Due Diligence Report for MCN Acquisition
Prepared for:
City of Fort Bragg and Mendocino Unified School District Prepared by:
Level Up Office Pro LLC – Sage Statham
Date: May 1st, 2025
2 Executive Summary.................................................................................................3 Transaction Background and Objectives ..................................................................3 Financial Overview and Analysis..............................................................................3 Revenue and Expense Trends ...............................................................................3 Net Position .........................................................................................................5 Human Resources and Personnel Review .....................................................................7 Staffing................................................................................................................7 Technology and Operations Assessment .......................................................................8 Hosted Services....................................................................................................9 Customer Churn and Growth Rates....................................................................10 Cybersecurity ....................................................................................................11 Risk Management and Compliance ........................................................................11 Equipment and Asset Inventory.................................................................................12 Open Air Inventory – Approximate Stock ......................................................................12 Open Air Long Range Equipment .................................................................................13 Colocation Facility Equipment .....................................................................................14 Grandstream VOIP Inventory .......................................................................................14 Office Equipment .......................................................................................................14 Office Furniture..........................................................................................................15 Appendices and Supporting Documentation............................................................15 3 Executive Summary
This report summarizes findings from the due diligence review of the proposed acquisition of Mendocino Community Network (MCN), currently operated by the Mendocino Unified School District. The acquisition supports the City of Fort Bragg’s strategic goal to build a municipally owned broadband network that delivers affordable, reliable, high-speed internet services to residents and businesses.
The analysis highlights MCN’s operational potential alongside its structural and financial vulnerabilities. Despite strong customer loyalty and digital service offerings, MCN has experienced consistent operating losses and declining net position.
From FY20-21 through FY22-23, MCN showed resilience and financial recovery following the COVID-19 pandemic—despite its ineligibility for federal PPP assistance. However, a significant decline in FY23-24, both in net position and operating margin, as well as projected current year totals signals a reversal in this trend. Coupled with limited internal financial reporting in recent years, underscore the need for careful transition planning and fiscal oversight under City ownership.
Transaction Background and Objectives
The Mendocino Unified School District has agreed to transfer MCN to the City of Fort Bragg for $500,000, payable over ten years. The City’s objective is to modernize and expand broadband infrastructure, using MCN’s assets as a foundation for municipal fiber deployment. The agreement includes operational assets, customer relationships, and staff.
Financial Overview and Analysis
Revenue and Expense Trends
From FY17-18 through FY19-20, MCN had consistent financial performance, with operating revenue between $2.1 million and $2.3 million and modest year-end surpluses. During this time, the organization invested in fixed wireless infrastructure to support the launch of its Open Air service, which became operational in early FY20-21. These investments increased service and supply costs but were intended to transition MCN to a leaner, internally managed broadband model with stronger margins. In recent years operating losses became recurring, driven not by revenue decline but by a failure to scale down expenditures in line with the simplified Open Air service structure. By FY23-24, the organization recorded a $167,531 loss and unrestricted net 4 position had fallen to just $12,703, down from $287,094 in FY18-19. These results reflect not only a structural imbalance between revenue and spending, but a lack of fiscal response to evolving business conditions.
In FY24–25 to date, actual monthly revenue has ranged from $180K to $193K, trailing the budgeted targets of $210K+. Meanwhile, monthly expenses have consistently exceeded revenue, peaking near $219K. This persistent gap has led to sustained monthly deficits and limits MCN’s financial resilience. While MCN has not produced formal cash flow forecasts, it has implemented a price increase in an effort to improve revenue. However, this measure also carries risk, as it may accelerate customer attrition, particularly among Fusion users. Some of the revenue from the price increase began in March and the rest in April so we do not yet have accurate numbers on how this has impacted their financial trend.
Source Data: Appendix A - MCN Audited Operating Net
Year-end data for FY23-24 shows that the Total Net Position (excluding pension) declined from $198,111 in FY22-23 to just $30,580—a drop of over $167K. While the school district’s broader solvency supports the fund’s viability, this decline illustrates an unsustainable financial trajectory within the MCN operation itself.
Q1 and Q2 of FY2025 further illustrate this trend:
• Fiscal
Quarter
Total Income Total Expenses Net Income
Q1 (Jul–Sep 2024) $540,650.33 $570,087.00 –$29,436.67
Q2 (Oct–Dec 2024) $564,725.92 $616,766.00 –$52,040.08
Q3 (Jan – Mar 2025) $557,766.54 -
5 Net Position
The net position excluding pension for the period ending June 2024 was $30,580—down significantly from $198,111 in June 2023, marking a year-over-year decline of $167,531. This shift followed three years of post-pandemic stabilization and signaled the beginning of a downward financial trend. That decline continued into FY24-25, with net losses of $29,436.67 in Q1 and $52,040.08 in Q2, resulting in a fully eroded net position and the fund now operating at a deficit. As operations transition from the school district to the City, this financial trajectory underscores the importance of a proactive stabilization strategy to ensure long-term sustainability under City management.
Source Data: Appendix B - MCN Audited Net Position
Valuation Estimate
The following valuation represents an updated estimate of MCN’s fair market value based on tangible assets, customer goodwill, and identified liabilities. While MCN holds meaningful operational assets and an active customer base, the current financial trajectory, infrastructure age, and operational liabilities reduce its net valuation.
6 Asset Category Estimated Value Notes
IPv4 Address Block (/20) $160,000 Based on current secondary market valuations
Capital Equipment $100,000 Includes wireless radios,
firewalls, servers, switches,
VOIP handsets
Office Equipment &
Furniture
$15,000 Includes desks, chairs,
shelving, routers, phones,
etc.
Goodwill / Customer Base $100,000 – $125,000 Estimated based on recurring hosted service
revenues and brand loyalty
Adjustments / Liabilities:
Category Amount Notes
Equipment Financing –$43,000 Outstanding lease/loan for capital equipment
Customer Credits –$55,092 Per FY2024 audit;
transitional liability for
pre-paid services
Risk Discount –$35,000 to –$75,000 Accounts for aging Fusion infrastructure, end-of-life
services, vacancies
After adjustments, this yields a revised valuation estimate of:
$242,000 – $327,000
This updated range reflects the actual net value of MCN as of early 2025, incorporating both asset potential and known financial risks.
Given that the proposed purchase price is $500,000, the estimate indicates the offer exceeds current fair market value by approximately $175K–$260K
7 Human Resources and Personnel Review
Staffing
MCN currently employs seven full-time staff and one part-time employee, maintaining a staffing level just below the historical norm of eight FTEs. The team includes more technical personnel than in past years, positioning MCN to support infrastructure modernization such as fiber deployment. However, two key roles remain vacant, raising concerns about capacity and oversight.
Management
The MCN Manager brings strong technical expertise from his prior role as Operations Engineer and has been effective in maintaining core infrastructure. However, he was placed into a leadership role without a background in financial management or administrative oversight—and the support structures needed to bridge that gap were never fully established.
The Inside Operations Manager position, which historically provided key billing and financial support, has been vacant for several months. Even prior to that vacancy, the data suggests that the role had not been functioning effectively. The MCN Manager, with limited experience in financial administration, did not identify early indicators of performance issues, and concerns went largely unaddressed.
As a result, signs of deeper issues—reflected in the profit and loss statements and overall organizational performance—were not recognized until they had escalated and begun to impact broader operational stability. While technically capable, the Manager has not demonstrated the necessary capacity to oversee financial operations, enforce accountability, or implement timely corrective action. Strengthening administrative leadership and financial oversight will be essential to support a stable transition and future operational success.
Network Operations
A single Senior Network Administrator is responsible for maintaining MCN’s entire infrastructure, including core servers, wireless links, virtual machines, and customer-facing systems. Historically, this responsibility was shared between two technical staff, allowing for coverage during absences and distributing the workload. Currently, the MCN Manager provides backup, which may not be sustainable long-term.
Looking ahead, network operations demand will increase significantly with the rollout of the new fiber infrastructure. The planning, configuration, testing, and deployment of fiber network equipment—including switches, routers, customer premise devices, and integration with existing systems—will require substantial engineering time and coordination. The current staffing level is not sufficient to meet these demands without risking service reliability or deployment delays.
Reinstating a second technical operations position is strongly recommended.
Customer Support
The customer service team includes four full-time employees and one part-time technician. This team handles installations, phone/email support, and pre-sales technical inquiries. One employee 8 is bilingual—an asset to serving the region’s diverse population. Two team members have four or more years of experience; the remaining staff have less than three years.
This staffing level is likely appropriate to support the City’s planned rapid fiber deployment, especially given the increased customer onboarding and field service activity that will accompany infrastructure expansion. Maintaining or enhancing this team’s capacity will be critical to supporting service continuity and growth.
Billing
Two positions are designated to support billing operations: an Inside Operations Manager (currently vacant) and an Inside Operations Agent. The Agent handles customer-facing billing support and front-office responsibilities. In the absence of the Operations Manager, oversight of billing systems, reconciliation, and budget adherence may be lacking. Currently, the Mendocino Unified School District’s Chief Business Officer (CBO) provides assistance with higher-level financial oversight and support due to this vacancy.
Going forward, the City will want to keep a dedicated billing staff member, like the Inside Operations Agent, due to the high volume and technical nature of MCN’s billing processes, which include complex service tiers, VOIP, storage subscriptions, and other technical billing issues. However, broader financial reporting, budgeting, and oversight functions could be absorbed by the City’s existing finance department, assuming adequate coordination and knowledge transfer occur during transition.
Technology and Operations Assessment
Billing Systems
MCN uses Platypus ISP Billing Software, a specialized yet cost-effective platform for managing complex ISP billing requirements. The system supports dynamic service tiers, VOIP licenses, email storage, and tax applications, but requires experienced staff to maintain data integrity and accuracy.
Fusion
Fusion is a bundle of DSL internet and Plain Old Telephone Service (POTS). Fusion is a resold product provided by Sonic Telecom in Santa Rosa. Fusion currently is the largest budget item at MCN. Fusion customers can be transitioned to fiber and paired with MCN’s Digital Voice service. Fusion is offered in a single speed that is distance sensitive. Customers are connecting at between 1.5 Mb/s to 150 Mb/s depending on their distance from the central office. Fusion also includes POTS with unlimited local and long distance and the phone works when the power is out. Fusion is billed to customers with both the data and phone service included in the price.
Sonic is no longer selling Fusion service to new customers so new customers are being directed to Open Air and customers are upgrading their service from Fusion to Open Air. 9 Fusion Monthly
Fusion Res Single $93.73 (Including Taxes)
Fusion Res Bonded $158.51 (Including Taxes)
Fusion Bus Single $105.73 (Including Taxes)
Fusion Bus Bonded $171.51 (Including Taxes)
Fusion Rental Equipment
Single $6.00
Wireless $8.00
Bonded $10.00
This product line is in rapid decline industry-wide and is considered end-of-life. Sonic has the right to terminate service with only 90 days’ notice. Migrating Fusion customers to alternative platforms is a high priority to prevent service disruption and revenue loss.
Open Air
Open Air Internet is a fixed wireless internet connection operating in the 5 GHZ wireless radio frequency (not to be confused with 5G cellular service). Open Air is a tiered service with speed offerings of 50 Mb/s -250 Mb/s and is data only. Customers transitioning from Fusion to Open Air can convert their POTS line to Digital Voice and are usually saving money in the process.
Hosted Services
MCN provides standard hosting packages including Web Hosting, Domain Hosting, Domain Registration, Email, and Digital Voice phone service. Some of these items are currently bundled with connectivity services and all can be purchased separately. Hosted services provide nearly as much net revenue as connectivity services but are flat in sales other than Digital Voice.
Digital Voice
Residential $20.00
Business $30.00
Open Air
Residential 50Mb/s $54.95 Residential Long Range 6Mb/s $50.00 Residential 100Mb/s $74.95 Residential Long Range 12Mb/s $70.00 Residential 250 Mb/s $139.95 Residential Long Range 18Mb/s $90.00 Business 50Mb/s $64.95 Residential Long Range 25Mb/s $110.00 Business 100Mb/s $84.95 Business Long Range 6Mb/s $60.00 Business 250 Mb/s $159.95 Business Long Range 12Mb/s $80.00 Extenders $5.00 Business Long Range 18Mb/s $100.00
Business Long Range 25Mb/s $120.00
10 Fax To Email $6.00
Toll Free $6.00
Guest Ext $10.00
Web Services
Domain Registration $19.95 (varies by TLD)
Domain Service $5.00
Web Hosting $5.00
MySQL Database $5.00
DNS Monthly Service $5.00
Email Storage Bundled Account Paid Account Paid Account Up to 250 MB Included Included $4.00
250 MB to 500 MB $1.00 Included $4.00
500 MB to 1 GB $2.00 Included $4.00
1 GB to 2 GB $3.50 $1.00 $5.00 total
2 GB to 5 GB $5.00 $2.50 $6.50 total
5 GB to 20 GB $8.95 $6.50 $10.50 total
20GB to 50GB $10.95 $8.50 $12.50 total
50GB to 80GB $12.95 $10.50 $14.50 total
80GB to 125GB $14.95 $12.50 $16.50 total
Customer Churn and Growth Rates
Service YTD
Churn
Previous Year Churn
DNS 3% 12%
Email 4% 0%
Fusion (DSL) 10% 11%
Open Air (Wireless) -2% -11%
VOIP -14% -11%
Customer trends reflect a clear divergence between legacy services and growth opportunities.
Fusion, MCN’s resold DSL product, shows consistent decline, with churn of 10–11% over both timeframes, reinforcing the urgency of transitioning customers to modern platforms before further erosion. Email services remain stable with only minor fluctuation, while DNS shows short-term growth but significant long-term decline, which may stem from service consolidation or changing customer behavior. In contrast, Open Air wireless and VOIP services have experienced net customer growth over the last one to two years, suggesting these product lines may represent scalable opportunities under City ownership. These trends support prioritizing investment in VOIP and wireless expansion while accelerating deprecation of Fusion. 11 Cybersecurity
MCN maintains firewalls at both its main office and its colocation facility, providing a strong perimeter defense for network traffic. Data is stored on multiple servers within the colocation environment, with built-in redundancy. A NetApp NAS device provides network-attached storage for daily operations and serves as a backup repository. These servers are firewalled, SSH key protected, and access is IP-restricted in accordance with best practices. While these safeguards offer meaningful protections, a full cybersecurity audit is recommended postacquisition to evaluate current vulnerabilities, enhance monitoring protocols, and ensure systems remain up to date.
Risk Management and Compliance
Vendor Continuity
It is assumed that all major vendors (e.g., Sonic, TPX) will allow the City to assume existing service agreements. However, formal confirmations should be secured during contract review.
Customer Credits
MCN’s 2024 audit identifies $55,092 in customer credits, which should be accounted for as part of the City’s transitional liability planning.
Service Transition
There is no anticipated service disruption during transfer, as equipment and infrastructure will remain at their current colocation facilities. IP space is actively in use, though a portion is available for expansion or reassignment under City control.
Insurance Risk Exposure
MCN currently maintains general liability insurance (Appendix D: Certificate of Insurance) and has also provided a copy of its professional liability policy, which includes cyber liability coverage (Appendix E: Professional Insurance). This coverage helps mitigate potential City exposure related to past network incidents, data breaches, or operational failures. However, to fully evaluate risk, the City should review both policies’ terms, limits, exclusions, and any active or prior claims. Despite the presence of cyber and professional liability coverage, it remains prudent for the City to include indemnification clauses in the purchase agreement to protect against liabilities arising from pre-acquisition events that may fall outside the scope of coverage.
Regulatory Agencies
The City must register as a service provider with the Universal Service Administrative Company (USAC) and establish new accounts for E-rate participation and other relevant Universal Service Fund programs. The City will also need to register with the FCC and maintain compliance with 911 obligations, number portability, CALEA, and other VoIP-specific regulations. 12 Equipment and Asset Inventory
As part of the acquisition, the City of Fort Bragg will assume ownership of a broad inventory of equipment that supports MCN’s broadband, VOIP, and hosted service operations. This includes fixed wireless infrastructure at regional access points, long-range outdoor radios, customer premises equipment, VOIP handsets and adapters, and high-performance hardware such as Palo Alto firewalls, NetApp storage systems, and SuperMicro virtualization servers housed at MCN’s Sacramento colocation facility. The inventory also includes essential office hardware—routers, switches, battery backup systems, provisioning tools, and structured cabling—as well as all office furniture, shelving, and workstation equipment needed for day-to-day operations. While this document summarizes key categories of equipment, it is not intended to be exhaustive. The assumption guiding this transition is that all equipment and materials currently used or stored by MCN will be transferred to the City, unless the Mendocino Unified School District (MUSD) provides a specific exclusion list identifying items to be retained.
