sites/g/files/nginej146/files/2020-08/Ponemon-Global-Cost-of-Data-Breach-Study-2020.pdf" target="_blank" rel="noreferrer noopener">&ldquo;Cost of a Data Breach Report 2020,&rdquo;</a>&nbsp;IBM Security and Ponemon Institute, July 2020 2,3&nbsp;&ldquo; <a href="https://digitalguardian.com/blog/data-breach-experts-share-most-important-next-step-you-should-take-after-data-breach-2014-2015" target="_blank" rel="noreferrer noopener">Data breach experts share the most important next step you should take after a data breach in 2019 &amp; beyond,&rdquo;</a>&nbsp;Digital Guardian, Aug. 11, 2020 4 <a href="https://www.avertium.com/digging-in-why-root-cause-analysis-is-crucial-in-ir/" target="_blank" rel="noreferrer noopener">&ldquo;Digging in: Why root cause analysis is crucial in IR,&rdquo; Avertium,&rdquo;</a>&nbsp;July 17, 2020 5 <a href="https://techaeris.com/2020/12/15/data-breaches-why-and-how-to-handle-the-attack/" target="_blank" rel="noreferrer noopener">&ldquo;Data breaches: Why and how to handle the attack,&rdquo;&nbsp;</a>TechAeris, Dec. 15, 2020 6&nbsp;&ldquo; <a href="https://www.priv.gc.ca/en/privacy-topics/business-privacy/safeguards-and-breaches/privacy-breaches/respond-to-a-privacy-breach-at-your-business/c-t_201809_pb/" target="_blank" rel="noreferrer noopener">Preventing and responding to a privacy breach,&rdquo;</a>&nbsp;Office of the Privacy Commissioner of Canada, Sept. 2018&nbsp;&nbsp; 7 <a href="https://securitytrails.com/blog/top-5-ways-handle-data-breach" target="_blank" rel="noreferrer noopener">&ldquo;Top 5 ways to handle a data breach,&rdquo;</a>&nbsp;SecurityTrails, Nov. 27, 2018 8,9&nbsp; Office of the Privacy Commissioner of Canada. (2018, October 29).&nbsp; <a href="https://www.priv.gc.ca/en/privacy-topics/business-privacy/safeguards-and-breaches/privacy-breaches/respond-to-a-privacy-breach-at-your-business/gd_pb_201810/" target="_blank" rel="noreferrer noopener">What you need to know about mandatory reporting of breaches of security safeguards</a>. Retrieved February 05, 2021, 10&nbsp; <a href="https://digitalguardian.com/blog/data-breach-experts-share-most-important-next-step-you-should-take-after-data-breach-2014-2015" target="_blank" rel="noreferrer noopener">&ldquo;Data breach experts share the most important next step you should take after a data breach in 2019 &amp; beyond,&rdquo;</a>&nbsp;Digital Guardian, Aug. 11, 2020 11,12 <a href="https://www.priv.gc.ca/en/privacy-topics/business-privacy/safeguards-and-breaches/privacy-breaches/respond-to-a-privacy-breach-at-your-business/gd_pb_201810/" target="_blank" rel="noreferrer noopener">&ldquo;What you need to know about mandatory reporting of breaches of security safeguards,&rdquo;</a>&nbsp;Office of the Privacy Commissioner of Canada,&nbsp; Oct. 2018&nbsp; 13 <a href="https://www.smartdatacollective.com/4-easy-steps-conduct-security-audit-company/" target="_blank" rel="noreferrer noopener">&ldquo;4 easy steps how to conduct IT security audit of your own company,&rdquo;</a>&nbsp;SmartDataCollective, May 22, 2017&nbsp; 14 <a href="https://www.computerworld.com/article/3535590/avoid-security-breaches-how-to-protect-your-data.html" target="_blank" rel="noreferrer noopener">&ldquo;Avoid security breaches: How to protect your data,&rdquo;</a>&nbsp;Computer World, April 1, 2020&nbsp;

5 steps to manage a data breach

In today&rsquo;s ever evolving cyber age, data has become one of the most valuable assets of every business. Cyber protection is essential for your business, but it&rsquo;s equally critical to reduce your cyber exposures and build resiliency to prevent, or at least minimize, a cyber-attack in the first place.
