Travelers Insurance Company of Canada	CyberRisk Application

The information requested in this Application is for a Claims-Made policy. If issued, the policy will apply only to claims first made during the policy period or any applicable extended reporting period. The limit of liability available to pay losses will be reduced and may be exhausted by amounts paid as defense expenses. The retention will apply to defense expenses.

IMPORTANT INSTRUCTIONS: Under this CyberRisk Coverage, affiliates, other than Subsidiaries as defined in this coverage, are not covered unless the Insurer has agreed specifically to schedule such entities by endorsement..

GENERAL RISK INFORMATION

“Applicant” means all entities, including subsidiaries, for which coverage is requested. Name of Applicant:
Address:
Web Address(es):	Description of Operations:	NAICS Code	Year Established
Total Annual Revenues: $	Total Assets: $	Total Number of Employees:
Entity Type (select all that apply): Private Non-Profit Financial Institution Publicly Traded Public Entity Franchisor Franchisee
1. In the next 12 months is the Applicant contemplating, or during the past 24 months has the Applicant completed or been in the process of completing, the following: a. Any actual or proposed merger, acquisition, or divestiture? Yes No b. Any reorganization or arrangement with creditors under federal, provincial, territorial, or state law? Yes No If any part of Question 1. is answered “Yes”, attach an explanation, including the timing, the essential terms of the event, the arrangement, the impact on employee base, and the surrounding circumstances.

2.	List and describe any Subsidiaries or affiliated companies for which coverage is requested, and attach an organization chart.
(Check here if not applicable: )
Name	Percentage Owned	Year Started	Country	Description of Operations	Entity Type*
%
%
%
*FP = For-Profit (other than Partnership); NP = Non-Profit; GP = General Partnership; LP = Limited Partnership; LLC = Limited Liability Company

UNDERWRITING INFORMATION

DATA INVENTORY

1.	Indicate whether the Applicant or a third party on the Applicant’s behalf, collects, receives, processes, transmits, or maintains the following types of data as part of its business activities:
Credit/Debit Card Data	Yes No
If “Yes”:
(1) Is the Applicant currently compliant with Payment Card Industry Data Security Standards (PCI-DSS)?	Yes No
(2) How many credit card transactions are processed or accepted for payment in a typical year?
(3) What is the Applicant’s reporting level?	1	2	3	4
(4) Was the Applicant’s last PCI assessment conducted within the past 12 months?	Yes No
Medical information, other than that of the Applicant’s own employees	Yes No
Non-employee Social Insurance Numbers	Yes No
Employee/HR Information	Yes No
2.	What is the approximate number of unique individuals for whom the Applicant, or a third party on the Applicant’s behalf, collects, stores, or processes any amount of personal information as outlined in Question 1?
fewer than 100,000	100,000 – 250,000	250,001 – 500,000	500,001 – 1,000,000
1,000,001 – 2,500,000	2,500,001 – 5,000,000	> 5,000,000
3.	Indicate whether the data indicated in Question 1 is encrypted:
While at rest in the Applicant’s databases or on the Applicant’s network	Yes No	N/A
While in transit in electronic form	Yes No	N/A
While on mobile devices	Yes No	N/A
While on employee owned devices	Yes No	N/A
While in the care, custody, and control of a third party service provider	Yes No	N/A
4.	Is the Applicant a Healthcare Provider?	Yes No
If “Yes”, is the Applicant HIPAA compliant?	Yes No
5.	Is the Applicant subject to the General Data Protection Regulation (GDPR)?	Yes No
If “Yes”, is the Applicant currently compliant with GDPR?	Yes No
If the Applicant is subject to GDPR, and is not currently compliant, attach a description of steps being taken toward compliance.
PRIVACY CONTROLS
6.	Indicate whether the Applicant currently has the following in place:
A Chief Privacy Officer or other individual assigned responsibility for monitoring changes in statutes and regulations related to handling and use of sensitive information	Yes No
A publicly available privacy policy which has been reviewed by an attorney	Yes No
Sensitive data classification and inventory procedures	Yes No
Data retention, destruction, and recordkeeping procedures	Yes No
Annual privacy and information security training for employees	Yes No
Restricted access to sensitive data and systems based on job function	Yes No
NETWORK SECURITY CONTROLS
7.	Indicate whether the Applicant currently has the following in place:
A Chief Information Security Officer or other individual assigned responsibility for privacy and security practices	Yes No
Up-to-date, active firewall technology	Yes No
Up-to-date, active anti-virus software on all computers, networks, and mobile devices	Yes No
A process in place to regularly download, test, and install patches	Yes No
If “Yes”, is this process automated?	Yes No
If “Yes”, are critical patches installed within 30 days of release?	Yes No
Intrusion Detection System (IDS)	Yes No
Intrusion Prevention System (IPS)	Yes No
Data Loss Prevention System (DLP)	Yes No
Multi-factor authentication is required for all employees when accessing e-mail through a website or cloud based service (Check here if N/A: e-mail is not web-based: )	Yes No
Multi-factor authentication is required for all remote access to the network provided to employees, contractors, and third party service providers	Yes No
In addition to remote access, multi-factor authentication is required for the following, including such access provided to third party service providers:
(1) All internal and remote admin access to directory services (active directory LDAP, etc.)	Yes No
(2) All internal and remote admin access to network backup environment	Yes No
(3) All internal and remote admin access to network infrastructure (firewalls, routers, switches, etc.)	Yes No
(4) All internal and remote admin access to the organization’s endpoints/servers	Yes No
Remote access to the Applicant’s network limited to VPN	Yes No	N/A
Backup and recovery procedures in place for all important business and customer data	Yes No
If” Yes”, are such procedures automated?	Yes No
If “Yes”, are such procedures tested on an annual basis?	Yes No
Annual penetration testing	Yes No
If “Yes”, is such testing conducted by a third party service provider?	Yes No
Annual network security assessments	Yes No
If “Yes”, are such assessments conducted by a third party service provider?	Yes No
Systematic storage and monitoring of network and security logs	Yes No
Enforced password complexity requirements	Yes No
Procedures in place to terminate user access rights as part of the employee exit process	Yes No
PAYMENT CARD CONTROLS
Complete only if the Applicant, or a third party on the Applicant’s behalf, collects, processes, stores, or accepts payment card information.
8.	Indicate whether the Applicant’s current payment card environment:
Processes all payment cards using End-to-End or Point-to-Point encryption	Yes No
Encrypts or tokenizes card data when stored	Yes No
Processes card present transactions using EMV capable devices	Yes No	N/A

