BESIDES THE health and economic devastation that the COVID-19 pandemic has left in its wake, it has also caused supply chain disruptions that have affected a number of industries.

The fallout for companies of all types illustrates the fragility of most businesses’ supply chains. The pandemic has left retailers with half-empty shelf space because product manufacturers couldn’t keep operations going due to raw material or personnel shortages, while a number of carmakers and other manufacturers have had to suspend operations because of a global semiconductor shortage.

But it’s not only large companies that suffer, and small businesses are especially vulnerable. That’s why it’s important that you have in place a solid plan for averting and dealing with disruptions to your supply chain if you rely on materials and inputs from outside vendors.

Here’s what you can do to manage this growing risk.

Understand your supply chain

Start by identifying risks in your supply chain and develop ways to mitigate them.

FOUR MAIN EXTERNAL SUPPLY CHAIN RISKS

• Flow interruptions – Problems with the movement of goods and materials.
• Environmental risks – Economic, social, political, terrorism threat and weather-related factors that affect facilities and infrastructure. The pandemic falls into this category.
• Business risks – Problems caused by factors like a supplier’s poor financial or general stability, or the purchase or sale of supplier companies by other entities.
• Physical plant risks – Problems at a supplier’s facility. For example, a key supplier could have a machinery breakdown and/or regulators may shut the facility down.

 

Develop a plan

The best way to manage a supply chain disruption is to prepare for it. Start by undertaking a business impact analysis to prepare your company.

Form a team of key personnel to:

• Identify alternatives to key suppliers. One option is to contract with an alternative vendor in advance, so you can certify them and ensure they can ramp up if you lose a critical supplier.
• Model the impact of disruptions on your production and inventory for the four supply chain risks listed to the left. Think about how non-delivery of a key item
  would affect your operations.

Using that information, you can build contingencies for supply chain failures:

• Plan for how you would respond to all “what if” scenarios that could affect your operations. Be realistic about assessing your capacity to respond to these scenarios.
• Create a contingency plan for failure of any supply chain pillars. Identify the points at which you would need to execute risk-mitigating measures, like sourcing from other vendors or using new distribution channels.
• In advance, amass a contingency management team that will bridge the divide between your departments during disruptions. This team must include senior
  staff who are influential with top company decision-makers.
• Make sure your supply chain is flexible enough to deal with risks. Look at opportunities to address current supply chain bottlenecks; investigate alternative transportation network configurations or production systems.

 

The final backstop: insurance

You can address supply chain risks with business interruption insurance or contingent business interruption insurance.

Business interruption insurance.
This coverage, which is often included in a commercial property policy, covers lost profits after a company’s own facility is damaged by an insured peril.

Contingent business interruption insurance. This is often a policy rider that you can purchase. It covers lost profits if an insured peril shuts down a critical supplier, part of the transportation or distribution chain, or a major customer.

This coverage is triggered if there is:
1. Damage to property that prevents one of your suppliers from making products or delivering them.
2. Damage to property that prevents your customers from receiving your products.

CYBER INSURANCE rates are going to increase dramatically in 2021, driven by more frequent and more severe insured losses, according to a recent industry study.

The report by global insurance firm Aon plc predicted that rates would jump by 20% to 50% this year due to two main factors:

 

1. Cyber attacks are becoming more frequent

While publicly disclosed data breach/privacy incidents are actually occurring less often, ransomware attacks are exploding in frequency.

Ransomware incident rates rose 486% from the first quarter of 2018 to the fourth quarter of 2020. The comparable rate for data breach incidents fell 57% during the same period. The incident rates for the two types of events combined rose 300% over the trailing two years.

 

2. The costs of these attacks are growing

The average dollar loss increased in every quarter of 2020. Ransomware attacks were particularly severe – many of them resulted in eight-figure losses. Others may grow to that level as business interruption losses are adjusted and lawsuits against insured organizations proceed.

The combination of more frequent and more costly losses is a
recipe for higher rates.

Cyber insurance rates continued increasing in 2020, with rises of between 6% and 16% in the last four months of the year. In January 2021, most of the top 12 cyber insurance companies told Aon they were planning more drastic rate hikes. Nearly 60% reported that they would be seeking rate increases of 30% or more during the second quarter. None of them expected increases less than 10%.

 

New underwriting criteria

When insurers evaluate cyber insurance applicants, they will be particularly concerned with the organization’s overall cyber risk profile, its cyber governance and access control practices, and its network and data security. Prior loss history will be less important because the frequency of attacks is growing so quickly.

Some insurers may also cap how much they will pay for ransomware losses, or even exclude them entirely. They may also increase the waiting periods before coverage begins to apply.

 

WHAT BUSINESSES CAN DO

To improve your chances of getting more favorable pricing and coverage, the report recommends that you focus on:

• Reducing the risk of cyber losses.
• Measures to keep data private.
• Building an internal culture of cybersecurity.
• Preparing for ransomware attacks and disaster recovery planning.
• How your contracts and insurance will respond to a supply chain security breach.
• Understanding primary and excess coverage terms and
  communicating primary terms to excess insurers.