What are the implications for your business if it were to suffer a data breach? Could your business recover?
Here are four key take-aways that any business can use to help them manage their cyber exposures.
<h3>1. Inform and educate</h3>
Education is key, and it&rsquo;s not only an IT responsibility and risk. It&rsquo;s everyone&rsquo;s responsibility.
Employee cyber security training is essential. In a corporate setting, human error is the weakest link in the security chain. Employers need to educate employees of impending risks and vulnerabilities and how to avoid them.
Cyber security should be a pillar of the corporate culture and this can be achieved in a number of ways:
<ul>
<li>Conduct regular sessions with your employees where you can discuss real world examples of security incidents and make it relevant to what people do</li>
<li>Incorporate cyber security best practices into the discussion and protocols when you&rsquo;re onboarding new employees</li>
<li>Train individuals on the actions they should take if they suspect a security threat, and don&rsquo;t forget to periodically test individuals to affirm that they truly understand what they should be looking out for &nbsp;&nbsp;&nbsp;</li>
</ul>
<h3>2. Mitigate cyber risks</h3>
Here are some mitigation strategies that businesses can use to protect their data:
<ul>
<li>Encrypt data: Encryption can be an effective cyber-crime prevention strategy, rendering data difficult to access if it falls into the wrong hands.</li>
<li>Back up data and store it separately: Backing up data and storing it separately strengthens your resiliency in the face of ransomware attacks, where attackers lock companies out of their own systems.</li>
<li>Use strong passwords: Using unique and complex passwords, changing them often and discourage password sharing</li>
<li>Restrict network administration rights: Employees can&rsquo;t mistakenly give away information they don&rsquo;t have access to. Use robust anti-malware and firewall software. While effective Restrict network administration rights: Employees can&rsquo;t mistakenly give away information they don&rsquo;t have access to. Use robust anti-malware and firewall software. While effective anti-malware tools catch and isolate software viruses when they hit, preventing these viruses from entering your database in the first place is most important.</li>
</ul>
<h3>3. Make a plan</h3>
If you collect or store data in the course of commercial activity, you as a custodian are responsible.
On November 1, 2018, important changes to the Personal Information Protection and Electronic Documents Act (PIPEDA) came into force . Both large and small businesses that are subject to PIPEDA must report material personal information breaches to the Privacy Commissioner and the individuals concerned, and keep records of all breaches. &ldquo;If you collect or store data in the course of commercial activity, you as a custodian are responsible&rdquo; said Julie.
Therefore, it&rsquo;s important for businesses to develop incident response plans and put procedures in place to minimize, contain, and recover from a data breach. Incident response plans act as a roadmap to be followed by response teams when a data breach is discovered. Effective plans require the organization to understand the quantity of sensitive data that&rsquo;s being stored, the type of data (personal data, customer data, intellectual property etc.), how it&rsquo;s being secured, and who has access to the information.
In the face of a breach, there are two things your company can do to inform how best to respond:
<ul>
<li>Identify a data forensics team: Independent forensic investigators can help determine the source and scope of the breach.</li>
<li>Consult legal counsel: They can advise on your responsibilities under applicable provincial and federal privacy laws.</li>
</ul>
<h3>4. Lean on experts</h3>
Some insurance policies include breach preparation and crisis management services and resources. These services can include:
<ul>
<li>Counseling</li>
<li>Crisis management</li>
<li>Notification assistance</li>
<li>Breach victim remediation planning</li>
<li>Media relations consulting</li>
<li>Regulatory communication</li>
<li>Personalized access to a breach preparedness website</li>
</ul>
Having the right type of expert to help you navigate the complexities and nuances of data security can make all the difference when you&rsquo;re preparing for or facing a breach.
To be resilient is to be informed, proactive, and supported. Talk to your insurance broker to ensure you&rsquo;re getting access to the resources and expertise you need to be just that.