Wireless Access Point Equipment
Location Key Equipment
MCN Office / Swithenbank CRS310, A5C, Wave AP, RB40
PFI Chestnut / Main St UB60, A5C, B24, BATT
Harbor Lite / Sports Club WS12, N45X2, UB60LR, BATT
Colombi’s Market / Redwood CCR, A5C, UB60LR, Wave AP
Mendo Litho / North Coast N5360, A5X, UB60LR, C5X
RCSC Senior Center CAB, WS12, UB60LR, Power Units
Bald Hill / Bruhel / Berger N5X20, B5C, LITHBATT, TP Mounts Open Air Inventory – Approximate Stock
Device Qty
C5X Radio 26
C5C 4
C5 4
A5X 6
B24 3
Wave LR 2
UB60-LR 5
LiteBeamACXR 1
WiFrost CPE 5
PBE M5 620 2
Wave AP 3
Wave AP Micro 4
Wave Nano 4
Wave Pico 1
Nano Beam 5AC 4
Lite Beam 5AC 4
RB4011 3
RB5011 3
Mikrotik MDU 5
Mikrotik MDU PRO 5
Nano Station 8
13 N5X16 (Antenna)3
N5X20 (Antenna) 16
N5X25 (Antenna) 12
Mimosa NID 14 J-Arm Small 20 J-Arm Medium 25 J-Arm Large 22 Open Air Long Range Equipment
Device Qty
airFiber 5X2
airFiber 5XHD2
ISO Station 5AC1
LiteAP GPS1
LiteBeam 5AC Gen24
NanoBeam 5AC 162
NanoBeam 5AC Gen2 24
NanoBeam M5 163
NanoBridge M51
NanoStation 5AC loco 12
NanoStation loco M51
NanoStation loco M9002
NanoStation M22
PowerBeam 5AC 4001
PowerBeam 5AC 5002
PowerBeam 5AC Gen2 10
PowerBeam 5AC ISO Gen23
PowerBeam M5 3001
PowerBeam M5 4006
Rocket 5AC Lite1
Rocket M55
Rocket M9002
Rocket Prism 5AC Gen21
RBD53iG-5HacD2HnD3
RBD52G-5HacD2HnD1
RB952Ui-5ac2nD 28
Netonix WS-61
Mikrotik Powerbox Pro1
Rocket Dish 2' (to bruhel)1
Rocket Dish 2' (to bald)1
Mikrotik Hex-S1
Netonix WS-12-250-DC1
Meanwell NDR-480-241
100AH AGM Battery2
Din fuse block1
Din breakers2
RF Ultradish TP-273
RF Elements Asym 30° Horn1
14 Ubiquiti Edgerouter-X SFP1
Tycon TP-DIN Voltage monitor1
Tycon SCPOE-2424-HP1
Ubiquiti 13dbi 5GHz Omni1
Colocation Facility Equipment
Device Qty
Palo Alto Edge Firewall1
Mikrotik Router Edge Device1
Cisco Switches2
Cisco Router1
PDU Strips4
KVM w/ Monitor & Keyboard1
NetApp Filer 20201
NetApp Filer 25521
NetApp Filer AFF2501
NetApp Cluster Switches2
SuperMicro 1U (VMWare)3
SuperMicro Admin Server1
Grandstream VOIP Inventory
Device Qty
GRP2636 16
GRP2634 17
GRP2616 19
WP822 17
GRP611 27
GRP621W7
GXP21308
GXP21702
GXP2200 EXT1
HT802/1 22
HT814 10
DP7505
DP7202
TP Link SW7
TP Link WiFi Adaptor2
Office Equipment
Item Qty 3-way Phone Splitters 25
Single Line Filters 142
Dual Line Filter1
TP-Link Travel Router3
TP-Link Switch7
Power Strip1
Cyber Power Battery1
15 Assorted Ethernet Cables 200
Ethernet Surface Jack 40
Office Furniture
Item Qty Description Condition
Computer Desk 12 Wood laminate, 5’
wide, mixed sizes
Good
Standing Desk
Mounts
8 Ergo Desktop
Electric Kangaroo
Elite
Good
Rolling Office Chair 13 Mixed brands and
condition
Fair-Good
Misc. Table Piece 5 Wood laminate,
mixed sizes
Good
Filing Cabinet 7 Wood laminate,
mixed sizes
Good
Bookshelf 5 Wood laminate,
mixed sizes
Good
Drafting Table 1 Wood laminate, table
top only, 8' long
Metro Shelving 7 Constructed shelving
units, mixed sizes
Appendices and Supporting Documentation
• Appendix A - MCN Audited Operating Net
• Appendix B - MCN Audited Net Position
• Appendix C - Fiscal Year 23-24 Audit Report
• Appendix D - Certificate of Insurance
• Appendix E - Professional Insurance
Appendix A - MCN Audited Operating Net
MCN Audited Operating Net (ex Pension)
Operating Net June 2024 June 2023 June 2022 June 2021 June 2020 June 2019 June 2018 Operating Revenue 2,153,148 2,187,053 2,309,537 2,326,647 2,223,364 2,221,115 2,131,734 Total Revenue 2,153,148 2,187,053 2,309,537 2,326,647 2,223,364 2,221,115 2,131,734 Salary/Benefits (ex Pension)* 830,020 752,024 857,932 837,753 802,654 784,370 720,667 Supplies/Materials 128,520 104,946 96,195 78,909 107,186 65,690 53,954 Professional Services 1,294,820 1,224,747 1,324,755 1,410,855 1,327,318 1,288,884 1,260,011 Depreciation 39,328 39,328 25,730 25,730 7,719 21,242 21,243 Total Expenditures 2,292,688 2,121,045 2,304,612 2,353,247 2,244,877 2,160,186 2,055,875 Total Operating Income/(Loss) (139,540) 66,008 4,925 (26,600) (21,513) 60,929 75,859 Non-Operating Net
Interest Income 2,990 (1,246) 271 532 2,817 2,689 1,532 Transfers in 9,019 8,866 9,094 9,194 8,365 8,729 8,753
Net donation to district (40,000) (40,000) (40,000) (40,000) (40,000) (40,000) (40,000) Total Non-Operating Rev/(Exp) (27,991) (32,380) (30,635) (30,274) (28,818) (28,582) (29,715) Operating Net (ex Pension) - Profit/(Loss) (167,531) 33,628 (25,710) (56,874) (50,331) 32,347 46,144 Balance Sheet Net Position (ex Pension) (167,531) 33,628 (25,710) (56,874) (50,331) 32,347 46,144 *Salary/Benefit Adjustmenf for Pension 17,146 (87,504) 68,646 (93,850) (93,268) (45,237) (26,968) Appendix B - MCN Audited Net Position
Net Position - ex Pension June 2024 June 2023 June 2022 June 2021 June 2020 June 2019 June 2018 Current Assets 151,177 188,377 197,914 232,847 306,371 347,880 303,709 Non-Current Assets 81,963 121,291 54,032 79,762 15,439 23,158 44,400 Total Assets 233,140 309,668 251,946 312,609 321,810 371,038 348,109 Current Liabilities 109,287 33,765 75,220 60,083 43,520 47,329 43,207 Non-Current Liabilities 93,273 77,792 12,243 62,333 31,223 26,311 39,851 Total Liabilites 202,560 111,557 87,463 122,416 74,743 73,640 83,058 excl Pension Costs
Net Position (ex Pension) 30,580 198,111 164,483 190,193 247,067 297,398 265,051 Change in Net Position (ex Pension) (167,531) 33,628 (25,710) (56,874) (50,331) 32,347 46,144 Components of Net Position (ex Pension)
Net Investment Capital Assets 17,877 39,438 23,908 21,097 15,439 10,304 19,346 Unrestricted 12,703 158,673 140,575 169,096 231,628 287,094 245,705 Appendix C - Fiscal Year 23-24 Audit Report
MENDOCINO COMMUNITY NETWORK
(A PROPRIETARY FUND OF THE
MENDOCINO UNIFIED SCHOOL DISTRICT)
MENDOCINO, CALIFORNIA
AUDIT REPORT
JUNE 30, 2024
MENDOCINO COMMUNITY NETWORK
TABLE OF CONTENTS
JUNE 30, 2024
FINANCIAL SECTION
Report on the Audit of the Financial Statements................................................................................................................1 Basic Financial Statements
Statement of Net Position.............................................................................................................................................4 Statement of Revenues, Expenses, and Changes in Net Position..........................................................................5 Statement of Cash Flows..............................................................................................................................................6 Notes to Financial Statements..............................................................................................................................................7
OTHER INFORMATION
Organization/Board of Education/Administration .............................................................................................................18 OTHER INDEPENDENT AUDITORS’ REPORT
Report on Internal Control Over Financial Reporting and on Compliance and Other Matters Based on an Audit of Financial Statements Performed in Accordance with Government Auditing Standards................19
FINANCIAL SECTION
O: 619-270-8222
F: 619-260-9085
christywhite.com
348 Olive Street
San Diego, CA
92103
Certified Public Accountants serving
K-12 School Districts and Charter
Schools throughout California
1 REPORT ON THE AUDIT OF THE FINANCIAL STATEMENTS
Independent Auditors’ Report
Governing Board
Mendocino Community Network
Mendocino Unified School District
Mendocino, California
Report on the Audit of the Financial Statements
Opinion
We have audited the accompanying Financial Statements of the Mendocino Community Network, a Proprietary Fund within the Mendocino Unified School District, for the year ended June 30, 2024, and the related notes to the financial statements as listed in the table of contents.
In our opinion, the financial statements referred to above present fairly, in all material respects, the respective financial position of the Mendocino Community Network, as of June 30, 2024, and the respective changes in financial position and cash flows for the year then ended in accordance with accounting principles generally accepted in the United States of America.
Basis for Opinion
We conducted our audit in accordance with auditing standards generally accepted in the United States of America and the standards applicable to financial audits contained in Government Auditing Standards, issued by the Comptroller General of the United States. Our responsibilities under those standards are further described in the Auditors’ Responsibilities for the Audit of the Financial Statements section of our report. We are required to be independent of the Mendocino Unified School District and to meet our other ethical responsibilities, in accordance with the relevant ethical requirements relating to our audit. We believe that the audit evidence we have obtained is sufficient and appropriate to provide a basis for our audit opinion.
Responsibilities of Management for the Financial Statements Management is responsible for the preparation and fair presentation of the financial statements in accordance with accounting principles generally accepted in the United States of America, and for the design, implementation, and maintenance of internal control relevant to the preparation and fair presentation of financial statements that are free from material misstatement, whether due to fraud or error. 2 Auditor’s Responsibilities for the Audit of the Financial Statements Our objectives are to obtain reasonable assurance about whether the financial statements as a whole are free from material misstatement, whether due to fraud or error, and to issue an auditor’s report that includes our opinion.
Reasonable assurance is a high level of assurance but is not absolute assurance and therefore is not a guarantee that an audit conducted in accordance with generally accepted auditing standards and Government Auditing Standards will always detect a material misstatement when it exists. The risk of not detecting a material misstatement resulting from fraud is higher than for one resulting from error, as fraud may involve collusion, forgery, intentional omissions, misrepresentations, or the override of internal control. Misstatements are considered material if there is a substantial likelihood that, individually or in the aggregate, they would influence the judgement made by a reasonable user of the financial statements.
In performing an audit in accordance with generally accepted auditing standards and Government Auditing Standards, we:
• Exercise professional judgement and maintain professional skepticism throughout the audit. • Identify and assess the risks of material misstatement of the financial statements, whether due to fraud or error, and design and perform audit procedures responsive to those risks. Such procedures include examining, on a test basis, evidence regarding the amounts and disclosures in the financial statements. • Obtain an understanding of internal control relevant to the audit in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of the Mendocino Unified School District’s internal control. Accordingly, no such opinion is expressed. • Evaluate the appropriateness of accounting policies used and the reasonableness of significant accounting estimates made by management, as well as evaluate the overall presentation of the financial statements.
We are required to communicate with those charged with governance regarding, among other matters, the planned scope and timing of the audit, significant audit findings, and certain internal control-related matters that we identified during the audit.
Report on Summarized Comparative Information
We have previously audited the Mendocino Community Network's 2022-23 financial statements, and we expressed an unmodified audit opinion on those audited financial statements in our report dated February 29, 2024. In our opinion, the summarized comparative information presented herein as of and for the year ended June 30, 2023, is consistent, in all material respects, with the audited financial statements from which it has been derived.
Other Information
Management is responsible for the other information included in the annual report. The other information comprises the Organization/Board of Education/Administration but does not include the basic financial statements and our auditor’s report thereon. Our opinions on the basic financial statements do not cover the other information, and we do not express an opinion or any form of assurance thereon.
In connection with our audit of the basic financial statements, our responsibility is to read the other information and consider whether a material inconsistency exists between the other information and the basic financial statements, or the other information otherwise appears to be materially misstated. If, based on the work performed, we conclude that an uncorrected material misstatement of the other information exists, we are required to describe it in our report. 3 Other Reporting Required by Government Auditing Standards In accordance with Government Auditing Standards, we have also issued our report dated March 26, 2025 on our consideration of the Mendocino Unified School District's internal control over financial reporting and on our tests of its compliance with certain provisions of laws, regulations, contracts, and grant agreements and other matters specific to the Mendocino Community Network. The purpose of that report is solely to describe the scope of our testing of internal control over financial reporting and compliance and the results of that testing, and not to provide an opinion on the effectiveness of the Mendocino Unified School District internal control over financial reporting or on compliance. That report is an integral part of an audit performed in accordance with Government Auditing Standards in considering Mendocino Unified School District’s internal control over financial reporting and compliance specific to the Mendocino Community Network.
