Cyber risk has become a leading issue for many organisations as awareness of cloud computing, social media, corporate Bring Your Own Device (BYOD) policies and big data has grown, especially in light of the recent malicious cyber attacks experienced by companies across the European Union (EU). In an increasingly punitive legal and regulatory environment, and in the face of more frequent contractual insurance requirements specifying cyber liability, forward-thinking companies are taking proactive steps to explore and transfer cyber risk.

1. Risk. Reinsurance. Human Resources.
Aon Risk Solutions
Construction Cyber Risk and Solutions
Cyber risk has become a leading issue for many organisations as awareness of cloud
computing, social media, corporate Bring Your Own Device (BYOD) policies and big data has
grown, especially in light of the recent malicious cyber attacks experienced by companies
across the European Union (EU). In an increasingly punitive legal and regulatory environment,
and in the face of more frequent contractual insurance requirements specifying cyber liability,
forward-thinking companies are taking proactive steps to explore and transfer cyber risk.
When should organisations be concerned
about their cyber risk exposure?
Organisations should be concerned about cyber risk
if they:
• Gather, maintain, disseminate or store
private information
• Engage customers, subcontractors or additional
service providers
• Have a degree of dependency on electronic
processes or computer networks
• Are concerned about intentional acts by
rogue employees
• Are subject to regulatory statutes
• Are a public company subject to the ePrivacy
Directive notification requirements
• Are required to comply with Payment Card
Industry Data Security Standards (PCI DSS)
What are unique risks to Construction
organisations?
• Customer and suppliers financial information stored
• Building Information Modelling (BIM) and
Supervisory Control Data Acquisition (SCADA)
inter-connected systems targeted by hackers
• Theft of desirable information including
intellectual property, proprietary assets,
architectural drawings/specifications, building
schematics or blueprints
• Potentially large amounts of customer and
employee data held
• Business/service interruption or lost income due
to cyber incident
• Resources allocated to physical rather than
information and systems security
• Contractual agreement
Why aren’t standard insurance policies
enough?
While existing forms sometimes carry a level of
coverage, they were not intended to cover many
risks associated with an increasingly digital world.
Typical forms respond as follows:
• General Liability: covers bodily injury and
property damage, not economic loss
• Professional Indemnity: covers economic
damages resulting from a failure of defined
services only, and may contain exclusions for data
and privacy breaches
• Property: covers tangible property, which data
is not. Loss must be caused by a physical peril
while perils to data are more likely to be viruses
or hackers
• Crime: covers employees and generally only
money, securities and tangible property. No
coverageforthirdpartypropertysuchascustomer/
client data
We’re here to
empower results
Joseph Addo
Product Manager
+44 (0)125 276 7191
joseph.addo@aon.co.uk

2. Risk. Reinsurance. Human Resources.
Aon Risk Solutions
Why aren’t standard insurance policies enough?
While existing forms sometimes carry a level of coverage, they were
not intended to cover many risks associated with an increasingly
digital world. Typical forms respond as follows:
• General Liability: covers bodily injury and property damage,
not economic loss
• Professional Indemnity: covers economic damages resulting
from a failure of defined services only, and may contain
exclusions for data and privacy breaches
• Property: covers tangible property, which data is not. Loss
must be caused by a physical peril while perils to data are more
likely to be viruses or hackers
• Crime: covers employees and generally only money, securities
and tangible property. No coverage for third party property such
as customer/client data
What is the scope of today’s cyber coverage?
1st
Party Coverage
• Network business interruption: loss of income and extra expense
due to network security failure
• Intangible property: costs to restore or recreate data or software
resulting from network security failure
• Breach event notification/management costs associated with;
– Statutory notification requirements, including the hiring of
outside law firms and public relations consultants
– Credit monitoring/protection
– Notification hot line/call centre
– Forensic costs
– Identity theft resources
– Cyber extortion
3rd
Party Coverage
• Wrongful disclosure of Personally Identifiable Information,
Protected Health Information or confidential corporate
information in the client’s care, custody and control)
via a computer network or off-line (eg., via laptop, paper
records, disks)
• Failure of computer network security to guard against threats
such as hackers, viruses, worms, Trojan horses and denial-of-
service attacks whether or not resulting from the provision of
professional services
• Content liability perils such as defamation and infringement of
intellectual property rights arising out of website, marketing
and advertising activities
• Security or privacy breach regulatory proceedings (including
associated fines and penalties)
EU Data Protection Regulation
The EU Data Protection regulation will become a crucial piece
of legislation and will encompass stronger obligations around
minimum technical and organizational control as well as prompt
failure disclosures and will provide more power to local regulators
around imposing financial penalties as well as subjecting
companies to regulatory audits. Firms must start preparing early as
there are a number of additional administrative and record keeping
obligations that may require fundamental organizational and IT
change and in some cases at significant cost.
About Aon
Aon plc (NYSE:AON) is a leading global provider of risk
management, insurance brokerage and reinsurance brokerage,
and human resources solutions and outsourcing services.
Through its more than 72,000 colleagues worldwide, Aon
unites to empower results for clients in over 120 countries via
innovative risk and people solutions. For further information on
our capabilities and to learn how we empower results for clients,
please visit: http://aon.mediaroom.com/
© Aon UK Ltd 2016. All rights reserved.
The information contained herein and the statements expressed are of a general nature and are not intended to address the
circumstances of any particular individual or entity. Although we endeavour to provide accurate and timely information and use sources
we consider reliable, there can be no guarantee that such information is accurate as of the date it is received or that it will continue to be
accurate in the future. No one should act on such information without appropriate professional advice after a thorough examination of
the particular situation.
Aon UK Limited is authorised and regulated by the Financial Conduct Authority. Registered No. 210725. FPNAT235
aon.co.uk