MECO representative: Cyber-insurance rollout stalled as counties fail to meet compliance thresholds

MECO staff told the meeting a cyber-insurance offering could not proceed this year because too few counties signed up to meet the base premium and several counties did not meet technical compliance thresholds the underwriter requires.

"When we rolled it out to say hey who's interested who's signing up no one signed up. We had four counties which so we couldn't even reach the base premium to be able to cover it," the MECO representative said.

MECO staff and participants expressed worry that incomplete technical controls — for example, low adoption of multi-factor authentication and other cybersecurity best practices — could prompt an insurer to deny a cyber claim despite a certificate of coverage. The presenter warned that signed forms alone do not substitute for implemented controls: "When a claim happens the first thing they're going to do is look at your form ... when you haven't done those things they're going to reject the claim," she said.

Contract-limit mismatch: participants noted the county currently holds a $1 million certificate while a master contract requires $6 million, a discrepancy MECO staff said can be negotiated but could leave the county out of compliance with some contracts if not addressed.

Remediation plan: MECO proposed using Carly, its managed-service IT person, to perform technical reviews and certify that counties meet the required controls so they can purchase the package. The presenter said in prior outreach 17 counties were reviewed, 16 qualified and four indicated they would buy; the shortfall this rollout prevented the insurer from offering the program this cycle.

Next steps: MECO staff said they will follow up with county IT (Jenna) and Carly to pursue peer-review audits and to assess whether a multi-county group purchase or higher limits can be arranged for future cycles.