San Diego, California
March 26, 2025
The accompanying notes are an integral part of these financial statements. 4 MENDOCINO COMMUNITY NETWORK
STATEMENT OF NET POSITION
JUNE 30, 2024
(WITH COMPARATIVE TOTALS AS OF JUNE 30, 2023)
June 30, 2024 June 30, 2023
ASSETS
Current assets
Cash and investments $ 135,481 $ 165,469
Accounts receivable 11,977 18,414
Prepaid expenses 3,719 4,494
Total current assets 151,177 188,377
Non-current assets
Capital assets, net of accumulated depreciation 81,963 121,291 Total non-current assets 81,963 121,291
Total Assets 233,140 309,668
DEFERRED OUTFLOWS OF RESOURCES
Deferred outflows related to pensions 331,604 331,674
Total Deferred Outflows of Resources 331,604 331,674
LIABILITIES
Current liabilities
Accrued liabilities 34,740 2,289
Unearned revenue 55,092 13,709
Financed purchases, current portion 19,455 17,767
Total current liabilities 109,287 33,765
Non-current liabilities
Net pension liability 1,114,437 1,135,712
Financed purchases, non-current portion 44,631 64,086
Compensated absences 48,642 13,706
Total non-current liabilities 1,207,710 1,213,504
Total Liabilities 1,316,997 1,247,269
DEFERRED INFLOWS OF RESOURCES
Deferred inflows related to pensions 125,811 121,752
Total Deferred Inflows of Resources 125,811 121,752
NET POSITION
Net investment in capital assets 17,877 39,438
Unrestricted (895,941) (767,117)
Total Net Position $ (878,064) $ (727,679)
The accompanying notes are an integral part of these financial statements. 5 MENDOCINO COMMUNITY NETWORK
STATEMENT OF REVENUES, EXPENSES, AND CHANGES IN NET POSITION FOR THE YEAR ENDED JUNE 30, 2024
(WITH COMPARATIVE TOTALS FOR THE YEAR ENDED JUNE 30, 2023) June 30, 2024 June 30, 2023
OPERATING REVENUE
Charges for services $ 2,153,148 $ 2,187,053
Total operating revenues 2,153,148 2,187,053
OPERATING EXPENSE
Salaries and benefits 812,874 839,528
Supplies and materials 128,520 104,946
Professional services 1,294,820 1,224,747
Depreciation 39,328 39,328
Total operating expenses 2,275,542 2,208,549
Operating income/(loss) (122,394) (21,496)
NON-OPERATING REVENUES/(EXPENSES)
Interest income 2,990 (1,246)
Transfers in from District 9,019 8,866
Net donation to District (40,000) (40,000)
Total non-operating revenues/(expenses) (27,991) (32,380) CHANGE IN NET POSITION (150,385) (53,876)
Net Position - Beginning (727,679) (673,803)
Net Position - Ending $ (878,064) $ (727,679)
The accompanying notes are an integral part of these financial statements. 6 MENDOCINO COMMUNITY NETWORK
STATEMENT OF CASH FLOWS
FOR THE YEAR ENDED JUNE 30, 2024
(WITH COMPARATIVE TOTALS FOR THE YEAR ENDED JUNE 30, 2023) June 30, 2024 June 30, 2023
Cash flows from operating activities
Cash received from user charges $ 2,200,968 $ 2,183,583 Cash payments for payroll, insurance, and operating costs (2,185,198) (2,113,846) Net cash provided by (used for) operating activities 15,770 69,737 Cash flows from non-capital financing activities
Interfund transfers in (out) (30,981) (31,134)
Net cash provided by (used for) non-capital financing activities (30,981) (31,134) Cash flows from capital and related financing activities Financed purchase payments (17,767) (54,858)
Net cash provided by (used for) in capital and related financing activities (17,767) (54,858) Cash flows from investing activities
Interest received 2,990 (1,246)
Net cash provided by (used for) investing activities 2,990 (1,246) NET INCREASE (DECREASE) IN CASH AND CASH EQUIVALENTS (29,988) (17,501)
CASH AND CASH EQUIVALENTS
Beginning of year 165,469 182,970
End of year $ 135,481 $ 165,469
Reconciliation of operating income (loss) to cash
provided by (used for) operating activities
Operating income (loss) $ (122,394) $ (21,496)
Adjustments to reconcile operating income (loss) to net cash provided by (used in) operating activities:
Depreciation 39,328 39,328
Changes in assets, liabilities, deferred outflows, deferred inflows:
(Increase) decrease in accounts receivable 6,437 (3,470) (Increase) decrease in prepaid expenses 775 (4,494)
(Increase) decrease in deferred outflows of resources 70 (137,548) Increase (decrease) in accrued liabilities 32,451 (26,359) Increase (decrease) in unearned revenue 41,383 (2,739)
Increase (decrease) in compensated absences 34,936 1,463 Increase (decrease) in net pension liability (21,275) 433,063 Increase (decrease) in deferred inflows of resources 4,059 (208,011) Net cash provided by (used for) operating activities $ 15,770 $ 69,737 7 MENDOCINO COMMUNITY NETWORK
NOTES TO FINANCIAL STATEMENTS
JUNE 30, 2024
NOTE 1 – SUMMARY OF SIGNIFICANT ACCOUNTING POLICIES
A. Financial Reporting Entity
The Mendocino Community Network (MCN) was established by the Mendocino Unified School District (District) in 1994 to provide internet services to the school district and not-for-profit organizations within the community.
MCN has developed a solid customer base of analog dialup subscribers, DSL, web hosting, and local and longdistance phone service in the Mendocino and Fort Bragg areas. MCN is a proprietary fund of the District. The financial statements present only MCN and do not purport to, and do not, present fairly the financial position of the District as a whole.
B. Basis of Accounting – Measurement Focus
These statements are prepared on the accrual basis of accounting. Under this method, revenues from services and interest are recognized when earned and expenses are recognized when goods or services have been rendered.
The accounts of MCN are organized on the basis of funds, each of which is considered a separate accounting entity. MCN only maintains one fund, the Mendocino Community Network Fund. This fund is a proprietary fund type, which is a fund that is used to account for activities similar to those found in the private sector, where determination of net income is necessary or useful to sound financial administration.
C. Assets, Deferred Outflows of Resources, Liabilities, Deferred Inflows of Resources, and Net Position Cash and Cash Equivalents
MCN’s cash and cash equivalents consist of cash on hand, demand deposits and short-term investments with original maturities of three months or less from the date of acquisition. Cash equivalents also include cash with county treasury balances for purposes of the statement of cash flows.
Receivables
All receivables are reported at their gross value and, where appropriate, are reduced by the estimated portion that is expected to be uncollectible. Management considers all accounts receivable outstanding less than 60 days to be fully collectable. At June 30, 2024 and 2023 all accounts over 60 days old are excluded from the balance of accounts receivable.
Capital Assets
Capital assets are capitalized at cost (or estimated historical cost) and updated for additions and retirements during the year. Donated fixed assets are recorded at their acquisition value as of the date received. MCN maintains a capitalization threshold of $5,000. MCN does not own any infrastructure as defined in GASB Statement No. 34. Improvements are capitalized; the costs of normal maintenance and repairs that do not add to the value of the asset or materially extend an asset’s life are not capitalized. All reported capital assets, except for land and construction in progress, are depreciated. Improvements are depreciated over the remaining useful lives of the related capital assets. Depreciation is computed using the straight-line method over 3 to 20 years depending on asset type:
Compensated Absences
Accumulated unpaid employee vacation benefits are accrued as a liability as the benefits are earned.
Accumulated sick leave benefits are not recognized as liabilities of MCN. MCN’s policy is to record sick leave as an operating expense in the period taken because such benefits do not vest, nor is payment probable; however, unused sick leave is added to the creditable service period for calculation of retirement benefits when the employee retires.
8 MENDOCINO COMMUNITY NETWORK
NOTES TO FINANCIAL STATEMENTS, continued
JUNE 30, 2024
NOTE 1 – SUMMARY OF SIGNIFICANT ACCOUNTING POLICIES (continued) C. Assets, Deferred Outflows of Resources, Liabilities, Deferred Inflows of Resources, and Net Position, (continued)
Deferred Outflows/Deferred Inflows of Resources
In addition to assets, MCN will sometimes report a separate section for deferred outflows of resources. This separate financial statement element, deferred outflows of resources, represents a consumption of net position that applies to a future period and so will not be recognized as an outflow of resources (expense/expenditure) until then.
In addition to liabilities, MCN will sometimes report a separate section for deferred inflows of resources. This separate financial statement element, deferred inflows of resources, represents an acquisition of net position that applies to a future period and so will not be recognized as an inflow of resources (revenue) until that time.
Pensions
For purposes of measuring the net pension liability, deferred outflows of resources and deferred inflows of resources related to pensions, and pension expense, information about the fiduciary net position of the defined benefit pension plan (the Plan) of the California Public Employees’ Retirement System (CalPERS) and additions to/deductions from the Plan’s fiduciary net position have been determined on the same basis as they are reported by the Plan. For this purpose, benefit payments (including refunds of employee contributions) are recognized when due and payable in accordance with the benefit terms. Investments are reported at fair value.
Net Position
Net Position equals assets and deferred outflows of resources minus liabilities and deferred inflows of resources.
Net investment in capital assets consists of capital assets, net of accumulated depreciation, reduced by the outstanding balances of any borrowings used for the acquisition, construction or improvement of those assets.
The net position should be reported as restricted when constraints placed on its use are either externally imposed by creditors (such as through debt covenants), grantors, contributors, or laws or regulations of other governments or imposed by law through constitutional provisions or enabling legislation.
D. Estimates
The preparation of the financial statements in conformity with accounting principles generally accepted in the United States of America requires management to make estimates and assumptions that affect the amounts reported in the financial statements and accompanying notes. Actual results may differ from those estimates.
E. Income Taxes
MCN is a political subdivision of the State of California and is not liable for Federal and State income taxes. 9 MENDOCINO COMMUNITY NETWORK
NOTES TO FINANCIAL STATEMENTS, continued
JUNE 30, 2024
NOTE 1 – SUMMARY OF SIGNIFICANT ACCOUNTING POLICIES (continued) F. New Accounting Pronouncements
GASB Statement No. 99 – In April 2022, GASB issued Statement No. 99, Omnibus 2022. The objectives of this statement are to enhance comparability in accounting and financial reporting and to improve the consistency of authoritative literature by addressing (1) practice issues that have been identified during implementation and application of certain GASB Statements and (2) accounting and financial reporting for financial guarantees. The statement addresses various practice issues, including: (a) clarification of provisions in Statement No. 87, Leases, as amended, related to the determination of the lease term, classification of a lease as a short-term lease, recognition and measurement of a lease liability and a lease asset, and identification of lease incentives, (b) disclosures related to nonmonetary transactions; clarification of provisions in Statement No. 34, Basic Financial Statements—and Management’s Discussion and Analysis—for State and Local Governments, as amended, related to the focus of the government-wide financial statements, (c) terminology updates related to certain provisions of Statement No. 63, Financial Reporting of Deferred Outflows of Resources, Deferred Inflows of Resources, and Net Position, and (d) terminology used in Statement 53 to refer to resource flows statements. A portion of this statement was effective upon issuance, while the remaining portions of this statement were effective for periods beginning after June 15, 2022 and for periods beginning after June 15, 2023. MCN has fully implemented this Statement as of June 30, 2024.
GASB Statement No. 100 – In June 2022, GASB issued Statement No. 100, Accounting Changes and Error Corrections – an amendment of GASB Statement No. 62. The primary objective of this statement is to enhance accounting and financial reporting requirements for accounting changes and error corrections to provide more understandable, reliable, relevant, consistent, and comparable information for making decisions or assessing accountability. This statement is effective for periods beginning after June 15, 2023. MCN has fully implemented this Statement as of June 30, 2024.
GASB Statement No. 101 – In June 2022, GASB issued Statement No. 101, Compensated Absences. The objective of this statement is to better meet the information needs of financial statement users by updating the recognition and measurement guidance for compensated absences. That objective is achieved by aligning the recognition and measurement guidance under a unified model and by amending certain previously required disclosures. This statement is effective for periods beginning after December 15, 2023. MCN has not yet determined the impact on the financial statements.
GASB Statement No. 102 – In December 2023, GASB issued Statement No. 102, Certain Risk Disclosures. This Statement requires a government to assess whether a concentration or constraint makes the primary government reporting unit or other reporting units that report a liability for revenue debt vulnerable to the risk of a substantial impact. Additionally, this Statement requires a government to assess whether an event or events associated with a concentration or constraint that could cause the substantial impact have occurred, have begun to occur, or are more likely than not to begin to occur within 12 months of the date the financial statements are issued. This statement is effective for periods beginning after June 15, 2024. The MCN has not yet determined the impact on the financial statements.
GASB Statement No. 103 – In April 2024, GASB issued Statement No. 103, Financial Reporting Model Improvements. The objective of this Statement is to improve key components of the financial reporting model to enhance its effectiveness in providing information that is essential for decision making and assessing a government’s accountability. This Statement also addresses certain application issues. The statement is effective for periods beginning after June 15, 2025. The MCN has not yet determined the impact on the financial statements.
10 MENDOCINO COMMUNITY NETWORK
NOTES TO FINANCIAL STATEMENTS, continued
JUNE 30, 2024
NOTE 2 – CASH AND INVESTMENTS
Cash and investments consisted of the following:
Custodial Credit Risk
Custodial credit risk is the risk that in the event of a bank failure, MCN’s deposits may not be returned to it. MCN does not have a policy for custodial credit risk for deposits. However, the California Government Code requires that a financial institution secure deposits made by state or local governmental units by pledging securities in an undivided collateral pool held by a depository regulated under state law. The market value of the pledged securities in the collateral pool must equal at least 110 percent of the total amount deposited by the public agencies. California law also allows financial institutions to secure public deposits by pledging first trust deed mortgage notes having a value of 150 percent of the secured public deposits and letters of credit issued by the Federal Home Loan Bank of San Francisco having a value of 105 percent of the secured deposits. As of June 30, 2024, MCN’s bank balance was not exposed to custodial credit risk.
Interest Rate Risk
Interest rate risk is the risk that changes in market interest rates will adversely affect the fair value of an investment.
Generally, the longer the maturity of an investment, the greater the sensitivity of its fair value to changes in market interest rates. MCN manages its exposure to interest rate risk by investing in the County Treasury. MCN maintains a pooled investment with the County Treasury with an amortized cost of $69,151 and a fair value of approximately $68,986 at June 30, 2024. The average weighted maturity for this pool is 485 days.
June 30, 2024 June 30, 2023
Investment in county treasury $ 69,151 $ 73,535
Fair value adjustment - (1,340)
Cash on hand and in banks 51,330 78,274
Cash in revolving fund 15,000 15,000
Total cash and investments $ 135,481 $ 165,469
11 MENDOCINO COMMUNITY NETWORK
NOTES TO FINANCIAL STATEMENTS, continued
JUNE 30, 2024
NOTE 2 – CASH AND INVESTMENTS (continued)
Fair Value
MCN categorizes the fair value measurements of its investments based on the hierarchy established by generally accepted accounting principles. The fair value hierarchy is based on the valuation inputs used to measure an asset's fair value. The following provides a summary of the hierarchy used to measure fair value:
Level 1 - Quoted prices (unadjusted) in active markets for identical assets.
Level 2 - Observable inputs other than Level 1 prices such as quoted prices for similar assets in active markets, quoted prices for identical or similar assets in markets that are not active, or other inputs that are observable, either directly or indirectly.
Level 3 - Unobservable inputs should be developed using the best information available under the circumstances, which might include MCN’s own data. MCN should adjust that data if reasonable available information indicates that other market participants would use different data or certain circumstances specific to MCN are not available to other market participants.
Uncategorized - Investments in the Mendocino County Treasury Investment Pool are not measured using the input levels above because MCN’s transactions are based on a stable net asset value per share. All contributions and redemptions are transacted at $1.00 net asset value per share.
MCN’s fair value measurements at June 30, 2024 were as follows:
NOTE 3 – ACCOUNTS RECEIVABLE
Accounts receivable at June 30, 2024 and 2023 consisted of the following:
Uncategorized
Investment in county treasury $ 68,986
Total $ 68,986
June 30, 2024 June 30, 2023
Fees for service $ 11,977 $ 18,414
Total $ 11,977 $ 18,414
12 MENDOCINO COMMUNITY NETWORK
NOTES TO FINANCIAL STATEMENTS, continued
JUNE 30, 2024
NOTE 4 – CAPITAL ASSETS
Capital asset activity for the year ended June 30, 2024 was as follows:
NOTE 5 – LONG-TERM DEBT
A schedule of changes in long-term debt for the year ended June 30, 2024 consisted of the following:
Financed purchase
Mendocino Community Network entered into an agreement for networking and storage devices which provides for title to pass upon expiration of the agreement period. Future minimum payments at June 30, 2024 were as follows:
Compensated absences
Total unpaid employee compensated absences as of June 30, 2024 amounted to $48,642.
Net pension liability
MCN’s beginning net pension liability was $1,135,712 and decreased by $21,275 during the year ended June 30, 2024. The ending net pension liability at June 30, 2024 was $1,114,437. See Note 8 for additional information regarding the net pension liability.
Balance Balance
July 01, 2023 Additions Deletions June 30, 2024
Capital assets being depreciated
Buildings & improvements $ 66,234 $ - $ - $ 66,234
Furniture & equipment 341,930 - - 341,930
Total Capital Assets Being Depreciated 408,164 - - 408,164 Less Accumulated Depreciation
Buildings & improvements 66,234 - - 66,234
Furniture & equipment 220,639 39,328 - 259,967
Total Accumulated Depreciation 286,873 39,328 - 326,201 Capital Assets, net $ 121,291 $ (39,328) $ - $ 81,963
Balance Balance Balance Due
July 01, 2023 Additions Deductions June 30, 2024 In One Year Financed purchases $ 81,853 $ - $ 17,767 $ 64,086 $ 19,455 Compensated absences 13,706 34,936 - 48,642 -
Net pension liability 1,135,712 - 21,275 1,114,437 -
Total $ 1,231,271 $ 34,936 $ 39,042 $ 1,227,165 $ 19,455 Year Ended June 30, Payment
2025 $ 25,543
2026 25,543
2027 25,543
Total minimum payments 76,629
Less amount representing interest (12,543)
Present value of minimum payments $ 64,086
13 MENDOCINO COMMUNITY NETWORK
NOTES TO FINANCIAL STATEMENTS, continued
JUNE 30, 2024
NOTE 6 – UNEARNED REVENUE
Unearned revenue in the amount of $55,092 and $13,709 as of June 30, 2024 and 2023, respectively, consists of prepayments of service fees collected in advance.