THE $2 TRILLION Coronavirus Aid, Relief, and Economic Security (CARES) Act stimulus law has a number of provisions that employers and their workers need to know about and can take advantage of during this crisis.

The CARES Act aims to help workers and employers weather the outbreak by:
• Extending unemployment benefits.
• Requiring health plans to cover COVID-19-related costs.
• Providing Small Business Administration (SBA) emergency loans.
• Providing emergency loans for mid-sized and large companies.

Parts of the CARES Act will likely benefit your organization and employees in some way. Here’s what you need to know:

Extended unemployment

The CARES Act extends unemployment insurance benefits to workers, as long as they lost their jobs due to the outbreak.
Unemployment benefits under the CARES Act also apply to furloughed employees.
Workers in California will be able to collect both state unemployment and federal unemployment through the new law.
Under existing state law, workers who have lost their jobs can already receive regular unemployment benefits of between $40 and $450 per week, depending on their highest-earning quarter in a 12-month period beginning and ending before they apply for benefits with the state Employment Development Department. These benefits can last for up to 26 weeks.
The Pandemic Emergency Compensation program funded by the new law will provide an additional $600 per week on top of state unemployment benefits, through July 31.
The law extends state-level unemployment by an additional 13 weeks. For example, whereas most of California’s unemployment benefits last 26 weeks, the bill extends state benefits to 39 weeks.
The extended benefits will last through Dec. 31.

Health plan changes

Under the CARES Act, employer-sponsored group health plans must provide for covered workers – without cost-sharing or out-of-pocket expenses – the cost of COVID-19 testing, treatment and vaccinations when and if they become available.

SBA loans

In response to the Coronavirus (COVID-19) pandemic, small business owners are eligible to apply for an Economic Injury Disaster Loan advance of up to $10,000.
This advance will provide economic relief to businesses that are currently experiencing a temporary loss of revenue. Funds will be made available following a successful application. This loan advance will not have to be repaid.
This program is for any small business with fewer than 500 employees (including sole proprietorships, independent contractors and self-employed persons) as well as private non-profit organizations affected by COVID-19. You can find more information here.

And the law’s Paycheck Protection Program offers 1% interest loans to businesses with fewer than 500 workers. Borrowers who don’t lay off workers in the next eight weeks will have their loans forgiven, along with the interest. These loans are designed to provide a direct incentive for small businesses to keep their workers on the payroll. If small businesses maintain payroll through this economic crisis, some of the borrowed money via the PPP can be forgiven – the funds will be available through June 30. Act fast.

Mid-sized employers

Under the new law, the Secretary of the Treasury is authorized to implement financial assistance programs that specifically target mid-size employers with between 500 and 10,000 employees.
Loans would not have an annualized interest rate higher than 2% and principal and interest would not be due and payable for at least six months after the loan is made. But unlike loans under the PPP, these are not forgivable.

AS IF BUSINESSES didn’t have enough to worry about, online scammers have started sending out malicious e-mails to organizations about coronavirus that appear to be from business partners or public institutions. The criminals send these to rank and file employees in the hope that at least one of them will click on a link or attachment in the e-mail, which unleashes malware or tries to trick them into wiring money for supplies purportedly to protect the organization’s workers.

The number of malicious e-mails mentioning the coronavirus has increased significantly since the end of January, according to cybersecurity firm Proofpoint Inc. The company noted that this wasn’t the first time they had seen such widespread cyber attacks associated with some type of disaster. But because this is global in nature, it decided to track the new threat. This practice of launching cyber attacks that are centered around global news and outbreaks (like the current COVID-19 coronavirus) isn’t anything new. Cybercriminals have long employed these tactics to take advantage of users’ desires to keep as up to date with any new information as possible or to evoke powerful emotions (like fear) in the hope that their sentiments will get the better of them and they will not pause to check for the legitimacy of these e-mails.

The cybercriminals are using the public’s ignorance about coronavirus, as well as the conflicting claims of how to protect against it, to lure people into clicking on their malicious links or get them to wire money. Because people are afraid, their guards may be down and they may not be as careful about identifying the e-mail as dangerous.

Some real-life examples

• Japanese workers were targeted in January and February with e-mails that looked like they came from local hospitals. The messages even included legitimate contact information for key personnel. The e-mails were focused on employees of various companies and came in a message that would look like it’s a reply to something or a warning that people are getting from the government. But when they clicked, it was malware. E-mails were sent to companies in the transportation sector that looked like they came from an employee of the World Health Organization.
They included the WHO logo and instructions about how to monitor crews aboard ships for coronavirus symptoms, and they included an attachment with instructions. This phishing e-mail attack was
intended to lure individuals into providing sensitive data, such as personally identifiable information and passwords.
• Companies in the US and Australia have been receiving malicious e-mails that use a display name of “Dr. Li Wei” and are titled “CORONA-VIRUS AFFECTED COMPANY STAFF.”

