County staff weigh cyber insurance options and multifactor authentication trade-offs

County insurance representatives presented cyber insurance options at the March 18 Jackson County advisers meeting and discussed how coverage sublimits and internal controls, notably multifactor authentication (MFA), affect protection and premiums.

Jennifer Mashandy of Engel Insurance and Megan (identified in the meeting as director of ICAP) described three options: an ICAP pool placement with a $2 million limit (previously underwritten with Tokyo layered as reinsurer) at roughly $15,000 per year as presented, a Tokyo-linked placement similar in layer and price, and a CFC market option offering $2 million at $9,980 or $3 million at $12,530. Speakers repeatedly cautioned that quoted premiums are only one factor; sublimits (caps on specific coverages such as social engineering or stolen-funds scenarios) vary across carriers and materially affect outcomes when incidents occur.

Board members pressed for practical comparisons: how the sublimits differ, how claims handling differs if a county uses the ICAP pool versus an off-pool carrier, and which social-engineering limits would pay in common scenarios. Megan said some CFC sublimits are lower in specific categories but that CFC offered a lower premium; ICAP as a pool offers "nimble" claims support and a member-governed approach, Megan added. Insurance staff noted a recurring point in the meeting: if the county implements MFA across accounts, certain sublimits in the ICAP quote would increase (examples cited in the packet: specific coverages rising from $100,000 to $250,000 at no additional premium under ICAP).

Presenters and supervisors identified operational context the board should consider before buying coverage. Staff estimated the county has roughly 60'70 users and an "undetermined" total number of records across offices (records cited include paper and electronic inmate files, recorder books, and credit-card processing records). One real-world claim example presented involved a vendor'email compromise where apparent purchase orders triggered rapid transfers before IT discovered the issue; the presenters used that to illustrate social-engineering exposures.

Outcome and direction: staff asked the county's two in-house subject matter experts to work with the insurers to prepare a concise comparison packet that lists the coverage lines, specific sublimits, relevant deductibles, and how MFA or other controls alter coverage. The county requested this side-by-side comparison and suggested a two-hour follow-up meeting with the presenters and IT/security staff; a vote on cyber insurance was deferred.

Why it matters: counties with modest IT staff and mixed paper/electronic records face asymmetric cyber risks; coverage often depends on the exact loss cause and declared sublimits. Several supervisors said they preferred having subject-matter experts produce a recommendation the board could act on after reviewing the comparisons.