72DOW-S3941-Insurance.pdf

INSURANCE AND INDEMNIFICATION REQUIREMENTS

Risk Management Division

Effective – March/ 2007 1

SECTION C – PROFESSIONAL SERVICE AGREEMENTS

Professional Contracts – Technology Products/Services (Including data and equipment)

Contracts for Technology products and services like system integration, programming and data management create specialized exposures from loss or loss of use of the state’s tangible property and intangible property (software, data or other electronically stored information).

Additionally as more systems become dependent upon network solutions, such as cloud services or mobile computing platforms; there is an increased risk for privacy and/or data security issues.

Any contract involving capturing or processing the sensitive data, should include cyber liability coverage.

Sensitive data includes the following:

• Personally Identifiable Information (PII), such as name, address, date of birth, SSN

• Protected health information (PHI, HIPAA, HI-TECH);

• Student information (FERPA);

• Criminal History Repository Information (CHRI),

• Federal Tax Information (FTI);

• Bank accounts or credit/debit cards (PCI);

The fast pace of technology advances coupled with a highly competitive marketplace can lead to situations where IT vendors over-promise or misrepresent what their service/products solutions are able to deliver. Additionally, the nature of the agreements give vendors unique access to the state’s IT resources and data which could result in security issues if systems or data were misused, damaged or compromised.

The types of losses that can occur under such circumstances are often excluded under general liability policies. However, they can be covered through separate professional liability insurance policies, also known as “errors and omissions” (E&O) liability insurance.

Insurers have developed specialized policies E&O Policies that provide IT professionals coverage for the two common forms of IT liability risks: “malpractice” claims in which the company/individual were negligent in maintaining acceptable professional standards and breach of contract for failing to provide contracted services with timeframe or agreed specifications.

Examples of services that would require professional liability coverage include but are not limited to:

➢ Software development

➢ Computer consulting

➢ Web site design/programming

➢ Multi-media designers

➢ Integrated computer system design

➢ Data Management

➢ Other computer service providers

INSURANCE REQUIREMENTS:

Contractor and subcontractors shall procure and maintain until all of their obligations have been discharged, including any warranty periods under this Contract are satisfied, insurance against claims for injury to persons or damage to property which may arise from or in connection with the performance of the work hereunder by the Contractor, his agents, representatives, employees or subcontractors.

The insurance requirements herein are minimum requirements for this Contract and in no way limit the indemnity covenants contained in this Contract. The State in no way warrants that the minimum limits contained herein are sufficient to protect the Contractor from liabilities that might arise out of the performance of the work under this contract by the Contractor, his agents, representatives, employees or subcontractors and Contractor is free to purchase additional insurance as may be determined necessary.

A. MINIMUM SCOPE AND LIMITS OF INSURANCE: Contractor shall provide coverage with limits of liability not less than those stated below. An excess liability policy or umbrella liability policy may be used to meet the minimum liability requirements provided that the coverage is written on a “following form” basis.

1. Commercial General Liability – Occurrence Form

Policy shall include bodily injury, property damage and broad form contractual liability coverage.

• General Aggregate $2,000,000

• Products – Completed Operations Aggregate $2,000,000

• Personal and Advertising Injury $1,000,000

• Each Occurrence $1,000,000

Additional Requirements:

• State of Nevada, its officers, employees, and agents named as Additional Insured

• Primary and Non-Contributory wording

a. The policy shall be endorsed to include the following additional insured language: "The State of Nevada shall be named as an additional insured with respect to liability arising out of the activities performed by, or on behalf of the Contractor".

2. Automobile Liability - can be waived if contract does not involves use of motor vehicle.

Bodily Injury and Property Damage for any owned, hired, and non-owned vehicles used in the performance of this Contract.

Combined Single Limit (CSL) $1,000,000

a. The policy shall be endorsed to include the following additional insured language: "The State of Nevada shall be named as an additional insured with respect to liability arising out of the activities performed by, or on behalf of the Contractor, including automobiles owned, leased, hired or borrowed by the Contractor"

3. Worker's Compensation and Employers' Liability

Workers' Compensation Statutory Employers' Liability

Each Accident $1,000,000 Disease – Each Employee $1,000,000 Disease – Policy Limit $500,000

a. Policy shall contain a waiver of subrogation against the State of Nevada.

b. This requirement shall not apply when a contractor or subcontractor is exempt under N.R.S., AND when such contractor or subcontractor executes the appropriate sole proprietor waiver form.

4. Technology E&O/Professional Liability

The policy shall cover professional misconduct or lack of ordinary skill for those positions defined in the Scope of Services of this contract.