NOTE 7 – DONATION TO THE DISTRICT/INTERFUND TRANSFERS
MCN made the following donations to the Mendocino Unified School District’s governmental operations:
Mendocino Unified School District transferred the following amounts from other District Funds to MCN for telephone services:
NOTE 8 – PENSION PLANS
Qualified employees are covered under multiple-employer contributory retirement plans maintained by agencies of the State of California. Classified employees are members of the California Public Employees' Retirement System (CalPERS). MCN reported its proportionate share of the net pension liabilities, pension expense, deferred outflow of resources, and deferred inflow of resources as follows:
June 30, 2024 June 30, 2023
Contribution to the District's General Fund $ 40,000 $ 40,000 Total $ 40,000 $ 40,000
June 30, 2024 June 30, 2023
Transfer in from District $ 9,019 $ 8,866
Total $ 9,019 $ 8,866
Net pension
liability
Deferred
outflows related
to pensions
Deferred inflows
related to
pensions
Pension
expense
CalPERS $ 1,114,437 $ 331,604 $ 125,811 $ 110,293
Total $ 1,114,437 $ 331,604 $ 125,811 $ 110,293
14 MENDOCINO COMMUNITY NETWORK
NOTES TO FINANCIAL STATEMENTS, continued
JUNE 30, 2024
NOTE 8 – PENSION PLANS (continued)
California Public Employees’ Retirement System (CalPERS) Plan Description
MCN contributes to the School Employer Pool under the California Public Employees' Retirement System (CalPERS); a cost-sharing multiple-employer public employee retirement system defined benefit pension plan administered by CalPERS. The plan provides retirement and disability benefits, annual cost-of-living adjustments, and death benefits to plan members and beneficiaries. Benefit provisions are established by state statutes, as legislatively amended, within the Public Employees' Retirement Laws. CalPERS issues a separate comprehensive annual financial report that includes financial statements and required supplementary information. Copies of the CalPERS annual financial report may be obtained from the CalPERS Executive Office, 400 P Street, Sacramento, CA 95811.
Benefits Provided
The benefits for the defined benefit plan are based on members’ years of service, age, final compensation, and benefit formula. Benefits are provided for disability, death, and survivors of eligible members or beneficiaries. Members become fully vested in their retirement benefits earned to date after five years of credited service.
Contributions
Active plan members who entered into the plan prior to January 1, 2013, are required to contribute 7.0% of their salary. The California Public Employees’ Pension Reform Act (PEPRA) specifies that new members entering into the plan on or after January 1, 2013, shall pay the higher of fifty percent of normal costs or 7.0% of their salary.
Additionally, for new members entering the plan on or after January 1, 2013, the employer is prohibited from paying any of the employee contribution to CalPERS unless the employer payment of the member’s contribution is specified in an employment agreement or collective bargaining agreement that expires after January 1, 2013.
MCN is required to contribute an actuarially determined rate. The actuarial methods and assumptions used for determining the rate are those adopted by the CalPERS Board of Administration. The required employer contribution rate for fiscal year 2024 was 26.68% of annual payroll. Contributions to the plan from MCN were $127,439 for the year ended June 30, 2024.
Pension Liabilities, Pension Expense, and Deferred Outflows of Resources and Deferred Inflows of Resources Related to Pensions
At June 30, 2024, MCN reported a liability of $1,114,437 for its proportionate share of the net pension liability. The net pension liability was measured as of June 30, 2023, and the total pension liability used to calculate the net pension liability was determined by applying update procedures to an actuarial valuation as of June 30, 2022 and rolling forward the total pension liability to June 30, 2023. The MCN’s proportion of the net pension liability was based on a projection of the MCN’s long-term share of contributions to the pension plan relative to the projected contributions of all participating school districts, actuarially determined. At June 30, 2023, the MCN’s proportion was 0.003 percent, which did not change from its proportion measured as of June 30, 2022. 15 MENDOCINO COMMUNITY NETWORK
NOTES TO FINANCIAL STATEMENTS, continued
JUNE 30, 2024
NOTE 8 – PENSION PLANS (continued)
California Public Employees’ Retirement System (CalPERS) (continued) Pension Liabilities, Pension Expense, and Deferred Outflows of Resources and Deferred Inflows of Resources Related to Pensions (continued)
For the year ended June 30, 2024, MCN recognized pension expense of $110,293. At June 30, 2024, MCN reported deferred outflows of resources and deferred inflows of resources related to pensions from the following sources:
The $127,439 reported as deferred outflows of resources related to pensions resulting from MCN contributions subsequent to the measurement date will be recognized as a reduction of the net pension liability in the year ended June 30, 2025. Other amounts reported as deferred outflows of resources and deferred inflows of resources related to pensions will be recognized in pension expense as follows:
Actuarial Assumptions
The total pension liability was determined by applying update procedures to an actuarial valuation as of June 30, 2022, and rolling forward the total pension liability to June 30, 2023 using the following actuarial assumptions, applied to all periods included in the measurement:
Inflation 2.30%
Discount Rate 6.90%
Salary Increases Varies by Entry Age and Service
CalPERS uses custom mortality tables to best fit the patterns of mortality among its members. These custom tables are derived using CalPERS’ membership data for all funds. The table includes 15 years of mortality improvements using the Society of Actuaries Scale 80% of scale MP 2020.
Deferred Outflows Deferred Inflows
of Resources of Resources
Differences between projected and
actual earnings on plan investments $ 111,151 $ -
Differences between expected and
actual experience 37,975 15,982
Changes in assumptions 47,940 -
Changes in proportion and differences
between MCN contributions and
proportionate share of contributions 7,099 109,829
MCN contributions subsequent
to the measurement date 127,439 -
$ 331,604 $ 125,811
Deferred Outflows Deferred Inflows
Year Ended June 30, of Resources of Resources
2025 $ 62,487 $ 31,606
2026 50,921 17,332
2027 85,434 8,981
2028 5,323 67,892
$ 204,165 $ 125,811
16 MENDOCINO COMMUNITY NETWORK
NOTES TO FINANCIAL STATEMENTS, continued
JUNE 30, 2024
NOTE 8 – PENSION PLANS (continued)
California Public Employees’ Retirement System (CalPERS) (continued) Actuarial Assumptions (continued)
The actuarial assumptions used in the June 30, 2022, valuation were based on the results of an actuarial experience study for the period from 2000 through 2019.
The long-term expected rate of return on pension plan investments was determined using a building block method in which best estimate ranges of expected future real rates of return (expected returns, net of pension plan investment expense and inflation) are developed for each major asset class. In determining the long-term expected rate of return, both short-term and long-term market return expectations as well as the expected pension fund cash flows were taken into account. Such cash flows were developed assuming that both members and employers will make their required contributions on time and as scheduled in all future years. Using historical returns of all the funds’ asset classes, expected compound (geometric) returns were calculated over the short-term (first 10 years) and the longterm (11+ years) using a building block approach. Using the expected nominal returns for both short-term and longterm, the present value of benefits was calculated for each fund. The expected rate of return was set by calculating the single equivalent expected return that arrived at the same present value of benefits for cash flows as the one calculated using both short-term and long-term returns. The expected rate of return was then set equivalent to the single equivalent rate calculated above and adjusted to account for assumed administrative expenses.
The table below reflects long-term expected real rate of return by asset class. The rate of return was calculated using the capital market assumptions applied to determine the discount rate and asset allocation. These geometric rates of return are net of administrative expenses.
Asset Class
Assumed Asset
Allocation
Real Return
Years 1 – 10*
Global Equity – cap-weighted 30.0% 4.54%
Global Equity – non-cap-weighted 12.0% 3.84%
Private Equity 13.0% 7.28%
Treasury 5.0% 0.27%
Mortgage-backed securities 5.0% 0.50%
Investment grade corporates 10.0% 1.56%
High yield 5.0% 2.27%
Emerging market debt 5.0% 2.48%
Private debt 5.0% 3.57%
Real assets 15.0% 3.21%
Leverage (5.0)% (0.59)%
100.0%
*An expected inflation of 2.30% used for this period. Figures are based on the 2021-22 CalPERS Asset Liability Management Study
Discount Rate
The discount rate used to measure the total pension liability was 6.90 percent. A projection of the expected benefit payments and contributions was performed to determine if assets would run out. The test revealed the assets would not run out. Therefore, the long-term expected rate of return on pension plan investments was applied to all periods of projected benefit payments to determine the total pension liability for the Schools Pool. The results of the crossover testing for the Schools Pool are presented in a detailed report that can be obtained at CalPERS’ website. 17 MENDOCINO COMMUNITY NETWORK
NOTES TO FINANCIAL STATEMENTS, continued
JUNE 30, 2024
NOTE 8 – PENSION PLANS (continued)
California Public Employees’ Retirement System (CalPERS) (continued) Sensitivity of MCN’s Proportionate Share of the Net Pension Liability to Changes in the Discount Rate The following presents MCN’s proportionate share of the net pension liability calculated using the discount rate of
6.90 percent, as well as what the MCN’s proportionate share of the net pension liability would be if it were calculated using a discount rate that is 1-percentage-point lower (5.90 percent) or 1-percentage-point higher (7.90 percent) than the current rate:
Pension Plan Fiduciary Net Position
Detailed information about the pension plan’s fiduciary net position is available in the separately issued CalPERS financial report.
NOTE 9 – CONTINGENT LIABILITIES AND SUBSEQUENT EVENTS
In November 2024, Mendocino Unified School District accepted a proposal from the City of Fort Bragg to purchase MCN for $500,000, to be paid over ten years. Under the proposal, the City of Fort Bragg has stated it “would continue to service MCN customers, including those residing outside city limits, maintaining the same high-quality service MCN customers have come to rely on. Additionally, all current MCN staff members would become the City of Fort Bragg employees, ensuring continuity in operations and customer support, pending approval by the Fort Bragg City Council.
The anticipated closing date of the sale is June 30, 2025.
There are no known material contingent liabilities or additional significant subsequent events relating to the Mendocino Community Network. Management has evaluated subsequent events through March 26, 2025, the date on which the financial statements were available to be issued. 1% Current 1%
Decrease Discount Rate Increase
(5.90%) (6.90%) (7.90%)
MCN's proportionate share of
the net pension liability 1,611,188 $ 1,114,437 $ 703,884 $
OTHER INFORMATION
18 MENDOCINO COMMUNITY NETWORK
ORGANIZATION/BOARD OF EDUCATION/ADMINISTRATION
JUNE 30, 2024
The Mendocino Unified School District was established in 1964 and is comprised of an area of approximately 420 square miles located in Mendocino County. There were no changes in the boundaries of the District during the current year. The District operates three elementary schools, one high school, one continuation high school, one preschool and one alternative education K-12. Mendocino Community Network is a proprietary fund of the District.
GOVERNING BOARD
Member Office Term Expires
Emily Griffen President November 2026
Windspirit Aum Clerk November 2024
Lisa James Member November 2024
Mark Morton Member November 2024
Michael Schaeffer Member November 2024
DISTRICT ADMINISTRATORS
Jason Morse
Superintendent/Secretary to the Board
Meg Kailikole
Chief Business Officer
Rob Buch
MCN Manager
OTHER INDEPENDENT AUDITORS’ REPORTS
O: 619-270-8222
F: 619-260-9085
christywhite.com
348 Olive Street
San Diego, CA
92103
Certified Public Accountants serving
K-12 School Districts and Charter
Schools throughout California
19 REPORT ON INTERNAL CONTROL OVER FINANCIAL REPORTING AND ON COMPLIANCE AND OTHER
MATTERS BASED ON AN AUDIT OF FINANCIAL STATEMENTS PERFORMED IN ACCORDANCE WITH
GOVERNMENT AUDITING STANDARDS
Independent Auditors’ Report
Governing Board
Mendocino Community Network
Mendocino Unified School District
Mendocino, California
We have audited, in accordance with the auditing standards generally accepted in the United States of America and the standards applicable to financial audits contained in Government Auditing Standards issued by the Comptroller General of the United States, the financial statements of Mendocino Community Network a proprietary fund of the Mendocino Unified School District (the District), as of and for the year ended June 30, 2024, and the related notes to the financial statements, which collectively comprise the Mendocino Community Network’s basic financial statements, and have issued our report thereon dated March 26, 2025.
Report on Internal Control over Financial Reporting
In planning and performing our audit of the financial statements of the Mendocino Community Network, we considered the District’s internal control over financial reporting (internal control) as a basis for designing audit procedures that are appropriate in the circumstances for the purpose of expressing our opinions on the financial statements, but not for the purpose of expressing an opinion on the effectiveness of District’s internal control. Accordingly, we do not express an opinion on the effectiveness of District’s internal control.
A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, misstatements on a timely basis. A material weakness is a deficiency, or a combination of deficiencies, in internal control, such that there is a reasonable possibility that a material misstatement of the entity's financial statements will not be prevented, or detected and corrected on a timely basis. A significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit attention by those charged with governance.
Our consideration of internal control was for the limited purpose described in the first paragraph of this section and was not designed to identify all deficiencies in internal control that might be material weaknesses or significant deficiencies. Given these limitations, during our audit we did not identify any deficiencies in internal control that we consider to be material weaknesses. However, material weaknesses or significant deficiencies may exist that were not identified.
Report on Compliance and Other Matters
As part of obtaining reasonable assurance about whether Mendocino Community Network's financial statements are free from material misstatement, we performed tests of its compliance with certain provisions of laws, regulations, contracts, and grant agreements, noncompliance with which could have a direct and material effect on the financial statements. However, providing an opinion on compliance with those provisions was not an objective of our audit, and accordingly, we do not express such an opinion. The results of our tests disclosed no instances of noncompliance or other matters that are required to be reported under Government Auditing Standards. 20 Purpose of this Report
The purpose of this report is solely to describe the scope of our testing of internal control and compliance and the results of that testing, and not to provide an opinion on the effectiveness of the entity's internal control or on compliance. This report is an integral part of an audit performed in accordance with Government Auditing Standards in considering the entity's internal control and compliance. Accordingly, this communication is not suitable for any other purpose.
San Diego, California
March 26, 2025
Appendix D - Certificate of Insurance
Appendix E - Professional Insurance
Insurance for Technology Professionals
Hiscox Inc.
5 Concourse Parkway Suite 2150
Atlanta GA, 30328
T (646) 452-2353
F (678) 731-9501
E [email protected]
www.hiscox.com/brokers
HPACOVADREN134
A seamless integrated insurance solution for professionals.
Please read this wording, together with any endorsements and the Declarations, very carefully. If anything is not correct, please notify us immediately. Please note the full extent of your and our rights and duties.
Our promise to you
In return for the premium you have paid, we agree to insure you in accordance with the terms and conditions of the policy.
Your policy documents
Declarations Page
This contains a summary of policy information including the limits of liability and retention amounts you have selected.
General Terms and Conditions
This contains terms and conditions which apply to the entire policy.
Coverage Parts
This contains terms and conditions which apply only to the Coverage Part in which they appear.
Endorsements
These documents modify the Declarations page, General Terms and Conditions, and/or Coverage Parts.
Notices
These documents provide information that may affect your coverage as required by applicable law.
Complimentary training and risk management services
As a complimentary service that comes with this policy, we are pleased to provide a free confidential risk management and loss prevention service, consisting of an initial consultation and up to one hour of legal services to assist you in better understanding and minimizing risks that commonly lead to the types of claims covered under this policy. If you have a question about minimizing these types of liability risks in your business, please email your question to us at [email protected], along with your policy number. A Hiscox representative will get back to you within one business day with a referral to a nationally recognized law firm with a practice specifically focused on your industry.
