THE CRUNCH · EPISODE 34 · 0:32 · RISK

The Coverage Gap

THE CRUNCH · EP 34

TAP TO PAUSE

PAUSED — TAP TO RESUME

Tap ♫ for music

Or keep scrolling — the full text is below

0:32 runtimeFully captioned · music optionalDrag the top bar to seekThe Crunch · :30 series

Prefer to read it?

A retired hard drive turns up with your data on it. Who pays? Often nobody you expected. Your cyber policy is typically written around your live systems, and policies vary in how they treat assets that have left your control or a vendor’s mistake.

The vendor’s general liability policy covers accidents — injuries and property damage, not a negligently performed service. The vendor’s own cyber policy is written for the vendor’s losses. And a certificate of insurance is not the policy: it does not show exclusions, and it gives you no rights.

What closes the gap is technology errors & omissions coverage, being named as an additional insured with a waiver of subrogation, and an indemnity with insurance behind it. An indemnity without insurance is decorative. Read your own policy against the disposition scenario, and put three insurance questions in every ITAD contract.

About this episode

The Coverage Gap is episode 34 of The Crunch, CyberCrunch's series of 30-second animated ITAD explainers. It explains, at the pattern level, why a data breach caused by a retired device can fall between an organization's cyber liability policy, typically written around its live systems, and its vendor's insurance, since commercial general liability covers bodily injury and property damage rather than negligently performed services and a vendor's cyber policy is designed for the vendor's own losses; why a certificate of insurance shows neither exclusions nor rights; and how technology errors and omissions coverage, additional insured status with a waiver of subrogation, and insurance-backed indemnification close the gap. It is not legal or insurance advice. CyberCrunch is an R2v3, NAID AAA, RIOS, and PA DEP certified IT asset disposition and data destruction provider headquartered in Greensburg, Pennsylvania, with a secure processing facility in Upper Chichester, Pennsylvania, serving all 50 states.

The Coverage Gap

Prefer to read it?

Which policy pays when a retired drive causes a breach?