Cyber Liability Insurance

The State of Arkansas Department of Shared Administrative Services Office of State Procurement, on behalf of the Arkansas Insurance Department, is soliciting bids for a master cyber liability insurance contract through an Invitation for Bid (IFB) with responses due by April 28, 2026, at 2:00 p.m. Central Time via the ARBuy eProcurement system. The procurement covers two separate trust fund programs: the Arkansas Multi-Agency Insurance Trust (AMAIT), which insures 166 state agencies and public-funded institutions of higher education with mandatory participation, and the Arkansas Public School Insurance Trust (APSIT), which insures 19 public school districts, open enrollment public charter schools, and educational cooperatives with voluntary participation. The requested cyber liability insurance must provide comprehensive first-party and third-party coverage including Security & Privacy Liability, Security & Privacy Incident Response Expenses, Business Interruption, Data Recovery, Regulatory Proceedings, Cyber Extortion, Media Content Liability, and Reputational Risk Response Coverage, with coverage limits of $10,000,000 aggregate for AMAIT and $5,000,000 aggregate for APSIT, and per-occurrence limits of $10 million and $1 million respectively. The contract will commence on July 1, 2026, with an initial one-year term and potential for up to six additional one-year renewals for a maximum seven-year aggregate term. Prospective contractors must be licensed to do business in Arkansas, possess authority to bind coverage, maintain an office location within 250 miles of Little Rock with a dedicated commercial lines account manager possessing at least three years of cyber liability insurance experience, maintain errors and omissions insurance with a minimum $10 million per occurrence limit, and ensure that primary insurance carriers maintain an A.M. Best rating of A (Excellent) with Financial Size Category XII or better and domestic status. Contractors must provide 24-hour claims reporting through a dedicated Arkansas-based claims intake office with live staff support, detailed monthly loss history reporting, comprehensive policy administration services, and pre-approved cyber response panel vendors, with pricing submissions based on combined total annual actual expenditures of $22,770,189,352 for both programs, with current annual premiums of $928,000 for AMAIT and $93,905.76 for APSIT.

The solicitation contains no identified set-aside designations or restrictions specific to disadvantaged enterprises beyond standard Arkansas state certification requirements, though all bidders must certify they are not scrutinized companies and comply with state boycott prohibitions regarding Israel, energy/fossil fuel/firearms/ammunition industries, and illegal immigrant employment. The current insurance providers are Starr Surplus Lines Insurance Company for APSIT and Starr Indemnity & Liability Company for AMAIT, with the existing AMAIT policy carrying an aggregate retention of $2,500,000 and the APSIT policy carrying individual entity retentions ranging from $25,000 to $1,000,000 depending on coverage section; contractors must integrate with the existing cyber response infrastructure and loss management protocols established under the current AMAIT Cyber Claim Protocol Endorsement. Historical loss data indicates significant cyber risk exposure across participating entities, with total incurred losses of $3,282,008 across the AMAIT portfolio from July 2015 through June 2026, and six open claims totaling $670,000 in the most recent reporting period, reflecting substantial ransomware, unauthorized access, and employee error incidents across state agencies and educational institutions. The contract award value will be determined by the submitted pricing on the Official Bid Price Sheet, with the evaluation based on lowest cost for cyber liability coverage rates calculated on the established valuation bases of $38,001,233,662.00 for AMAIT and $468,087,862.00 for APSIT, though exact premium amounts cannot be determined until bid submissions are received and evaluated.