Additionally, your purchase of this policy qualifies you for complimentary access to the following:
● Hiscox CyberClear Academy, an online interactive suite of training modules designed to reduce the risk that your company will become victim of a cyber event. Training is tailored to each employee’s experience and role, and covers existing and emerging threats. This government-certified training program is unique to Hiscox, and will help you meet the requirements of regulators and train your employees to be prepared to better understand cyber-related threats.
To access Hiscox CyberClear Academy: www.hiscoxcyberclearacademy.com. ● Access to breach prevention services through eRisk Hub® powered by NetDiligence®, a full suite of educational and technical resources that can assist in the prevention of cyber losses to your organization. Register at Hiscox eRisk Hub®:
www.eriskhub.com/hiscox.php Use access code: 08663. Questions? [email protected] Insurance for Technology Professionals
Hiscox Inc.
5 Concourse Parkway Suite 2150
Atlanta GA, 30328
T (646) 452-2353
F (678) 731-9501
E [email protected]
www.hiscox.com/brokers
HPACOVADREN134
● A comprehensive panel of breach response resources, featuring eRisk Hub® Breach Response Resource and Information Web Portal, powered by NetDiligence®, the industry standard of response and protection. Plus, public relations support, legal services, credit monitoring, extortion protection and more. These resources will help your clients comply with regulations and protect their reputation, should a breach occur.
For more information, visit https://www.hiscox.com/risk-management-cyber.
Reporting a claim
Please inform us immediately if you have a claim or loss to report and refer to the claim reporting provisions in each Coverage Part for further details.
Email: [email protected]
HISCOX INSURANCE COMPANY INC. (A Stock Company)
30 North LaSalle Street, Suite 1760, Chicago, IL 60602
(646) 452-2353
Insurance for Technology Professionals
DECLARATIONS
PLP D0001 CW (04/14) Page 1 of 5
HPADECADREN134
NOTICE: YOUR POLICY CONTAINS CLAIMS-MADE LIABILITY COVERAGE. CLAIMS-MADE COVERAGE APPLIES ONLY TO
CLAIMS THAT ARE FIRST MADE DURING THE POLICY PERIOD OR DISCOVERY PERIOD, IF PURCHASED, AND REPORTED IN ACCORDANCE WITH THE TERMS OF THE POLICY.
THE LIMIT OF LIABILITY AVAILABLE TO PAY DAMAGES WILL BE REDUCED AND MAY BE EXHAUSTED BY CLAIMS EXPENSES. FURTHERMORE, CLAIMS EXPENSES WILL BE APPLIED AGAINST THE RETENTION.
PLEASE READ YOUR POLICY CAREFULLY AND CONSULT YOUR INSURANCE ADVISOR ABOUT ANY QUESTIONS YOU MIGHT HAVE.
Broker No.: US 0000126 AmWINS Brokerage (Manhattan Beach, CA)
Policy No.: MPL1790263.24
Renewal of: MPL1790263.23
1600 Rosecrans Ave, Ste 100
Manhattan Beach, CA 90266-3708
1. Named Insured:
Address:
Mendocino Unified School District dba Mendocino Community Network 10700 Ford St
Mendocino, CA 95460
2. Policy Period: Inception Date: 08/08/2024 Expiration Date: 08/08/2025 Inception date shown shall be at 12:01 A.M. (Standard Time) to Expiration date shown above at 12:01 A.M. (Standard Time) at the address of the Named Insured.
3. General terms and
conditions wording:
PLP P0001 CW (07-19)
The General terms and conditions apply to this policy in conjunction with the specific wording detailed in each section below.
4. Endorsements: E6017.3 - Nuclear Incident Exclusion Clause-Liability-Direct (Broad) Endorsement, E6020.4 - War, Civil War, Cyberwarfare, and NCBR Exclusion Endorsement, E9003.2 - California Amendatory Endorsement, E6085.1 - Full Prior Acts Endorsement, E8511.3 - Cyber Crime & Cyber Deception Endorsement (DBPSL), E8627.1 - Intellectual Property Enhancement Endorsement, E8621.2 - Breach of Contract Enhancement Endorsement (Tech), E8530.1 - Telephone Toll Fraud Sublimit Endorsement, E8531.1 - Amend Personally Identifiable Information and Regulatory Action Endorsement (EU General Data Protection Regulation), E6314.2 - Coverage Enhancement Amendatory Endorsement, E9998.2 - TRIA Not Purchased Endorsement, E8673.2 - Cyber Incidents (Tech), and E6065.3 - Change of Mailing Address Endorsement
5. Optional Extension Extended Reporting Period of 12/24/36 months at 75/150/225 percent of the annual premium.
Period:
6. Notification of
claims to:
Hiscox Claims
5 Concourse Parkway, Suite 2150
HISCOX INSURANCE COMPANY INC. (A Stock Company)
30 North LaSalle Street, Suite 1760, Chicago, IL 60602
(646) 452-2353
Insurance for Technology Professionals
DECLARATIONS
PLP D0001 CW (04/14) Page 2 of 5
HPADECADREN134
Atlanta GA, 30328
Fax: 678-731-9501
Email: [email protected]
Notification of cyber
claims and events:
Hiscox Cyber Claims
5 Concourse Parkway, Suite 2150
Atlanta GA, 30328
Fax: 678-731-9501
Email: [email protected]
If you experience a cyber event, please also contact the Breach Coach® at 1-855-HISCO-BR (1-855-447-2627). Provide your company name and any other companies/individuals involved.
Additional Notification
requirements:
see Endorsement E8643 for additional notification requirements under the Cyber Enhancement Coverage Part
7. Policy Premium: $ 4,464 Premium Allocated to TRIA: $ 0 State Surcharge: N/A
8. Specified Terms for Cyber Coverage Part:
Your CyberClear policy includes complimentary access to our risk management and breach response services, including:
● Cyber Training with Paladin Shield, a powerful cybersecurity platform that is entirely free for Hiscox insureds. Paladin Shield provides software protections, live consultative services, and security training content including phishing simulations, all under one log-in. Nearly all cyber attacks are instigated by human error. Paladin’s training teaches best practices on current security topics with engaging videos and interactive quizzes. Training includes topics such as data privacy, dangers in your inbox, incident preparedness and response, and online safety 101.
To access Paladin cyber training: hiscox.meetpaladin.com. ● Access to breach prevention services through eRisk Hub® powered by NetDiligence®, a full suite of educational and technical resources that can assist in the prevention of cyber losses to your organization.
To register at Hiscox eRisk Hub®, visit https://eriskhub.com/hiscox and use access code: 08663. Questions? [email protected]
● A comprehensive panel of breach response resources, including public relations support, legal services, credit monitoring, extortion protection, and more. These resources will help you address Extortion matters quickly, comply with regulations and protect your reputation, should an event occur.
For more information, visit www.hiscox.com/risk-management-cyber.
Technology Professional Liability Claims-Made and Reported Coverage Part: PLPTCH P0001 CW (01/20)
HISCOX INSURANCE COMPANY INC. (A Stock Company)
30 North LaSalle Street, Suite 1760, Chicago, IL 60602
(646) 452-2353
Insurance for Technology Professionals
DECLARATIONS
PLP D0001 CW (04/14) Page 3 of 5
HPADECADREN134
Covered Professional Services: Providing access to the internet, and Telecom Billing Services, for others for a fee.
Technology Professional Liability (TL): $ 1,000,000 Each Claim / $ 1,000,000 Aggregate Retroactive Date: 08/08/2003
Retention: $ 2,500
TL Premium: $ 2,658
Endorsements: E9182.1 - California Amendatory Endorsement Media Liability Claims-Made and Reported Coverage Part: PLP P0005 CW (06-14) Covered Professional Services: Providing access to the internet, and Telecom Billing Services, for others for a fee.
Media Liability (ML): $ 1,000,000 Each Claim / $ 1,000,000 Aggregate Retroactive Date: Full Prior Acts
Retention: $ 2,500
ML Premium: $ 151
Endorsements: E9122.1 - California Amendatory Endorsement Data Breach and Privacy Security Liability Claims-Made/Breach Occurring Coverage Part: PLP P0004 CW (06-14)
Data Breach & Privacy Security
Liability (DBPSL):
$ 1,000,000 DBPSL Each Claim and/or Breach / $ 1,000,000 Aggregate Regulatory Action: $ 1,000,000 Aggregate
Regulatory Compensatory: $ 1,000,000 Aggregate
PCI Fine/Penalties: $ 1,000,000 Aggregate
PCI Assessments: $ 1,000,000 Aggregate
Computer Forensics Costs: $ 1,000,000 Aggregate
Notification Costs: $ 1,000,000 Aggregate
Credit or Identity Protection Costs: $ 1,000,000 Aggregate Crisis Management & Public
Relations Cost:
$ 1,000,000 Aggregate
Retroactive Date: Full Prior Acts
Retention: $ 2,500
DBPSL Premium: $ 1,505
HISCOX INSURANCE COMPANY INC. (A Stock Company)
30 North LaSalle Street, Suite 1760, Chicago, IL 60602
(646) 452-2353
Insurance for Technology Professionals
DECLARATIONS
PLP D0001 CW (04/14) Page 4 of 5
HPADECADREN134
Endorsements: E9102.1 - California Amendatory Endorsement Cyber Enhancement Loss Occurring and Discovered Coverage Part: PLP P0006 CW (06-14) Cyber Business Interruption (CBI): $ 1,000,000 Aggregate Cyber Business Interruption
Consulting Costs:
$ 50,000 Aggregate
Cyber Business Interruption Hourly
Loss Amount:
$ 10,000 Minimum Per hour
Retention: 10 hours
CBI Premium: $ 50
Cyber Extortion (CE): $ 1,000,000 Aggregate
Retention: $ 2,500
CE Premium: $ 50
Hacker Damage (HD): $ 1,000,000 Aggregate
Hacker Damage Consulting Costs: $ 50,000 Aggregate
Retention: $ 2,500
HD Premium: $ 50
Endorsements: E8643.2 - Cyber Enhancements Notification Endorsement, and E8649.1 - Amend Definition of Business Interruption Costs (Remove Hourly Loss Amount) IN WITNESS WHEREOF, the Insurer indicated above has caused this Policy to be signed by its President and Secretary, but this Policy shall not be effective unless also signed by the Insurer’s duly authorized representative.
HISCOX INSURANCE COMPANY INC. (A Stock Company)
30 North LaSalle Street, Suite 1760, Chicago, IL 60602
(646) 452-2353
Insurance for Technology Professionals
DECLARATIONS
PLP D0001 CW (04/14) Page 5 of 5
HPADECADREN134
President
Secretary
Authorized Representative
Kevin Kerridge
July 15, 2024
Hiscox Inc.
General Terms and Conditions
PLP P0001 CW (07/19) Page 1 of 5
I. Our promise to
you
In consideration of the premium charged, and in reliance on the statements made and information provided to us, we will pay covered amounts as defined in this policy, provided you properly notify us of claims, breaches, events, or occurrences, and meet your obligations to us in accordance with the terms of this policy.
II. Limits of liability Regardless of the number of Coverage Parts you have purchased, the maximum we will pay for all covered amounts will be as follows:
A. Coverage part limit Each Coverage Part purchased will be subject to a coverage part limit (if one is stated in the Declarations), which is the maximum amount we will pay for all covered amounts under that Coverage Part, other than coverage enhancements or other items we have expressly agreed to pay in addition to the limit. The coverage part limit will be in excess of any applicable retention.
B. Each claim limit The Each Claim Limit identified in the Declarations is the maximum amount we will pay for all covered amounts for each covered claim, unless a lower sublimit is specified, in which case the sublimit is the maximum amount we will pay for the type of covered claim to which the sublimit applies. The Each Claim Limit, or any sublimit, will be in excess of any applicable retention and will be a part of, and not in addition to, any applicable coverage part limit.
C. Each breach limit The Each Breach Limit identified in the Declarations (if you have purchased a relevant Coverage Part) is the maximum amount we will pay for all covered amounts for each covered breach, unless a lower sublimit is specified, in which case the sublimit is the maximum amount we will pay for the type of covered breach or costs to which the sublimit applies. The Each Breach Limit, or any sublimit, will be in excess of any applicable retention and will be a part of, and not in addition to, any applicable coverage part limit.
D. Each occurrence limit The Each Occurrence Limit identified in the Declarations (if you have purchased a relevant Coverage Part) is the maximum amount we will pay for all covered amounts for each covered occurrence, unless a lower sublimit is specified, in which case the sublimit is the maximum amount we will pay for the type of covered occurrence to which the sublimit applies. The Each Occurrence Limit, or any sublimit, will be in excess of any applicable retention and will be a part of, and not in addition to, any applicable coverage part limit.
E. General liability coverage
part limits
If you have purchased a General Liability Coverage Part, additional rules for applying limits are contained in Section IV. Limits of liability, of that Coverage Part.
F. Related claims All related claims, regardless of when made, will be treated as one claim, and all subsequent related claims will be deemed to have been made against you on the date the first such claim was made. If, by operation of this provision, the claim is deemed to have been made during any period when we insured you, it will be subject to only one retention and one Each Claim Limit regardless of the number of claimants, insureds, or claims involved.
G. Shared limits If you have purchased more than one of the following Coverage Parts:
1. Cyber Coverage Part;
2. Technology Professional Liability Coverage Part; or
3. Digital Media Liability Coverage Part,
then the coverage part limits applicable to those Coverage Parts will be shared, and any payments we make under one Coverage Part, other than coverage enhancements or other items we have expressly agreed to pay in addition to the limit, will reduce the coverage part limits for all Coverage Parts.
If the applicable coverage part limits are different, the maximum amount we will pay for covered amounts under all Coverage Parts combined, other than coverage enhancements or other items we have expressly agreed to pay in addition to the limits, will be the highest available coverage part limit.
General Terms and Conditions
PLP P0001 CW (07/19) Page 2 of 5
III. Your obligations
to us
A. Named insured
responsibilities
It will be the responsibility of the named insured (or, if there is more than one named insured, the first one listed on the Declarations) to act on behalf of all insureds with respect to the following:
1. timely giving and receiving notice of cancellation or non-renewal;
2. timely payment of premium;
3. receipt of return premiums;
4. timely acceptance of changes to this policy; and
5. timely payment of retentions.
B. Your duty to cooperate You must cooperate with us in the defense, investigation, and settlement of any claim, potential claim, breach, event, occurrence, or other matter notified to us, including but not limited to:
1. notifying us immediately if you receive any settlement demands or offers, and sending us copies of any demands, notices, summonses, or legal papers;
2. submitting to examination and interrogation under oath by our representative and giving us a signed statement of your answers;
3. attending hearings, depositions, and trials as we request;
4. assisting in securing and giving evidence and obtaining the attendance of witnesses;
5. providing written statements to our representative and meeting with such representative for the purpose of investigation and/or defense;
6. providing all documents and information we may reasonably request, including authorizing us to obtain records; and
7. pursuing your right of recovery from others.
C. Your obligation not to
incur any expense or
admit liability
You must not make any payment, incur any expense, admit any liability, assume any obligation, or enter into any settlement negotiations or agreements without our prior consent. If you do so, it will be at your own cost and expense.
D. Your representations You warrant that all representations made and all materials submitted by you or on your behalf in connection with the application for this policy are true, accurate, and not misleading, and agree they were relied on by us and were material to our decision to issue this policy to you. If we learn any of the representations or materials were untrue, inaccurate, or misleading in any material respect, we are entitled to treat this policy as if it had never existed.
IV. Optional
extension period
1. If we or the named insured cancel or non-renew this policy, then the named insured will have the right to purchase an optional extension period for the duration and at the percentage of the expiring premium stated in Item 5 of the Declarations. The optional extension period, if purchased, will start on the effective date of cancellation or non-renewal.
However, the right to purchase an optional extension period will not apply if:
a. this policy is canceled by us for nonpayment of premium; or b. the total premium for this policy has not been fully paid.
2. The optional extension period will apply only to claims that:
a. are first made against you and reported to us during the optional extension period; and b. arise from your professional services performed, or a breach, data breach, offense, or occurrence that takes place, on or after the retroactive date but prior to the effective date of cancellation or non-renewal of this policy.
