UPDATE: Wednesday, Jan. 11, 12:18 p.m.:
Council voted unanimously to a staff recommendation to have a cyberattack insurance policy in place. Coun. Brian Quiring was absent from the regular meeting Monday, Jan. 9.
City manager of information services Kris Satchel told council he’d been in contact with numerous other local governments about such an insurance policy, and the numbers he received back “were staggering.”
“One municipality in Alberta with a population under 10,000 was hit and their totals costs ended up being $650,000,” said Satchel, who did not name any of the municipalities he spoke with. “Another with a population of about 70,000, so almost twice as big as us, was hit for $2.9 million but they did have a policy in place. Yet it still ended up costing the taxpayers about $400,000.”
A report to council from the city’s Information Services and Financial Planning departments found the city does not currently have any insurance coverage for any type of cyberattack or intrusion.
“Cyber crime is evolving at a rapid pace, and the frequency and magnitude of attacks in the government sector is dramatically increasing,” the report states, adding that insurance coverage availability is “extremely limited” for municipalities.
The Municipal Insurance Association of BC is the liability insurance provider for the city and offers cyber coverage with certain restrictions. The association has provided the city with a quote of $27,375 for $1 million coverage or $37,250 for $2 million coverage per year with minimum levels of risk mitigation put in place.
The Information Services department confirms that the conditions imposed by the association are attainable.
The report states the $2 million coverage is more desirable. It notes that the current financial plan does not have a provision for this expense, but the 2021 Prior Year Unexpected Uncommitted Reserve has a balance of just over $154,500 that could be used to fund the first year’s premium.
Starting in 2024, the annual cyber insurance expense could be included in the tax base, the report states.
Cyber insurance was not included in the 2023 budget due to the unexpected length of time required to obtain premium quotes. The quoting process began in early fall last year but wasn’t completed until late November — too late for 2023 budget deliberations.
The report recommends that council purchase the $2 million coverage while directing administration to bring forward a service level adjustment for the annual cyber insurance coverage during the 2024 budget process to include the service in the 2024 tax base.