Managed Service Provider (MSP) Insurance & Risk Management
Insurance Expert, Simon Taylor
What is a managed service provider?
MSPs will typically offer their services on a subscription basis, allowing businesses to outsource their IT needs without the need for in-house staff or infrastructure. The use of an MSP can also provide businesses with access to a wider range of IT expertise and resources than they would be able to maintain in-house.
What insurance do MSPs need?
Cyber insurance and professional indemnity (also known as professional liability or E&O insurance) should be combined under the same policy. Failure to prevent a cyber-attack can trigger both a traditional cyber insurance policy and a professional indemnity policy.
Cyber criminals are capable of inflicting damage by gaining access to clients through MSPs. They are increasingly targeting vendors and suppliers to gain access to a larger number of company targets. MSPs face real cyber risk, and the steady growth in this market has been accompanied by a rise in claims.
It’s becoming more common that insurers will undertake port scanning – which means your IT systems are scanned for open ports and other system vulnerabilities. If the insurer can identify vulnerabilities, they will need to be resolved before any terms are offered.
MSP risk management
Monitoring software and detection software, such as EDR (Endpoint Detection and Response), are a must for MSPs. As are firewalls or a network monitoring system, tracked 24/7 by an internal or external security centre. Once a hacker gets into a system, it is vital they are detected in time.
Software companies generally devote a lot of time creating a secure product, however similar safeguarding for their own environments is often lacking. For example, clients are regularly asked to download the software from a website that is not well protected.
MSPs really should have the best practices in place, given the greater potential impact of losses from a widespread event and increased duty of care responsibilities. A Privileged Access Management (PAM) system tool preserves identities, with special access or capabilities beyond those of regular users. It is particularly important for MSPs, which have many people accessing multiple programs through a central software package.
One of the most business-critical elements for dealing with cyber-attacks is a clear incident response plan. Advanced planning will help a company react appropriately and quickly if they have been hacked. For a software company, this plan goes beyond their own IT environment and should also include a client communication and crisis management policy.
Protecting client data
Personal identifiable information (PII) remains a hot topic for the insurance market. Any data relating to a natural person who can be identified directly from the information falls under The Data Protection Act 2018. Which is the UK’s implementation of the General Data Protection Regulation (GDPR). Everyone responsible for using personal data must follow strict rules called ‘data protection principles.
It’s also worth considering that an MSP has a duty of care to warn their clients about poor protection in a client environment. Clients should be informed in writing, and this should be recorded to offer protection about future liabilities.
About the author
Simon Taylor is a respected senior industry professional and a Chartered Insurance Broker with over 20 years’ of experience in the commercial insurance sector as an underwriter, broker and director.