4 ways to enable resilience in the cyber age

Cranes are workhorses on large-scale construction projects, providing the efficient and effective movement of heavy construction materials throughout the site. While safety is the number-one priority for crane operators, accidents and near misses do unfortunately happen, and often with serious consequences. Human error continues to be a major cause of crane accidents&mdash; with estimates as high as 90%&nbsp; 1&nbsp;&mdash;therefore, they can be considered preventable. The best way to mitigate accidents is a strong commitment to safety across all aspects of a construction project. The following are important safety tips and best practices to help ensure the safe operation of tower and mobile cranes and keep construction projects running smoothly.
<h3>Tower Cranes</h3>
Tower cranes are fixed and commonly used in high-rise building construction. They are designed, tested, and manufactured to lift and move heavy loads safely. When used properly, they are safe, reliable, and can lift heavy loads to great heights.&nbsp; It&rsquo;s critical for a construction project to operate their tower crane safely by observing safe operating practices including its initial installation. In Canada, the code for tower cranes is CSA Z248-17 2&nbsp;. Construction project managers and operators should familiarize themselves with the code, as well as applicable codes in their province and jurisdiction, and it&rsquo;s recommended they adopt the more stringent requirements. It&rsquo;s also important that project managers adhere to the tower crane manufacturer&rsquo;s specifications and requirements, along with the oversight and signoff from a professional engineer where applicable.&nbsp; The safe operations of tower cranes include (but are not limited to) the following practices:
<ul>
<li>Ensure&nbsp; operators are knowledgeable&nbsp;of the crane&rsquo;s construction and relevant safety codes and standards, including maintenance needs for the equipment.</li>
<li>Complete&nbsp; inspection, testing, and maintenance&nbsp;as required &ndash; daily, weekly, and annually &ndash; in accordance with the manufacturer&rsquo;s recommendations and the requirements of the jurisdiction.</li>
<li>Provide the&nbsp; load rating chart&nbsp;with each tower crane and attach it in a location visible to the operator while seated at the controls and at remote control stations. The operator should be familiar with load limitations.</li>
<li>Consider&nbsp; weather conditions, including temperature (greater than -20 oC,) wind (less than 50 km/h,) electrical storms, snow and ice, and visibility.</li>
<li>Isolate and de-energize&nbsp; overhead power lines&nbsp;when possible. If not possible, a minimum clearance of three metres should be maintained between the crane, or the load being handled, and the energized power lines. It&rsquo;s recommended that the stricter jurisdictional authority be observed.</li>
<li>Follow&nbsp; load management&nbsp;guidelines closely. It&rsquo;s important that loads to be lifted weigh within the rated capacity of the crane and are properly rigged by a competent person to prevent any dislodgement. Prior to unhooking, the load should have safely landed and blocked. Whenever possible, don&rsquo;t leave loads suspended and arrange to prevent them from passing over workers.</li>
<li>Assign a&nbsp; designated qualified signaller&nbsp;to work with the crane operator when signals are required to control hoisting operations. Except for a &lsquo;stop&rsquo; signal, the tower crane operator should only take direction from the designated signaller.</li>
</ul>
<h3>Mobile Cranes 3</h3>
Mobile cranes can be mounted on a crawler, or a truck type carrier that is primarily hydraulically powered with a telescoping boom. The main benefit of a mobile crane as opposed to a tower crane is exactly that: it&rsquo;s mobile. It can be moved around the job site itself, or to other job sites easily. However, there are significant lifting height limitations to the mobile crane as it&rsquo;s limited to how far the boom can be extended. The safe operations of a mobile crane are similar to a tower crane, but there are some significant differences. Safe operating practices of mobile cranes include, but are not limited to, the following:&nbsp;
<ul>