Minimum Each Claim $5,000,000 Annual Aggregate $5,000,000

a. In the event that the professional liability insurance required by this Contract is written on a claims-made basis, Contractor warrants that any retroactive date under the policy shall precede the effective date of this Contract; and that either continuous coverage will be maintained or an extended discovery period will be exercised for a period of two (2) years beginning at the time work under this Contract is completed.

b. Coverage should include:

• Software development errors

• Programming errors

• Systems integration failures

• Failure to perform professional services

• AI and automated decision support services

• Data migration errors

• Project management services

5. Network Security (Cyber) and Privacy Liability:

Minimum Per Occurrence $5,000,000 Annual Aggregate $5,000,000

Coverage should include:

• Privacy Liability

• Security Liability

• Data Breach Response

• Cyber Extortion

• Ransomware

• Business Interruption

• Regulatory Defense

• Media Liability

• Incident Response Costs

• Notification Costs

• Credit Monitoring

• Unauthorized access

• Malware

• Data destruction

• System interruption

• Privacy violations

Recommended Limits

• Minimum $5,000,000 per Claim

• $5,000,000 Aggregate For a statewide customer-facing platform:

• Preferred: $10,000,000

This errors and omissions insurance shall include coverage for third party claims and losses including with respect to network risks (such as data breaches, transmission of virus/malicious code; unauthorized access or criminal use of third party, ID/data theft) and invasion of privacy regardless of the type of media involved in the loss of private information (such as computers, paper files and records, or voice recorded tapes), covering collection, use, access, etc. of personally identifiable information., direct liability, as well as contractual liability for violation of privacy policy, civil suits and sublimit for regulatory defense/indemnity for payment of fines and penalties.

a. The retroactive coverage date shall be no later than the effective date of this contract.

b. Contractor shall maintain an extended reporting period for not less than two (2) years after termination of this contract.

6. Fidelity Bond or Crime Insurance (contracts involving financial accounts or data) Bond or Policy Limit $5,000,000

a. The bond or policy shall include coverage for all directors, officers, agents and employees of the Contractor.

b. The bond or policy shall include coverage for third party fidelity and name the State of Nevada as loss payee.

c. The bond or policy shall include coverage for extended theft and mysterious disappearance.

d. The bond or policy shall not contain a condition requiring an arrest and conviction.

e. Policies shall be endorsed to provide coverage for computer crime/fraud.

Coverage should include:

• Employee Theft

• Computer Fraud

• Funds Transfer Fraud

• Social Engineering Fraud (if available)

7. Umbrella / Excess Liability For a statewide implementation impacting customers, law enforcement, and data systems:

Recommended Limits

• $5,000,000 Excess Liability For a large modernization project:

• Consider $10,000,000

B. ADDITIONAL INSURANCE REQUIREMENTS: The policies shall include, or be endorsed to include, the following provisions:

1. On insurance policies where the State of Nevada is named as an additional insured, the State of Nevada shall be an additional insured to the full limits of liability purchased by the Contractor even if those limits of liability are in excess of those required by this Contract.

2 The Contractor's insurance coverage shall be primary insurance and non-contributory with respect to all other available sources.

C. NOTICE OF CANCELLATION: Contractor shall for each insurance policy required by the insurance provisions of this Contract shall not be suspended, voided or canceled except after providing thirty

(30) days prior written notice been given to the State, except when cancellation is for non-payment of premium, then ten (10) days prior notice may be given. Such notice shall be sent directly to The Department of Wildlife, Kelsey Anderson, 6980 Sierra Center Parkway #120 Reno, NV 89511. Should contractor fail to provide State timely notice, contractor will be considered in breach and subject to cure provisions set forth within this contract.

D. ACCEPTABILITY OF INSURERS: Insurance is to be placed with insurers duly licensed or authorized to do business in the state of Nevada and with an “A.M. Best” rating of not less than A- VII. The State in no way warrants that the above-required minimum insurer rating is sufficient to protect the Contractor from potential insurer insolvency.

E. VERIFICATION OF COVERAGE: Contractor shall furnish the State with certificates of insurance

(ACORD form or equivalent approved by the State) as required by this Contract. The certificates for each insurance policy are to be signed by a person authorized by that insurer to bind coverage on its behalf.

All certificates and any required endorsements are to be received and approved by the State before work commences. Each insurance policy required by this Contract must be in effect at or prior to commencement of work under this Contract and remain in effect for the duration of the project. Failure to maintain the insurance policies as required by this Contract or to provide evidence of renewal is a material breach of contract.

All certificates required by this Contract shall be sent directly to The Department of Wildlife, Kelsey

Anderson, 6980 Sierra Center Parkway #120 Reno, NV 89511. The State project/contract number and project description shall be noted on the certificate of insurance. The State reserves the right to require complete, certified copies of all insurance policies required by this Contract at any time. DO

NOT SEND CERTIFICATES OF INSURANCE TO THE STATES RISK MANAGEMENT DIVISION.