What you can do

All that it takes to break into your business is a cleverly worded e-mail message. If scammers can trick one person in your company into clicking on a malicious link, they can gain access
to your data. It’s important to train your staff to identify suspicious e-mails. They should avoid clicking links in e-mails that:
• Are not addressed to them by name, have poor English, or omit personal details that a legitimate sender would include.
• Are from businesses they are not expecting to hear from.
• Ask you to download any files.
• Take you to a landing page or website that does not have the legitimate URL of the company the e-mail is purporting to be sent from.
• Include attachments purportedly with advice for what to do. Do not open them even if they come from relatives or friends.

IF YOU are operating a small business, you are likely relying on a small staff to get the job done. Many employees in small firms have to wear many hats and if one of them or an owner should die, the business could suffer greatly from that sudden loss of talent. If you don’t have “key man” insurance, that setback could be devastating to the viability of your operations, whereas coverage would provide you with extra funding that you would need while recovering from the loss. Keyman insurance is life insurance on a key person or persons in a business. In a small business, this is usually the owner, a founder or perhaps a few vital employees. These are the people who are crucial to a business – the ones whose absence would sink the company. You need key man insurance on those people.

Key man insurance basics

Before buying coverage, give some thought to the effects on your company of possibly losing certain partners or employees. In opting for this type of coverage, your company would take out life insurance on the key individuals, pay the premiums and designate itself as the beneficiary of the policy. If that person unexpectedly dies, your company receives the claim payout. This payout would essentially allow your business to stay afloat as you recover from the sudden loss of that employee or partner, without whom it would be difficult to keep the business operating in the short term.

Your company can use the insurance proceeds for expenses until it can find a replacement person, or, if necessary, pay off debts, distribute money to investors, pay severance to employees and close the business down in an orderly manner. In other words, in the aftermath of this tragedy, the insurance would give you more options than immediate bankruptcy.

Determining whom to cover

Ask yourself: Who is irreplaceable in the short term? In many small businesses, it is the founder who holds the company together – he or she may keep the books, manage the employees, handle the key customers, and so on. If that person is gone, the business pretty much stops.

Determining amount of coverage

• The amount of coverage depends on your business and revenue.
• Think of how much money your business would need to survive until it could replace the key person, come up to speed and get the business back on its feet.
• Buy a policy that fits into your budget and will address your short-term cash needs in case of tragedy.
• Ask us to get some quotes from different insurers. • Check rates for different levels of coverage ($100,000, $500,000, etc.)

Small and mid-sized businesses are increasingly bearing the burden of cyber threats, as criminals are betting they do not have the resources in place to mount a strong defense. A severe attack on a small company can incapacitate its ability to do business, and the expenses of getting operations back on track – coupled with loss of goodwill – can easily force a firm into bankruptcy.
Unfortunately, with more data breaches hitting the news, one of the main concerns that executives have is if their insurance will cover the costs of recovering from an attack.

If you are running a small or mid-sized company, do not underestimate the growing threat to your business. Your chief priorities should be protecting against the threat and having proper insurance coverage in place.

TOP REASONS FOR CYBER LOSSES

• Malicious breaches resulting in data losses: 52%
• Unintentional data disclosure by staff: 16%
• Physical loss or theft of data: 13%
• Network or website disruptions: 5%
• Phishing, spoofing and social engineering: 5%
• Other: 9%
Source: Advisen and Nationwide Insurance Co.

Insurance concerns

One of the chief concerns for executives is any overlap or gaps between their property, liability, crime and cyber policies when it comes to covering the costs of recovering from an attack, according to a report by insurance news website Advisen and Nationwide Insurance. Some companies feel they don’t need cyber coverage because they believe their property and liability policies will cover any related losses.

EXECUTIVES’ INSURANCE WORRIES

• 95% of respondents named data breach as the number-one risk they expect to be covered by a cyber insurance policy.
• 94.5% said they expect cyber-related business interruption to be covered by a cyber policy.
• 89% said they expect their cyber policy to cover ransom demands.
• 36% said they have cyber-related property damage/bodily injury coverage under another policy, reflecting the belief that some coverage for cyber-related losses can be found under traditional policies.
• 60% of respondents said they are concerned about perceived gaps and overlaps in their insurance coverage.
• 53% of respondents said coverage for funds-transfer losses should be found under the crime policy, but also stated they would like to be able to recover under both crime and cyber policies – or have separate policies with higher limits.

The takeaway

Since cyber insurance is a new and evolving product, all policies do not cover the same thing. That’s why it’s important to weigh your choices carefully and consult with us. While the cyber threat grows, more insurers are changing language in their property and liability policies to limit coverage of cyber events. Because of the high costs associated with a data loss, more
executives want to see higher limits for business interruption coverage on their cyber stand-alone policies.

This market demand may drive insurers to refine their cyber insurance policies, including increasing cyber-related business interruption limits, according to the Advisen report. To find the best coverage for your business, please talk to us. We can help you evaluate your risks and coverages and identify any gaps by looking at your existing policies.