3. The additional premium will be fully earned at the inception of the optional extension period.
General Terms and Conditions
PLP P0001 CW (07/19) Page 3 of 5
4. Notice of election and full payment of the additional premium for the optional extension period must be received by us within 30 days after the effective date of cancellation or nonrenewal, otherwise any right to purchase the optional extension period will lapse.
The limits of liability applicable during any purchased optional extension period will be the remaining available coverage part limit. There will be no separate or additional limit of liability available for any purchased optional extension period.
The right to purchase an optional extension period will apply only to Coverage Parts you have purchased that include coverage written on a claims-made or loss occurring and discovered basis, and not to any Coverage Parts written on an occurrence basis.
V. Other provisions
affecting
coverage
The following provisions apply to all Coverage Parts you have purchased. If there is a conflict between any of the provisions here and a provision contained in a Coverage Part, then the provision in the Coverage Part will govern the coverage provided under that Coverage Part.
A. Alteration and assignment No change in, modification of, or assignment of interest under this policy will be effective unless made by written endorsement to this policy signed by our authorized representative.
B. Bankruptcy or insolvency Your bankruptcy or insolvency will not relieve us of any of our obligations under this policy.
C. Cancellation 1. This policy may be canceled by the named insured by giving written notice, which must include the date the cancellation will be effective, to us at the address stated in the Declarations.
2. This policy may be canceled by us by mailing to the named insured by registered, certified, or other first class-mail (or by email where allowed by applicable law), at the named insured’s address (or email address) stated in Item 1 of the Declarations, written notice which must include the date the cancellation will be effective. The effective date of the cancellation will be no less than 60 days after the date of the notice of cancellation, or ten days if the cancellation is due to nonpayment of premium.
3. The mailing (or emailing) of the notice will be sufficient proof of notice, and this policy will terminate at the date and hour specified in the notice.
4. If this policy is canceled by the named insured, we will retain the customary short rate proportion of the premium.
5. If this policy is canceled by us, we will return a pro rata proportion of the premium.
6. Payment or tender of any unearned premium by us will not be a condition precedent to the cancellation, but such payment will be made as soon as possible.
D. Change in control If, during the policy period identified in Item 2 of the Declarations, the named insured consolidates with, merges into, or sells all or substantially all of its assets to any other person or entity, or any other person or entity acquires ownership or control of the named insured, then the named insured will provide us written notice no later than 30 days after the effective date of such change in control, together with any other information we may require.
We will not cancel this policy solely because of a change in control, but unless you and we agree in writing otherwise, after the effective date of any change in control, this policy will cover only claims arising from professional services performed, or breaches, data breaches, offenses, or occurrences that took place, prior to the change in control.
E. Coverage territory This policy will apply to your professional services performed, and breaches, offenses, events, or occurrences that take place, anywhere in the world, provided that any action, arbitration, or other proceeding (if you have purchased a relevant Coverage Part) is brought within the United States, its territories or possessions, or Canada.
F. Estates, heirs, legal
representatives, spouses,
and domestic partners
In the event of an employee’s death or disability, this policy will also apply to claims brought against the employee’s:
1. heirs, executors, administrators, trustees in bankruptcy, assignees, and legal General Terms and Conditions
PLP P0001 CW (07/19) Page 4 of 5
representatives; or
2. lawful spouse or lawful domestic partner;
but only:
a. for a covered claim arising from the scope of the employee’s work for you; or b. in connection with their ownership interest in property which the claimant seeks as recovery in a covered claim arising from the scope of the employee’s work for you.
G. False or fraudulent claims If any insured commits fraud in connection with any claim, potential claim, breach, offense, event, or occurrence, whether regarding the amount or otherwise, this insurance will become void as to that insured from the date the fraud is committed.
H. Other insurance Any payment due under this policy is specifically excess of and will not contribute with any other valid and collectible insurance, unless such other insurance is written specifically as excess insurance over this policy. However, if you have purchased a General Liability Coverage Part, rules for how that Coverage Part will be treated when there is other valid and collectible insurance are contained in Section V. Other provisions affecting coverage, D. Other insurance, of that Coverage Part.
If the same claim or related claims, breach, event or related events, or occurrence is covered under more than one Coverage Part, we will pay only under one Coverage Part, which will be the Coverage Part that provides the most favorable coverage.
I. Subrogation In the event of any payment by us under this policy, we will be subrogated to all of your rights of recovery to that payment.
You will do everything necessary to secure and preserve our subrogation rights, including but not limited to the execution of any documents necessary to allow us to bring suit in your name.
You will do nothing to prejudice our subrogation rights without our prior written consent.
Any recovery first will be paid to you up to the amount of any retention you have paid, and then to us up to the amount of any covered amounts we have paid.
J. Titles Titles of sections of and endorsements to this policy are inserted solely for convenience of reference and will not be deemed to limit, expand, or otherwise affect the provisions to which they relate.
VI. Definitions
applicable to all
Coverage Parts
The following definitions apply to all Coverage Parts you have purchased. If the same term is defined here and in a Coverage Part, then the definition in the Coverage Part will govern the coverage provided under that Coverage Part.
Application means the signed application for the policy and any attachments and materials submitted with that application. If this policy is a renewal or replacement of a previous policy issued by us, application also includes all previous signed applications, attachments, and materials.
Coverage part limit means the amount stated in the Declarations as the aggregate limit applicable to each Coverage Part you have purchased which is subject to an aggregate limit.
Covered amounts means any amounts we have expressly agreed to pay under any Coverage Part you have purchased.
Employee means any past, present, or future:
1. employee (including any part-time, seasonal, leased, or temporary employee or any volunteer);
2. partner, director, officer, or board member (or equivalent position); or
3. independent contractor;
of a named insured, but only while in the course of their performance of work or services on General Terms and Conditions
PLP P0001 CW (07/19) Page 5 of 5
behalf of or at the direction of the named insured.
Named insured means the individual, corporation, partnership, limited liability company, limited partnership, or other entity identified in Item 1 of the Declarations.
Policy period means the period of time identified in Item 2 of the Declarations, and any optional extension period, if purchased.
Professional services means those services identified as Covered Professional Services under any Coverage Part on the Declarations containing such a description.
Related claims means all claims that are based upon, arise out of, or allege:
1. a common fact, circumstance, situation, event, service, transaction, cause, or origin;
2. a series of related facts, circumstances, situations, events, services, transactions, sources, causes, or origins;
3. a continuous or repeated act, error, or omission in the performance of your professional services; or
4. the same breach, event, occurrence, or offense.
The determination of whether a claim is related to another claim or claims will not be affected by the number of claimants or insureds involved, causes of action asserted, or duties involved.
Retention means the amount or time identified as such in the Declarations.
Retroactive date means the date identified as such in the Declarations.
We, us, or our means the Company identified on the Declarations as issuing this policy.
You, your, or insured means any individual or entity expressly described as an insured in any Coverage Part you have purchased.
Technology Professional Liability Coverage Part
PLPTCH P0001 CW (01/20) Page 1 of 11
I. Insuring
agreement –
What is covered
We will pay up to the coverage part limit for damages and claim expenses in excess of the retention for covered claims against you resulting from the performance of your technology services by you or anyone on your behalf (including your subcontractors or outsourcers) on or after the retroactive date, for any actual or alleged:
1. breach of contract;
2. indemnity;
3. negligence;
4. fraud;
5. breach of confidentiality;
6. invasion of privacy;
7. intellectual property infringement;
8. unfair practices;
9. defamation; or
10. unintentional infliction of emotional distress, but only when asserted in conjunction with and based on the same allegations as a claim for negligent publication, invasion of privacy, or defamation,
provided the claim is first made against you during the policy period and is reported to us in accordance with Section V. Your obligations.
II. Coverage
enhancements and
sublimits
We will also make the following payments, provided you report such matters to us in accordance with Section V. Your obligations:
Contractual fees A. If your client refuses to pay your contractually agreed fees (including any amount you owe to a subcontractor on the date your client first refuses to pay) for your technology services performed on or after the retroactive date, and you satisfy us that:
1. you do not have reasonable grounds to legally compel payment of the amount owed;
2. there is written evidence from your client that they intend to make a claim against you that is reasonably likely to result in covered damages greater than the amount that you are owed; and
3. our payment is reasonably likely to fully and finally resolve all known claims and potential claims by that client,
then we will pay the amount you are owed in excess of the retention stated in the Declarations, not including any amount for your lost profit, mark-up, or tax liabilities.
If a claim is still made against you after we have paid your outstanding fees, our obligation to pay any damages and claim expenses resulting from such claim will be reduced by the amount we paid.
Any payment we make under this subsection A will be a part of, and not in addition to, the coverage part limit.
Declaratory relief B. 1. If a claimant has advised you, in writing, that you are committing copyright or trademark infringement; and
2. directly in response to that written assertion, you file a declaratory relief action and the claimant files a counterclaim against you alleging copyright or trademark infringement; and
3. the counterclaim is covered under this policy and pending against you while you are prosecuting your declaratory relief action,
Technology Professional Liability Coverage Part
PLPTCH P0001 CW (01/20) Page 2 of 11
then we will pay reasonable attorney fees you incur in excess of the retention stated in the Declarations to prosecute that declaratory relief action.
Any payment we make under this subsection B will be a part of, and not in addition to, the coverage part limit.
Pre-claim assistance C. We will pay for reasonable and necessary fees, costs, and expenses we incur to investigate or monitor a potential claim arising out of your technology services performed on or after the retroactive date, provided you first become aware of the circumstances leading to the potential claim during the policy period. Our obligation to make any payments under this subsection C will cease when a claim is made against you arising out of the same circumstances as the potential claim we investigated or monitored.
No retention will apply to amounts we pay under this subsection C, and such amounts will be in addition to, and not part of, the coverage part limit.
Service credits D. If your client makes a claim against you, and providing service credits to the client as part of or as the entire settlement will fully and finally resolve all known claims and potential claims by that client, then we will also pay for the value of your service credits (less any profit or mark-up), but only if the service credits are agreed to by us as part of the settlement.
Any payment we make under this subsection D is subject to the retention stated in the Declarations, and such payments will be a part of, and not in addition to, the coverage part limit.
Supplemental payments E. We will pay reasonable expenses, including loss of wages and a $250 travel per diem, incurred by you if we require you to attend depositions, arbitration proceedings, or trials in connection with the defense of a covered claim, but we will not pay more than an aggregate of $10,000 per claim for such expenses, regardless of the number of insureds.
No retention will apply to amounts we pay under this subsection E, and such amounts will be in addition to, and not part of, the coverage part limit.
III. Who is an
insured
For purposes of this Coverage Part, you, your, or insured means a named insured, subsidiary, employee, executive, acquired entity, or additional insured as defined below:
Named insured means the individual, corporation, partnership, limited liability company, limited partnership, or other entity identified in Item 1 of the Declarations.
Subsidiary means any entity of which the named insured has majority ownership before or as of the inception of the policy period.
Employee means any past, present, or future person employed by the insured organization as a permanent, part-time, seasonal, leased, or temporary employee, or any volunteer, but only while in the course of their performance of technology services on behalf of or at the direction of such insured organization.
Executive means any past, present, or future partner, director, officer, or board member (or the equivalent positions) of the insured organization, but only while in the course of their performance of technology services on behalf of such insured organization.
Acquired entity means any entity:
1. in which the named insured:
a. acquires substantially all of the assets;
b. acquires the majority of its voting securities, as a result of which it becomes a subsidiary; or
Technology Professional Liability Coverage Part
PLPTCH P0001 CW (01/20) Page 3 of 11
c. merges and leaves the named insured as the surviving entity; or
2. that the named insured creates as a subsidiary,
during the policy period.
With respect to an acquired entity whose revenues exceed 20% of the named insured’s revenues (as reported in your most recent fiscal year-end financial statements prior to inception of this policy) at the time of its creation or acquisition, any coverage under this policy will expire 90 days after the effective date of its creation or acquisition unless, within such 90 day period:
a. the named insured provides us with written notice of such creation or acquisition; b. the named insured provides us with information related to such creation or acquisition as we may reasonably require;
c. the named insured accepts any special terms, conditions, exclusions, or additional premium charge as we may reasonably require; and
d. we agree by written endorsement to provide such coverage.
This policy will apply to an acquired entity only with respect to your technology services performed after the acquisition, merger, or creation. If a claim results from technology services performed both before and after the acquisition, merger, or creation of an acquired entity, this policy will apply only to that portion of the claim attributable to the technology services performed after the acquisition, merger, or creation.
Additional insured means any person or organization you have agreed in a written contract or agreement to add as an additional insured to a policy providing the type of coverage afforded by this Coverage Part, provided the contract or agreement:
1. is currently in effect or becomes effective during the policy period; and
2. was executed before the technology services out of which the claim arises were performed.
Coverage is available for additional insureds solely for their liability arising out of your negligence or of those acting on your behalf and not for any liability arising out of the sole negligence of the additional insured.
IV. Defense and
settlement of
claims
Defense We have the right and duty to defend any covered claim, even if such claim is groundless, false, or fraudulent.
We have the right to select and appoint counsel to defend you against a covered claim. You may request in writing that we appoint defense counsel of your own choice, but whether to grant or deny such a request will be at our sole discretion.
Settlement We have the right to solicit and negotiate settlement of any claim but will not enter into a settlement without your consent, which you agree not to withhold unreasonably. We agree that you may settle any claim where the total claim expenses and damages does not exceed the retention, provided the entire claim is resolved and you obtain a full release on behalf of all insureds.
If you withhold consent to a settlement recommended by us and acceptable to the party who made the claim, the most we will pay for that claim is the sum of:
1. the amount of our recommended settlement;
2. claim expenses incurred up to the date of our recommendation;
3. 70% of all claim expenses incurred after our recommendation; and Technology Professional Liability Coverage Part
PLPTCH P0001 CW (01/20) Page 4 of 11
4. 70% of all damages in excess of the settlement amount recommended by us.
V. Your obligations
Notifying us of claims and
coverage enhancements
You must give written notice to us of any claim, or any other matter covered under Section II.
Coverage enhancements, as soon as possible once such claim or other matter is known to an executive, but in any event, no later than 60 days after the end of the policy period.
All such notifications must be in writing and include a copy of the claim or other covered matter, and must be submitted to us via the designated email address or mailing address identified in Item 6 of the Declarations.
Notifying us of potential
claims
You have the option of notifying us of potential claims that may lead to a covered claim against you.
In order to do so, you must give written notice to us as soon as possible and within the policy period, and the notice must, to the greatest extent possible, identify the details of the potential claim, including identifying the potential claimant(s), the likely basis for liability, the likely demand for relief, and any additional information about the potential claim we may reasonably request.
The benefit to you of notifying us of a potential claim is that if an actual claim arises from the same circumstances as the properly notified potential claim, then we will treat that claim as if it had first been made against you on the date you properly notified us of it as a potential claim, even if that claim is first made against you after the policy period has expired.
All potential claim notifications must be in writing and submitted to us via the designated email address or mailing address identified in Item 6 of the Declarations.
Retention Our obligation to pay damages and claim expenses under this Coverage Part is in excess of the retention, which you must pay in connection with each covered claim or other covered matter, if applicable.
VI. Exclusions –
What is not
covered
We will have no obligation to pay any sums under this Coverage Part, including any damages or claim expenses, for any claim:
Antitrust/deceptive trade
practices
1. based upon or arising out of any actual or alleged:
a. false, deceptive, or unfair trade practices;
b. unfair competition, impairment of competition, restraint of trade, or antitrust violations;
c. violation of the Sherman Anti-Trust Act, the Clayton Act, the Robinson-Patman Act, all including as may be amended, or any similar foreign, federal, state, or local statutes, rules, or regulations; or
d. deceptive or misleading advertising.
However, this exclusion will not apply to a claim for unfair practices otherwise covered under part 8 of Section I. Insuring agreement – What is covered.
Bodily injury 2. based upon or arising out of any actual or alleged bodily injury; however, this exclusion will not apply to a claim for emotional distress otherwise covered under part 10 of Section I. Insuring agreement - What is covered.
Ceased product/service 3. based upon or arising out of any actual or alleged commercial decision to cease providing a particular product or service.