<li>Avoid or remove &nbsp;obstructions&nbsp;to allow the movement of the load. As mentioned above, avoid passing loads over workers, pedestrians, and roadways. Obstructions such as energized power lines are a major cause of mobile crane accidents &mdash; nearly 45% of the cases according to the Occupational Safety and Health Administration 4.&nbsp;</li>
<li>Ensure&nbsp; ground conditions&nbsp;have enough stability and bearing capacity to support all loads placed on it by the crane. Special considerations need to be made when a mobile crane is located beside buildings under construction with possible uncompacted backfill, along trenches, or areas where water mains, sewer pipes, etc., are buried.&nbsp;</li>
<li>Be mindful that &nbsp;leveling can significantly affect the load rating capacity. The load rating charts are based on the crane being perfectly level in all directions. A crane that is three degrees out of level may need to reduce the rated capacity by as much as 50% 5&nbsp;.&nbsp;</li>
</ul>
While job sites will always have hazards, it&rsquo;s vital to keep the potential dangers of crane operations at bay. By following relevant safety codes and industry best practices, construction project managers and operators will be doing their part to ensure employee safety, peace of mind, and a successful construction project.&nbsp;
Sources
1 <a rel="" noreferrer="" noopener="" https:="" ilt="" safetynow="" com="" crane-safety-stats-and-facts="" target="" _blank="">Crane Safety &ndash; Stats and Facts</a>. SafetyNow ILT. (n.d.). 2 <a rel="" noreferrer="" noopener="" https:="" www="" techstreet="" com="" standards="" csa-z248-17="" product_id="2002137&quot;&quot;" target="" _blank=""></a><a href="https://store.accuristech.com/standards/csa-z248-17?product_id=2002137" title="" target="_blank" rel="noopener" aria-invalid="true">CSA Z248-17</a>. (2017, December 1). CSA Z248-17 - Techstreet 3 <a rel="" noreferrer="" noopener="" https:="" www="" jespear="" com="" factors-affecting-mobile-crane-safety="" target="" _blank="">&nbsp;</a><a href="https://jespear.com/factors-affecting-mobile-crane-safety/" title="" target="_blank" rel="noopener">Mobile Crane Safety: Factors Affecting Rated Capacity</a>. (2018, November 15). JE Spear Consulting, LP | Environmental Consulting Services.&nbsp; 4, 5 <a rel="" noreferrer="" noopener="" https:="" www="" graphicproducts="" com="" articles="" crane-accidents="" target="" _blank=""></a><a href="https://resources.duralabel.com/articles/crane-accidents" title="" target="_blank" rel="noopener">Crane Accidents</a>. Graphic Products. (n.d.).

Ways to ensure tower and mobile crane safety

Construction projects have a lot of moving parts, and unexpected challenges are a given. Unfortunately, equipment losses from theft, fire, and transportation and operations are common challenges &mdash;and costly ones. While there is no sure-fire way to guard against equipment loss and damage, construction business owners and contractors can take action to prevent and mitigate risks.&nbsp;
<h3>Theft</h3>
Construction equipment is an attractive target to criminals, who can make huge profits selling stolen machines and tools. Job sites can be especially vulnerable to theft and vandalism if they&rsquo;re at a remote location or lack the proper security measures.&nbsp;
Mitigating losses starts with administrative controls. Management must be committed to theft prevention and communicate a &ldquo;zero tolerance&rdquo; philosophy, so employees take their efforts seriously. Implementing theft prevention policies and unannounced site inspections can help control losses, particularly from &ldquo;inside jobs&rdquo;, which unfortunately do happen from time to time.
On site, there are a wide range of security measures that can be implemented. Premises security can include fencing and gates to minimize access points, lighting, and motion-sensitive video cameras and alarms that are actively monitored.&nbsp;
Prevention measures can also be taken with the equipment itself. For example, beyond antitheft marking and tracking devices, small and medium-sized equipment can be protected by using &ldquo;smart&rdquo; keys, locking wheels and trailer hitches. For larger equipment, hidden kill switches, fuel shutoffs, track locks and alarm systems can be installed.