F. SUBCONTRACTORS: Contractors’ certificate(s) shall include all subcontractors as additional insureds under its policies or Contractor shall furnish to the State separate certificates and endorsements for each subcontractor. All coverages for subcontractors shall be subject to the minimum requirements identified above.

G. APPROVAL: Any modification or variation from the insurance requirements in this Contract shall be made by the Attorney General’s Office or the Risk Manager, whose decision shall be final. Such action will not require a formal Contract amendment, but may be made by administrative action.

Recommended Insurance Requirements

1. Commercial General Liability (CGL)

Coverage for bodily injury, property damage, personal injury, and contractual liability.

Recommended Limits

• $1,000,000 Each Occurrence

• $2,000,000 General Aggregate

• $2,000,000 Products/Completed Operations Aggregate

Additional Requirements:

• State of Nevada, its officers, employees, and agents named as Additional Insured

• Primary and Non-Contributory wording

2. Automobile Liability

Required if vendor employees travel to State facilities.

Recommended Limits

• $1,000,000 Combined Single Limit

Coverage for:

• Owned Autos

• Hired Autos

• Non-Owned Autos

3. Workers' Compensation and Employers Liability

Required by Nevada law.

Workers' Compensation

• Statutory Limits

Employers Liability

• $1,000,000 Each Accident

• $1,000,000 Disease Policy Limit

• $1,000,000 Disease Each Employee

4. Technology Errors & Omissions (Professional Liability)

This is one of the most important coverages for this project.

The contractor is designing, implementing, integrating, and potentially maintaining technology systems supporting wildlife licensing, law enforcement, reporting, AI functions, and customer data.

Recommended Limits

• Minimum $5,000,000 per Claim

• $5,000,000 Aggregate

Coverage should include:

• Software development errors

• Programming errors

• Systems integration failures

• Failure to perform professional services

• AI and automated decision support services

• Data migration errors

• Project management services

For large enterprise implementations, I often recommend $10,000,000 if the contract value exceeds several million dollars.

5. Cyber Liability and Privacy Liability

This project clearly involves customer information and cloud-based technologies.

Coverage should include:

• Privacy Liability

• Security Liability

• Data Breach Response

• Cyber Extortion

• Ransomware

• Business Interruption

• Regulatory Defense

• Media Liability

• Incident Response Costs

• Notification Costs

• Credit Monitoring

Recommended Limits

• Minimum $5,000,000 per Claim

• $5,000,000 Aggregate

For a statewide customer-facing platform:

• Preferred: $10,000,000

Given Nevada's recent cyber events and increasing regulatory exposure, $10M would be a prudent target.

6. Crime/Fidelity Coverage

Because the contractor may have access to:

• Customer accounts

• Payment information

• State data

• Administrative system access

Require Employee Dishonesty coverage.

Recommended Limits

• Minimum $1,000,000

If vendor personnel have administrative access to financial transactions or licensing revenue:

• Consider $2,000,000 to $5,000,000

Coverage should include:

• Employee Theft

• Computer Fraud

• Funds Transfer Fraud

• Social Engineering Fraud (if available)

7. Network Security and Privacy Endorsement

Require coverage specifically addressing:

• Unauthorized access

• Malware

• Data destruction

• System interruption

• Privacy violations

This may be included within Cyber Liability but should be specifically verified.

8. Umbrella / Excess Liability

For a statewide implementation impacting customers, law enforcement, and data systems:

Recommended Limits

• $5,000,000 Excess Liability

For a large modernization project:

• Consider $10,000,000

Additional Contractual Risk Transfer Requirements

The contract should also require:

• Vendor indemnification of the State for negligent acts, errors, omissions, cyber incidents, and data breaches.

• Certificates of Insurance provided prior to work.

• 30 days' notice of cancellation or material change.

• Subcontractors required to maintain equivalent coverage.

• Data breach notification requirements within 24 hours.

• Compliance with State cybersecurity standards and CJIS requirements if law enforcement data is involved.

My Recommended Insurance Schedule for NDOW

If this is a major modernization project involving cloud hosting, customer records, mobile applications, AI tools, and law enforcement functionality, I would require:

Coverage Limit

Commercial General Liability $1M / $2M

Auto Liability $1M CSL

Workers Compensation Statutory

Employers Liability $1M

Technology E&O $5M–$10M

Cyber Liability $5M–$10M

Crime/Fidelity $1M–$5M

Umbrella Liability $5M–$10M

For a statewide technology transformation with AI and customer data, my recommendation would be $10 million Cyber Liability, $10 million Technology E&O, and at least $2 million

Crime/Fidelity coverage. These are the coverages most likely to respond to the largest foreseeable losses arising from this type of contract.