Technology Professional Liability Coverage Part
PLPTCH P0001 CW (01/20) Page 5 of 11
Chargeback 4. based upon or arising out of any actual or alleged chargeback, liability, or fee incurred by you or your client as a result of a merchant service provider, including any credit card company or bank, wholly or partially reversing or preventing a payment transaction.
Collection of data without
knowledge/ consumer privacy
5. based upon or arising out of any actual or alleged:
a. collection of personally identifiable information by you (or others on your behalf) without the knowledge or permission of the person to whom the personally identifiable information relates; or
b. violation of any privacy law or consumer data protection law protecting against the use, collection, retention, or disclosure of any information about a person or any confidential corporate information.
Commercial dispute 6. based upon or arising out of any actual or alleged commercial dispute with your business partner or business associate, including but not limited to any reseller, distributor, original equipment manufacturer, third-party sales agent, systems integrator, or joint venturer, but only to the extent such a claim is based upon:
a. a commission or royalty, or any other term upon which such partner or associate is to be compensated in connection with doing business with you, or any compensation or remuneration promised or owed by you pursuant to those terms; or
b. your decision to cease doing business with such a partner or associate.
Competitor trade secrets/
confidential information
7. based upon or arising out of any actual or alleged disclosure, misuse, or misappropriation of any ideas, trade secrets, or confidential information that came into the possession of any person or entity:
a. before such person or entity became an employee, board member, trustee, director, or officer (or equivalent position) of the insured organization; or b. after such person or entity became an employee, board member, trustee, director, or officer (or equivalent position) of the insured organization if the ideas, trade secrets, or confidential information was obtained by use of access credentials that were granted prior to their employment with the insured organization.
Criminal proceedings 8. brought in the form of a criminal proceeding, including but not limited to a criminal investigation, grand jury proceeding, or criminal action.
Employer liability/ third party
discrimination/ fiduciary
9. based upon or arising out of any actual or alleged:
a. obligation under any workers’ compensation, unemployment compensation, employers’ liability, fair labor standards, labor relations, wage and hour, or disability benefit law, including any similar provisions of any foreign, federal, state, or local statutory or common law;
b. liability or breach of any duty or obligation owed by you as an employer or prospective employer;
c. breach of any fiduciary duty owed by you; or
d. harassment, wrongful termination, retaliation, or discrimination, including but not limited to adverse or disparate impact.
Excluded statutory violations 10. based upon or arising out of any actual or alleged violation of the following laws:
a. the Securities Act of 1933;
b. the Securities Exchange Act of 1934;
c. any state blue sky or securities laws;
d. any state or federal taxation law or regulation;
d. the Racketeer Influenced and Corrupt Organizations Act, 18 U.S.C. § 1961 et seq.; e. the Employee Retirement Income Security Act of 1974; Technology Professional Liability Coverage Part
PLPTCH P0001 CW (01/20) Page 6 of 11
f. the Children’s Online Privacy Protection Act (COPPA); g. the Fair Debt Collection Practices Act; or
h. the Fair Credit Reporting Act,
all including as may be amended, or any similar provisions of any foreign, federal, state, or local statutory or common law and any rules or regulations promulgated under such laws.
Exclusivity/non-compete 11. based upon or arising out of any actual or alleged breach of any exclusivity, noncompetition, non-solicitation, or other similar commercial terms in your contract with a client.
False or misleading
advertising
12. based upon or arising out of any actual or alleged false or misleading advertisement; however, this exclusion will not apply to any otherwise covered claim that is based on your alleged unauthorized use of another’s trademark.
Funds transfer 13. for any actual or alleged loss, theft, or transfer of:
a. your funds, monies, or securities;
b. the funds, monies, or securities of others in your care, custody, or control; or c. the funds, monies, or securities in the care, custody, or control of any third party, including but not limited to the value of any funds, monies, or securities transferred by you or others on your behalf.
Government investigation/
enforcement
14. based upon or arising out of any actual or alleged governmental investigation or enforcement of any state or federal regulation, including but not limited to any regulation promulgated by the Federal Trade Commission, Federal Communications Commission, or the Securities and Exchange Commission, or ASCAP, BMI, SESAC, or other similar licensing organization; however, this exclusion will not apply to any claim brought by a government agency in its capacity as a client.
Improper billing 15. based upon or arising out of any actual or alleged inaccurate, improper, or fraudulent billings or invoices, including but not limited to a qui tam action or any action under the False Claims Act, as may be amended, or any similar provisions of any foreign, federal, state, or local statutory or common law.
Infrastructure interruption 16. based upon or arising out of any actual or alleged failure or interruption of service provided by an internet service provider, telecommunications provider, utility provider, including but not limited to any water, gas, electric, or other utility provider, or other infrastructure provider; however, this exclusion will not apply to:
a. a claim by your client, if you are an internet service provider, telecommunications provider, utility provider, or other infrastructure provider; or b. a failure or interruption of service provided by a cloud computing provider, data center or colocation service provider, or other hosted computer resource provider.
Insured vs. insured 17. brought by or on behalf of one insured or affiliate against another insured or affiliate; however, this exclusion will not apply to a claim made by:
a. an insured or affiliate in their capacity as a client; or b. any additional insured against another insured which is based upon or arises out of any other insured's performance of technology services for the additional insured.
Intentional acts 18. based upon or arising out of any actual or alleged fraud, dishonesty, criminal conduct, or any knowingly wrongful, malicious, or intentional acts or omissions, except that we will pay claim expenses until there is a final adjudication establishing such conduct.
However, this exclusion will not apply to an otherwise covered claim for fraud.
This exclusion will apply to the named insured only if the conduct was committed or Technology Professional Liability Coverage Part
PLPTCH P0001 CW (01/20) Page 7 of 11
allegedly committed by any:
a. executive of the named insured; or
b. employee of the named insured if any executive of the named insured knew or had reason to know of such conduct by the employee.
This exclusion will apply separately to each insured and will not apply to any insured who did not commit, participate in, acquiesce to, or ratify such conduct committed by another insured.
Patent infringement 19. based upon or arising out of any actual or alleged infringement, use, or disclosure of any patent.
Pollution/environmental 20. based upon or arising out of any actual, alleged, or threatened discharge, dispersal, release, or escape of pollutants, including any direction or request to test for, monitor, clean up, remove, contain, treat, detoxify, or neutralize pollutants.
Prior acts/notice/knowledge 21. based upon or arising out of any:
a. claim or potential claim that was the subject of any notice given under any other policy of which this policy is a renewal or replacement; b. claim or potential claim that was the subject of, or is related to, any prior or pending litigation, claim, written demand, arbitration, administrative or regulatory proceeding or investigation, or licensing proceeding that was filed or commenced against you and of which any executive had notice prior to the policy period; or c. other matter any executive had knowledge of prior to the policy period, and such executive had a reasonable basis to believe could result in a claim.
However, if this policy is a renewal or replacement of a previous policy we issued that provided materially identical coverage, and is part of an unbroken chain of successive policies issued by us, the policy period referred to in paragraphs b and c, above, will be the policy period of the first such policy we issued.
Property damage 22. based upon or arising out of any actual or alleged property damage; however, this exclusion will not apply to damage to data, or destruction or loss of use of data.
Repair/replace/recall 23. based upon or arising out of any actual or alleged repair, upgrade, correction, recall, replacement, withdrawal, removal, or disposal costs incurred by you or others; however, this exclusion will not apply to an otherwise covered claim alleging the loss of use of technology products.
Subsidiary outside control of
named insured
24. a. based upon or arising out of technology services performed by or on behalf of a past or present subsidiary or acquired entity while the named insured does not have majority ownership or management control of it; or b. made against a subsidiary or an acquired entity, or anyone acting on its behalf, while the named insured does not have majority ownership or management control of it.
Sweepstakes/gambling/
lotteries/redemption
25. based upon or arising out of any:
a. actual or alleged provision of any sweepstakes, gambling activities, or lotteries; or b. price discounts, prizes, awards, money, or valuable consideration given in excess of a total contracted or expected amount, including but not limited to over redemption or under redemption of coupons, discounts, awards, or prizes.
Third party technology
product defect
26. based upon or arising out of any actual or alleged defect in any technology products that is solely caused by a third party, including but not limited to any third party software supplier, manufacturer, or originator; however, this exclusion will not apply to:
a. claim expenses we pay on your behalf to defend such claims but only until (if ever) there is a finding in any legal proceeding (including any arbitration) or any admission that the defect at issue is solely caused by a third party, at which time Technology Professional Liability Coverage Part
PLPTCH P0001 CW (01/20) Page 8 of 11
our duty to defend you will end and you will reimburse us for all claim expenses that we have paid toward that claim; or
b. any amount you satisfy us that you are legally able to recover under a written contract.
Unsolicited telemarketing 27. based upon or arising out of any actual or alleged violation of any federal, state, local, or foreign statutes, ordinances, or regulations relating to unsolicited telemarketing, solicitations, emails, faxes, text messages, or any other communications of any type or nature, including but not limited to the Telephone Consumer Protection Act, CAN-SPAM Act, or any “anti-spam” or “do-not-call” statutes, ordinances, or regulations.
VII. Definitions The following definitions apply to this Coverage Part. Additional definitions are contained in Section III. Who is an insured, and in the General Terms and Conditions, Section VI.
Definitions applicable to all Coverage Parts.
Affiliate means any person or entity related to any insured through common ownership, control, or management as follows:
1. any person or entity:
a. which wholly or partly owns, operates, controls, or manages the named insured; b. which was operated, controlled, or managed by the named insured; or c. in which any insured has an ownership interest of 15% or more, at any time during or after the performance of the technology services giving rise to the claim; or
2. any entity for which any insured is an officer or director at the time the claim is made.
Affiliate does not include a subsidiary or an acquired entity.
Bodily injury means physical injury, sickness, disease, death, humiliation, mental injury, mental anguish, emotional distress, suffering, or shock sustained by a person.
Breach of
confidentiality
means breach of any duty of confidentiality or unauthorized interception or recording of images or sound in violation of any civil anti-wiretap statute.
Breach of contract means the unintentional breach of a written contract with your client.
Claim means any written assertion of liability or any written demand for financial compensation or non-monetary relief.
Claim expenses means the following sums incurred in excess of the retention and with our prior consent:
1. all reasonable and necessary fees, costs, and expenses (including the fees of attorneys and experts) incurred in the investigation, defense, or appeal of a claim; and
2. premiums on appeal bonds, attachment bonds, or similar bond, but we will have no obligation to apply for or furnish any such bonds.
Client means any person or entity with whom you have entered into a written contract to provide services or deliverables that expressly fall within your technology services.
Damages means a monetary judgment or monetary award that you are legally obligated to pay (including pre- or post-judgment interest and claimant’s attorney fees) or a monetary settlement agreed to by you and us.
Damages will not mean:
1. fines, civil or criminal penalties, taxes, or sanctions;
2. any punitive, exemplary, or multiple damages; however, we will pay punitive or exemplary damages to the extent insurable in any applicable jurisdiction that most favors Technology Professional Liability Coverage Part
PLPTCH P0001 CW (01/20) Page 9 of 11
coverage;
3. the return or reduction of fees, commissions, profits, or charges for goods provided or services rendered; however, we will pay such amounts if asserted as damages in connection with an otherwise covered claim;
4. restitution, disgorgement of profits, or unjust enrichment;
5. the cost of complying with injunctive relief;
6. amounts you agree to indemnify; however, we will pay such amounts to the extent they are explicitly covered under this Coverage Part;
7. any coupons, discounts, prizes, or other incentives, unless agreed in advance by us in our discretion; provided any such amounts will not include any profits to you;
8. any liquidated damages, but only to the extent such damages exceed the amount for which you would have been liable in the absence of the liquidated damages agreement; or
9. any service credits, except as provided under Section II. Coverage enhancements, D.
Service credits.
Defamation means any form of defamation, including but not limited to libel, slander, trade libel, product disparagement, or injurious falsehood.
Fraud means any fraud or dishonesty of your employees, but only if the actual or alleged fraud or dishonesty was not committed or allegedly committed by any:
1. executive; or
2. employee of the insured organization if any executive knew or had reason to know of such conduct by the employee.
Indemnity means an indemnification obligation owed by you to a client under a written contract.
Insured organization means the named insured or any subsidiary or acquired entity.
Intellectual property
infringement
means intellectual property infringement (but not any patent infringement), including but not limited to misappropriation of trade secret, copyright infringement, trademark infringement, trademark dilution, trade dress infringement, publicity rights violations, cybersquatting violations, moral rights violations, any act of passing-off, or any misappropriation of formats, characters, trade names, character names, titles, plots, musical compositions, voices, slogans, graphic material, or artwork.
Invasion of privacy means false light, intrusion upon a person’s seclusion, or misappropriation of a person’s picture, name, or voice for commercial gain.
Negligence means any negligent act, error, or omission, breach of any duty to use reasonable care, or negligent misrepresentation.
Pollutants means any solid, liquid, gaseous, biological, radiological, or thermal irritant or contaminant, including smoke, vapor, asbestos, silica, dust, nanoparticles, fibers, soot, fumes, acids, alkalis, chemicals, nuclear materials, germs, mold, and waste. Waste includes, but is not limited to, materials to be recycled, reconditioned, or reclaimed.
Potential claim means any acts, errors, or omissions of an insured or other circumstances reasonably likely to lead to a claim covered under this policy.
Property damage means physical loss of, physical damage to, or destruction or loss of use of any tangible property.
Retention means the amount stated as such under the Technology Professional Liability Coverage Part section of the Declarations.
Technology Professional Liability Coverage Part
PLPTCH P0001 CW (01/20) Page 10 of 11
Retroactive date means the date stated as such in the Declarations; provided, for any acquired entity acquired or created during the policy period, the retroactive date for such acquired entity will be the date the named insured created, merged with, or acquired effective control of the entity.
Technology products means information technology or telecommunications hardware, software, firmware, or related electronic equipment.
Technology services means the following services performed for others:
1. designing, developing, customizing, programming, testing, distributing, publishing, installing, implementing, integrating, hosting, supporting, repairing, and maintaining software;
2. planning, designing, developing, installing, implementing, integrating, supporting, repairing, and maintaining computer systems, computer or telecommunications networks, or electronic systems;
3. managing and operating computer systems, computer or telecommunications networks and facilities, including colocation, data center, and cloud computing services, and managed cybersecurity services;
4. data processing, management, warehousing, and hosting services, including data entry, conversion, destruction, backup, and recovery;
5. information technology or telecommunications consulting, training, project management, staffing, and support services;
6. internet, voice, video, email, text, data, and broadband services, and related call center and customer service support;
7. services as an Application Service Provider (ASP), Software-as-a-Service Provider (SaaS), Platform-as-a-Service Provider (PaaS), Infrastructure-as-a-Service Provider (IaaS), or Internet Service Provider (ISP);
8. website design and development services, web hosting services, web portal services, domain name services, or search engine services;
9. digital marketing services, search engine optimization services, or social media management services;
10. information technology or telecommunications hardware sales, installation, integration, testing, repair, maintenance, and support services; and
11. any services described as Covered Professional Services under the Technology Professional Liability Coverage Part section of the Declarations.
Technology services also includes the supply, provision, or delivery of technology products.
Unfair practices means unfair competition, deceptive business practices, or false designation of origin, but only when asserted in conjunction with and based on the same allegations as a claim for intellectual property infringement.
You, your, or insured means a named insured, subsidiary, employee, executive, acquired entity, or additional insured, as defined in Section III. Who is an insured.
VIII. Other provisions
affecting
coverage
Technology Professional Liability Coverage Part
PLPTCH P0001 CW (01/20) Page 11 of 11
Coverage territory A. This Coverage Part will apply to the performance of your technology services anywhere in the world. However, with respect to claims brought outside the United States, its territories or possessions, or Canada, this Coverage Part will not apply:
1. to any claim brought in any country in which the United States (or any of its departments, agencies, or subdivisions) administers or enforces economic or trade sanction laws; or
2. if it would otherwise be in violation of the laws of the United States.
