Council voted unanimously to a staff recommendation to have a cyberattack insurance policy in place.
City manager of information services Kris Satchel told council he’d been in contact with numerous other local governments about such an insurance policy, and the numbers he received back “were staggering.”
“One municipality in Alberta with a population under 10,000 was hit and their totals costs ended up being $650,000,” said Satchel, who did not name any of the municipalities he spoke with. “Another with a population of about 70,000, so almost twice as big as us, was hit for $2.9 million but they did have a policy in place. Yet it still ended up costing the taxpayers about $400,000.”
A report to council from the city’s Information Services and Financial Planning departments found the city does not currently have any insurance coverage for any type of cyberattack or intrusion.
“Cyber crime is evolving at a rapid pace, and the frequency and magnitude of attacks in the government sector is dramatically increasing,” the report states, adding that insurance coverage availability is “extremely limited” for municipalities.
The Municipal Insurance Association of BC is the liability insurance provider for the city and offers cyber coverage with certain restrictions. The association has provided the city with a quote of $27,375 for $1 million coverage or $37,250 for $2 million coverage per year with minimum levels of risk mitigation put in place.
The Information Services department confirms that the conditions imposed by the association are attainable.
The report states the $2 million coverage is more desirable. It notes that the current financial plan does not have a provision for this expense, but the 2021 Prior Year Unexpected Uncommitted Reserve has a balance of just over $154,500 that could be used to fund the first year’s premium.
Starting in 2024, the annual cyber insurance expense could be included in the tax base, the report states.