<h3>Fire</h3>
Vehicles such as dump trucks and bulldozers have complex mechanical systems and operate under intense conditions, resulting in an above average fire risk. Similarly, off-road vehicles accumulate debris on the frame and under the chassis, creating a greater risk of ignition as they use combustible liquids such as fuel, oil, grease, and hydraulic fluid. 1&nbsp;It&rsquo;s likely some or all of these vehicles will find themselves at your construction site, so fire risks and prevention should be top of mind. Fire prevention starts with identifying where fires are most likely to occur, delivering ongoing training, and communicating the plan to everyone on the work site. 3 Minimizing the risk of fire involves conducting regular inspections and maintenance to your equipment&rsquo;s high-risk areas, such as the electrical system, engine blocks, turbochargers, and braking systems. It&rsquo;s also important not to overlook the basics, such as routine cleaning of debris. 3 In order to fuel your equipment safely, one solution is to engage an outside vendor to provide fuel services. If that&rsquo;s not possible, some considerations for contractors include:
<ul>
<li>locating the onsite fuel supply away from ignition sources</li>
<li>grounding and bonding procedures when handling and dispensing fuel&nbsp;</li>
<li>establishing procedures for immediate cleanup of fuel spills</li>
</ul>
In addition, training all employees in the use of fire extinguishers, which must be available on each piece of equipment, is a must. 4
<h3>Transportation &amp; Operations</h3>
Construction equipment can be damaged not only when it&rsquo;s in operation, but also while being transported between jobs and storage sites. Whether in operation or transport, employees should be thoroughly trained on company policies, safety rules and emergency procedures. 5 While there are plenty of hauling companies with the right equipment and expertise for successful transport, construction business owners should keep a few key considerations top of mind in order to transport heavy equipment safely:&nbsp;
<ul>
<li>check the owner&rsquo;s manual for specific instructions on how it should be transported</li>
<li>map the most linear route ahead of time, keeping an eye out for road widths, overhead passes and bridges</li>
<li>immobilize equipment wheel components</li>
<li>outfit vehicles with proper banners, signs and lights. 6</li>
</ul>
On the equipment operations side, preventing damage from overturns starts with hiring drivers with a high level of knowledge, skill and experience. In addition, there are specific operating procedures that should be observed, such as load considerations; the environment, including soil conditions and ground irregularities; clearances, including keeping loads low when overhead obstructions are present; and slopes, including avoiding side hill travel. 6 While there are no guarantees in any construction project, implementing controls can reduce the likelihood of equipment losses. In addition, construction business owners and contractors should ensure there are no gaps in their insurance coverage, so they can protect their business and keep their construction projects running smoothing.&nbsp;
Sources
1&nbsp;&ldquo;<a href="https://www.acppubs.com/articles/5971-best-practices-for-protecting-construction-equipment-from-fire-damage" title="" target="_blank" rel="noopener"> </a><a https:="" www="" acppubs="" com="" articles="" 5971-best-practices-for-protecting-construction-equipment-from-fire-damage="" target="" _blank="" rel="" noreferrer="" noopener="">Best practices for construction equipment from fire damage</a><a https:="" www="" acppubs="" com="" articles="" 5971-best-practices-for-protecting-construction-equipment-from-fire-damage="" target="" _blank="" rel="" noreferrer="" noopener="">,</a>&rdquo; California Builder and Engineer,&rdquo; Jan. 25 2018.&nbsp; 2&nbsp;&ldquo; <a https:="" www="" surrey="" ca="" sites="" default="" files="" media="" documents="" cwcconstructionfiresafetymanual="" pdf="" target="" _blank="" rel="" noreferrer="" noopener=""></a><a href="https://www.surrey.ca/sites/default/files/media/documents/CWCConstructionFireSafetyManual.pdf" title="" target="_blank" rel="noopener">Construction site fire safety: A guide for construction of large buildings</a>,&rdquo; Canadian Wood Council and University of the Fraser Valley, April 2015 3,4,6&nbsp;Contactors&rsquo; Equipment Guide to Loss Prevention, Inland Marine Underwriters Association, 1998.&nbsp; 5&nbsp;&ldquo; <a https:="" www="" equipmentjournal="" com="" on-the-job="" transporting-heavy-equipment="" target="" _blank="" rel="" noreferrer="" noopener=""></a><a href="https://www.equipmentjournal.com/on-the-job/transporting-heavy-equipment/" title="" target="_blank" rel="noopener">A how-to for transporting equipment</a>,&rdquo; Equipment Journal, Jan. 19, 2019&nbsp; and &ldquo; <a https:="" thompsontractor="" com="" about="" resources-="" 1="" safe-heavy-load-transport="" target="" _blank="" rel="" noreferrer="" noopener=""></a><a href="https://thompsontractor.com/about/resources-(1)/safe-heavy-load-transport" title="" target="_blank" rel="noopener">How to safely load and transport equipment,&rdquo; Thompson Tractor Co</a>.