CONTENT LIABILITY CONTROLS
Media, Regulatory Proceeding, and Public Relations Coverage is not requested.
9.	Does the Applicant have a comprehensive written program in place for managing intellectual property rights?	Yes No
10.	Indicate whether the Applicant has formal policies or procedures for:
Avoiding the dissemination of content that infringes upon intellectual property rights	Yes No
Editing or removing controversial, offensive, or infringing content from material distributed or published by or on behalf of the Applicant	Yes No
Responding to allegations that content created, displayed, or published by the Applicant is libelous, infringing upon, or in violation of a third party’s privacy rights	Yes No
BUSINESS CONTINUITY / DISASTER RECOVERY / INCIDENT RESPONSE
11.	Indicate whether the Applicant has the following:
A disaster recovery plan, business continuity plan, or equivalent to respond to a computer system disruption	Yes No
An incident response plan to respond to a network intrusion	Yes No
12.	Are all plans indicated above tested regularly with any critical deficiencies remediated?	Yes	No	N/A
13.	Based upon testing results, how long does it take to restore the Applicant’s critical business operations following a network or systems interruption?
Unknown	0 – 12 hours	12 – 24 hours	More than 24 hours
VENDOR CONTROLS
14.	For vendors with access to the Applicant’s computer system or confidential information, indicate whether the Applicant has the following in place:
Written policies which specify appropriate vendor information security controls	Yes No
Periodic review of, and updates to, vendor access rights	Yes No
Prompt revocation of vendor access rights when access is no longer needed	Yes No
Logging and monitoring of vendor access to the Applicant’s system	Yes No
A requirement that vendors carry their own Professional Liability or Cyber Liability insurance	Yes No
Hold harmless / indemnity clauses that benefit the Applicant in contracts with vendors	Yes No
15.	Indicate which of the following services are outsourced and give the provider name (select all that apply):
Service	Provider
Data back up
Data center hosting*
IT infrastructure”
IT security
Web hosting
Payment processing**
Physical security
Software development
Customer marketing
Data processing
*If Data center hosting or IT infrastructure are selected:
What is the likely impact to the organization if these services become unavailable?
Does the Applicant have an alternative solution in the event of a failure or outage to one of these service providers?
**If Payment processing is selected, does the Applicant have an alternative means of processing card data in the event of an outsourced provider failure or outage?	Yes No
Provide details:

LOSS INFORMATION AND WARRANTY

1.	In the past 3 years, has the Applicant:
a. Experienced: (i) a network or computer system disruption due to an intentional attack or system failure; (ii) an actual or suspected data breach; or (iii) a cyber extortion demand?	Yes No
b. Received any complaints, claims, or been subject to any litigation involving matters of data protection law, intellectual property rights, defamation, rights of privacy, identity theft, denial of service attacks, computer virus infections, theft of information, damage to third party networks, or access to the Applicant’s network?	Yes No
If “Yes”, attach details of each claim, complaint, allegation or incident, including date, costs, losses or damages incurred or paid, any corrective procedures implemented, and any amounts paid as loss under any insurance policy.
Incident 1	Date: (dd/MON/yyyy)	Amount of Loss: $
Description of Loss
Corrective Procedures Implemented

2.	Is the Applicant or any person proposed for this insurance aware of any fact, circumstance, situation, event or act that reasonably could give rise to a claim against them under the insurance policy for which the Applicant is applying?	Yes No
If “Yes”, attach an explanation.

requested insurance terms

1.	Provide the following information if the Applicant currently carries cyber liability insurance:
Current Limit	Current Retention	Current Premium	Current Carrier	Date First Purchased (dd/MON/yyyy)
$	$	$
2.	Select requested Insuring Agreements:
Insuring Agreement	Limit Requested	Retention Requested
Privacy and Security	$	$
Media	$	$
Regulatory Proceedings	$	$
Privacy Breach Notification	$	$
Computer and Legal Experts	$	$
Betterment	$	$
Cyber Extortion	$	$
Data Restoration	$	$
Public Relations	$	$
Computer Fraud	$	$
Funds Transfer Fraud	$	$
Social Engineering Fraud	$	$
Telecom Fraud	$	$
Business Interruption	$	$
Dependent Business Interruption	$	$
Reputation Harm	$	$
3. Requested Terms: Aggregate Limit Requested: $ Effective Date Requested:	Requested Terms: a. Aggregate Limit Requested: $ b. Effective Date Requested (dd/MON/yyyy):

REQUIRED ATTACHMENTS — CYBERRISK

4.	As part of this Application, submit the following documents:
a. If requested Limit of Liability for Privacy and Security Coverage exceeds $3,000,000, submit most current audited or annual financial statements. b. Multi-Factor Authentication Attestation signed and dated.
These documents, and the representations and facts they contain, are made a part of this Application, whether such documents are physically delivered to Travelers Insurance Company of Canada by the Applicant or are obtained by Travelers Insurance Company of Canada from any public source, including the Internet.

SIGNATURE AND PRIVACY CONSENT

1.	The undersigned Authorized Representative represents that to the best of their knowledge and belief, and after reasonable inquiry, the statements provided in response to this Application and all attached Coverage Section Applications, including Supplemental Applications (collectively, “the Application”), are true and complete, and may be relied upon by Travelers Insurance Company of Canada as the basis for providing insurance. The Applicant will notify Travelers Insurance Company of Canada of any material changes to the information provided. This Application, including any requested or submitted information, will be deemed attached to and form a part of any policy issued.

2.	The undersigned Authorized Representative hereby consents to the collection, use, and disclosure of:

a.	the undersigned’s personal information; or

b.	the personal information of a third party (such as a family member, director, officer, or employee); and the undersigned represents they have obtained that person’s consent to such collection, use, and disclosure in accordance with Travelers Insurance Company of Canada’s Privacy Policy*;

in the ordinary course of business:

(1)	for the purposes of underwriting bonds, policies of insurance, and all other related insurance products offered by Travelers Insurance Company of Canada and all related documentation, bond, or policy management (which includes: handling customer complaints; any activities associated with extensions, renewals, substitutions, and modifications of such bond or policy of insurance; and claims administration); or

(2)	by and to its affiliates, reinsurers, legal advisors, other financial institutions, regulatory bodies, and any third party deemed necessary by Travelers Insurance Company of Canada.

*Travelers Insurance Company of Canada’s Privacy Policy is available online at www.travelerscanada.ca. If you have any questions about our Privacy Policy, contact our Privacy Officer at 1.800.268.8447 or 416.362.7231.

Authorized Representative Signature*: X	Authorized Representative Name and Title	Date (dd/MON/yyyy):

*If you are electronically submitting this document, apply your electronic signature to this form by checking the Electronic Signature and Acceptance box below. By doing so, you agree that your use of a key pad, mouse, or other device to check the Electronic Signature and Acceptance box constitutes your signature, acceptance, and agreement as if actually signed by you in writing and has the same force and effect as a signature affixed by hand.

Electronic Signature and Acceptance – Authorized Representative