Common use of [OPTIONAL IF APPLICABLE] Specific Requirements for Cyber/Data Information Security Insurance Clause in Contracts

[OPTIONAL IF APPLICABLE] Specific Requirements for Cyber/Data Information Security Insurance. Licensor shall purchase and maintain cyber/information security insurance coverage with combined single limits for each wrongful act of $2,000,000 per occurrence to cover the unauthorized acquisition of personal information such as social security numbers, credit card numbers, financial account information, or other information that uniquely identifies an individual and may be of a sensitive nature in accordance with Section 2-6-1501, MCA through Section 2-6-1503, MCA. If Licensor maintains higher limits than the minimums shown above, the State requires and shall be entitled to coverage for the higher limits maintained by Licensor. Any available insurance proceeds in excess of the specified minimum limits of insurance and coverage shall be available to the State. Such insurance must cover, at a minimum, privacy notification costs, credit monitoring, forensics investigations, legal fees/costs, regulatory fines and penalties, and third party liability settlements or judgments as may be caused by any act, omission, or negligence of Licensor’s officers, agents, representatives, assigns or subcontractors. [NOTE: Most vendors have access to cybersecurity coverage; therefore, agencies should require cybersecurity insurance unless there is no risk to the State. Even on-premise solutions can introduce security vulnerabilities to otherwise secure systems, and agencies should require cybersecurity insurance to reduce financial risk to the State.][NOTE: If occurrence coverage is unavailable or cost-prohibitive, State will accept ‘claims made’ coverage provided the following conditions are met: 1) the retroactive date must be shown, and must be before the date of the contract or the beginning of contract work; 2) insurance must be maintained and evidence of insurance must be provided for at least three (3) years after completion of the contract of work; and 3) if coverage is canceled or non-renewed, and not replaced with another claims-made policy form with a retroactive date prior to the contract effective date, Licensor must purchase “extended reporting” coverage for a minimum of three (3) years after completion of work.]