Media Liability Coverage Part
I. What is covered We will pay up to the coverage part limit for damages and claim expenses in excess of the retention for covered claims against you for any actual or alleged:
1. copyright infringement, trademark infringement, trademark dilution, trade dress infringement, publicity rights violations, or any misappropriation of content, formats, characters, trade names, character names, titles, voices, slogans, graphic material, or artwork;
2. invasion of privacy, intrusion upon seclusion, publication of private facts, false light, or misappropriation of name or likeness;
3. defamation, libel, slander, trade libel, product disparagement, or injurious falsehood;
4. unintentional infliction of emotional distress or outrage based on harm to the character or reputation of any person; or
5. negligence in connection with your media activities or your advertising of your professional services,
provided the claim:
a. results from your media activities or your advertising of your professional services performed on or after the retroactive date;
b. is first made against you during the policy period; and c. is reported to us in accordance with Section V. Your obligations.
II. Coverage
enhancements We will also make the following payments:
Supplemental payments A. We will pay reasonable expenses, including loss of wages and a $250 travel per diem, incurred by you if we require you to attend depositions, arbitration proceedings, or trials in connection with the defense of a covered claim, but we will not pay more than an aggregate of $10,000 per claim for such expenses, regardless of the number of insureds.
No retention will apply to amounts we pay under this subsection A, and such amounts will be in addition to, and not part of, the coverage part limit.
III. Who is an
insured
For purposes of this Coverage Part, you, your, or insured means a named insured, subsidiary, employee, or acquired entity, as defined below:
Named insured means the individual, corporation, partnership, limited liability company, limited partnership, or other entity identified in Item 1 of the Declarations.
Subsidiary means any entity of which the named insured has majority ownership before or as of the inception of the policy period.
Employee means any past, present, or future:
1. person employed by the named insured or subsidiary as a permanent, part-time, seasonal, leased, or temporary employee, or any volunteer; or
2. partner, director, officer, or board member (or equivalent position) of the named insured or subsidiary,
but only while in the course of their performance of media activities or advertising of professional services on behalf of or at the direction of such named insured or subsidiary.
Acquired entity means an entity in which the named insured, during the policy period:
1. acquires substantially all of the assets;
PLP P0005 CW (06/14) Page 1 of 8
Media Liability Coverage Part
2. acquires the majority of its voting securities, as a result of which it becomes a subsidiary; or
3. merges and leaves the named insured as the surviving entity.
With respect to an acquired entity whose revenues exceed 10% of the annual revenues of the named insured at the time of its creation or acquisition, any coverage under this policy will expire 90 days after the effective date of its creation or acquisition unless, within such 90 day period:
1. the named insured provides us with written notice of such creation or acquisition;
2. the named insured provides us with information related to such creation or acquisition as we may reasonably require;
3. the named insured accepts any special terms, conditions, exclusions, or additional premium charge as we may reasonably require; and
4. we agree by written endorsement to provide such coverage.
This policy will apply to an acquired entity only with respect to your media activities or your advertising of your professional services performed after the acquisition, merger, or creation.
IV. Defense and
settlement of
claims
Defense We have the right and duty to defend any covered claim, even if such claim is groundless, false, or fraudulent.
We have the right to select and appoint counsel to defend you against a covered claim. You may request in writing that we appoint defense counsel of your own choice, but whether to grant or deny such a request will be at our sole discretion.
Settlement We have the right to solicit and negotiate settlement of any claim but will not enter into a settlement without your consent, which you agree not to withhold unreasonably. If you withhold consent to a settlement recommended by us and acceptable to the party who made the claim, the most we will pay for that claim is the sum of:
1. the amount of our recommended settlement;
2. claim expenses incurred up to the date of our recommendation;
3. 50% of all claim expenses incurred after our recommendation; and
4. 50% of all damages in excess of the settlement amount recommended by us.
V. Your obligations
Notifying us of claims You must give written notice to us of any claim as soon as possible, but in any event, no later than 60 days after the end of the policy period.
All such notifications must be in writing and include a copy of the claim, and must be submitted to us via the designated email address or mailing address identified in Item 6 of the Declarations.
Notifying us of potential
claims
You have the option of notifying us of potential claims that may lead to a covered claim against you.
In order to do so, you must give written notice to us as soon as possible and within the policy period, and the notice must, to the greatest extent possible, identify the details of the potential claim, including identifying the potential claimant(s), the likely basis for liability, the likely PLP P0005 CW (06/14) Page 2 of 8
Media Liability Coverage Part
demand for relief, and any additional information about the potential claim we may reasonably request.
The benefit to you of notifying us of a potential claim is that if an actual claim arises from the same circumstances as the properly notified potential claim, then we will treat that claim as if it had first been made against you on the date you properly notified us of it as a potential claim, even if that claim is first made against you after the policy period has expired.
All potential claim notifications must be in writing and submitted to us via the designated email address or mailing address identified in Item 6 of the Declarations.
Retention Our obligation to pay damages and claim expenses under this Coverage Part is in excess of the retention, which you must pay in connection with each covered claim.
VI. Exclusions –
What is not
covered
We will have no obligation to pay any sums under this Coverage Part, including any damages or claim expenses, for any claim:
Antitrust/deceptive trade
practices
1. based upon or arising out of any actual or alleged:
a. false, deceptive, or unfair trade practices;
b. unfair competition, impairment of competition, restraint of trade, or antitrust violations;
c. violation of the Sherman Anti-Trust Act, the Clayton Act, the Robinson-Patman Act, all including as may be amended, or any similar foreign, federal, state, or local statutes, rules, or regulations; or
d. deceptive or misleading advertising.
Bodily injury 2. based upon or arising out of any actual or alleged bodily injury; however, this exclusion will not apply to a claim for emotional distress or outrage covered under part 4 of Section I. What is covered.
Breach of contract 3. based upon or arising out of any actual or alleged breach of any contract or agreement, or any liability of others that you assume under any contract or agreement; however, this exclusion will not apply to any liability you would have in the absence of the contract or agreement.
Breach of warranty/
guarantee
4. based upon or arising out of any actual or alleged breach of express warranties or guarantees; however, this exclusion will not apply to any liability you would have in the absence of the warranties or guarantees.
Client content 5. based upon or arising out of any content provided to you by your client; however, we will pay claim expenses for any claims against you based upon or arising out of such content.
Collection of data without
knowledge
6. based upon or arising out of any actual or alleged:
a. collection of personally identifiable information by you (or others on your behalf) without the knowledge or permission of the person to whom the personally identifiable information relates; or
b. use of personally identifiable information by you (or others on your behalf) in violation of applicable law.
Commercial Dispute 7. based upon or arising out of any actual or alleged commercial dispute with your business partner or business associate, including but not limited to any reseller, distributor, original equipment manufacturer, third-party sales agent, systems integrator, or joint venturer, but only to the extent such a claim is based upon:
a. a commission or royalty, or any other term upon which such partner or associate is PLP P0005 CW (06/14) Page 3 of 8
Media Liability Coverage Part
to be compensated in connection with doing business with you, or any compensation or remuneration promised or owed by you pursuant to those terms; or
b. your decision to cease doing business with such a partner or associate.
Cramming/slamming 8. based upon or arising out of:
a. the imposition of charges for services or content in relation to telephone, cell phone, wireless data, cable television, internet, voice over internet protocol (VoIP) or other similar telecommunications services, which charges have not been adequately disclosed or which services or content have not been requested by the consumer; or
b. the unauthorized switching of telecommunications carriers, including providers of telephone, cell phone, wireless data, cable television, internet, voice over internet protocol (VoIP) or other similar services.
Criminal proceedings 9. brought in the form of a criminal proceeding, including but not limited to a criminal investigation, grand jury proceeding, or criminal action.
Employment related liability 10. based upon or arising out of any actual or alleged:
a. obligation under any workers’ compensation, unemployment compensation, employers’ liability, fair labor standards, labor relations, wage and hour, or disability benefit law, including any similar provisions of any foreign, federal, state, or local statutory or common law;
b. liability or breach of any duty or obligation owed by you as an employer or prospective employer; or
c. harassment, wrongful termination, retaliation, or discrimination, including but not limited to adverse or disparate impact.
Excluded costs and
damages
11. to the extent it seeks or includes:
a. fines, penalties, taxes, or sanctions against you;
b. overhead costs, general business expenses, salaries, or wages incurred by you; c. the return, reduction, or restitution of fees, commissions, profits, or charges for goods provided or services rendered;
d. liquidated or multiple damages;
e. restitution, disgorgement of profits, any advantage to which you were not legally entitled, or unjust enrichment; or
f. the cost of complying with injunctive relief.
Excluded statutory violations 12. based upon or arising out of any actual or alleged violation of the following laws:
a. the Securities Act of 1933;
b. the Securities Exchange Act of 1934;
c. any state blue sky or securities laws;
d. the Racketeer Influenced and Corrupt Organizations Act, 18 U.S.C. § 1961 et seq.; or
e. the Employee Retirement Income Security Act of 1974, all including as may be amended, or any similar provisions of any foreign, federal, state, or local statutory or common law and any rules or regulations promulgated under such laws.
Failure to maintain insurance
or bonds
13. based upon or arising out of any actual or alleged failure to procure or maintain adequate insurance or bonds.
PLP P0005 CW (06/14) Page 4 of 8
Media Liability Coverage Part
False or misleading
advertising
14. based upon or arising out of any actual or alleged false or misleading advertisement, including any inaccurate, inadequate, or incomplete description of your goods, products, or services; however this exclusion will not apply to any claim for trademark infringement or false designation of origin based on your alleged unauthorized use of another’s trademark.
Government investigation/
enforcement
15. based upon or arising out of any actual or alleged governmental investigation or enforcement of any state or federal regulation, including but not limited to any regulation promulgated by the Federal Trade Commission, Federal Communications Commission, or the Securities and Exchange Commission, or ASCAP, BMI, SESAC, or other similar licensing organization.
Insured vs. insured 16. brought by or on behalf of one insured or affiliate against another insured or affiliate.
Intentional acts 17. based upon or arising out of any actual or alleged fraud, dishonesty, criminal conduct, or any knowingly wrongful, malicious, or intentional acts or omissions, except that we will pay claim expenses until there is a final adjudication establishing such conduct.
This exclusion will apply to the named insured only if the conduct was committed or allegedly committed by any:
a. partner, director, officer, or member of the board (or equivalent position) of the named insured; or
b. employee of the named insured if any partner, director, officer, member of the board (or equivalent position) of the named insured knew or had reason to know of such conduct by the employee.
This exclusion will apply separately to each insured and will not apply to any insured who did not commit, participate in, acquiesce to, or ratify such conduct committed by another insured.
License/royalties 18. based upon or arising out of any actual or alleged obligation to pay any licensing fee or royalty.
Manufacture or design of
goods/products
19. based upon or arising out of any goods or products designed, manufactured, sold, handled, or distributed by you.
Misappropriation of funds 20. based upon or arising out of the actual or alleged theft, misappropriation, commingling, or conversion of any funds, monies, assets, or property.
Network security 21. based upon or arising out of any actual or alleged failure of computer security, including but not limited to the:
a. transmission of malicious software such as a computer virus, worm, logic bomb, or Trojan horse;
b. failure to prevent a denial of service attack;
c. failure to prevent authorized access to any computer system, personally identifiable information, or confidential corporate information held or transmitted in any form; or d. failure to prevent damage to any third party digital asset.
Ownership of content 22. based upon or arising out of any actual or alleged disputes with any of your present or former directors, officers, trustees, partners, joint venturers, employees, agents, or independent contractors concerning ownership of or the exercise of rights relating to content, material, or services supplied to you by any of them.
Patent/trade secret 23. based upon or arising out of any actual or alleged infringement, use, disclosure, or misappropriation of any patent or trade secret.
Pollution/environmental 24. based upon or arising out of any actual, alleged, or threatened discharge, dispersal, release, or escape of pollutants, including any direction or request to test for, monitor, clean up, remove, contain, treat, detoxify, or neutralize pollutants.
PLP P0005 CW (06/14) Page 5 of 8
Media Liability Coverage Part
Prior acts/notice/knowledge 25. based upon or arising out of any:
a. claim or potential claim that was the subject of any notice given under any other policy of which this policy is a renewal or replacement; b. claim or potential claim that was the subject of, or is related to, any prior or pending litigation, claim, written demand, arbitration, administrative or regulatory proceeding or investigation, or licensing proceeding that was filed or commenced against you and of which you had notice prior to the policy period; or c. other matter you had knowledge of prior to the policy period, and you had a reasonable basis to believe could result in a claim.
However, if this policy is a renewal or replacement of a previous policy we issued that provided materially identical coverage, and is part of an unbroken chain of successive policies issued by us, the policy period referred to in paragraphs b and c, above, will be the policy period of the first such policy we issued.
Privacy 26. based upon or arising out of any actual or alleged:
a. unauthorized acquisition, access, use, or disclosure of, improper collection or retention of, or failure to protect any non-public personally identifiable information or confidential corporate information that is in your care, custody, or control; or b. violation of any privacy law or consumer data protection law protecting against the use, collection, or disclosure of any information about a person or any confidential corporate information.
Privacy policy violations 27. based upon or arising out of any actual or alleged:
a. failure to have or appropriately display a privacy policy; b. failure of your privacy policy to comply with any federal, state, local, or foreign statutes, ordinances, regulations, or other laws;
c. breach of your privacy policy; or
d. changing of the terms of your privacy policy.
Professional services 28. based upon or arising out of your actual or alleged performance of or failure to perform professional services or any other services customarily provided by an architect, engineer, surveyor, physician, surgeon, dentist, or other healthcare provider, accountant, insurance agent/broker, investment advisor, securities broker/dealer, or attorney.
Property damage 29. based upon or arising out of any actual or alleged property damage.
Repair/replace/recall 30. based upon or arising out of any actual or alleged repair, upgrade, correction, recall, replacement, withdrawal, removal, or disposal costs incurred by you or others.
Scareware 31. based upon or arising out of any actual or alleged provision or transmission of Scareware, including but not limited to software that produces false or alarming warning messages.
Sexual misconduct 32. based upon or arising out of any actual, alleged, or threatened abuse, molestation, harassment, mistreatment, or maltreatment of a sexual nature, including the negligent employment, investigation, supervision, training, or retention of a person who commits such conduct, or the failure to report such conduct to the proper authorities.
Software copyright 33. based upon or arising out of any actual or alleged copyright infringement related to software or source code.
Subsidiary outside control of
named insured
34. a. based upon or arising out of media activities or advertising of professional services performed by or on behalf of a past or present subsidiary while the named insured does not have majority ownership or management control of it; or b. made against a subsidiary or anyone acting on its behalf while the named insured does not have majority ownership or management control of it.
PLP P0005 CW (06/14) Page 6 of 8
Media Liability Coverage Part
Sweepstakes/gambling/
lotteries
35. based upon or arising out of any:
a. actual or alleged provision of any sweepstakes, gambling activities, or lotteries; or b. price discounts, prizes, awards, money, or valuable consideration given in excess of a total contracted or expected amount, including but not limited to over redemption or under redemption of coupons, discounts, awards, or prizes.
Unsolicited telemarketing 36. based upon or arising out of any actual or alleged violation of any federal, state, local, or foreign statutes, ordinances, or regulations relating to unsolicited telemarketing, solicitations, emails, faxes, text messages, or any other communications of any type or nature, including but not limited to the Telephone Consumer Protection Act, CAN-SPAM Act, or any “anti-spam” or “do-not-call” statutes, ordinances, or regulations.
Virtual currency 37. based upon or arising out of any actual or alleged virtual currency, including but not limited to virtual goods exchanged in connection with an Internet game or virtual economy.
VII. Definitions The following definitions apply to this Coverage Part. Additional definitions are contained in Section III. Who is an insured, and in the General Terms and Conditions, Section VI. Definitions applicable to all Coverage Parts.
Advertising means the online, digital, or electronic promotion of your professional services by broadcast, transmission, dissemination, telecast, cablecast, podcast, streaming, publication, republication, or by use of a website or social media.
Affiliate means any person or entity related to any insured through common ownership, control, or management as follows:
1. any person or entity:
a. which wholly or partly owns, operates, controls, or manages the named insured; b. which was operated, controlled, or managed by the named insured; or c. in which any insured has an ownership interest of 15% or more, at anytime during or after the performance of the media activities or your advertising of your professional services giving rise to the claim; or
2. any entity for which any insured is an officer or director at the time the claim is made.
Affiliate does not include a subsidiary.
Bodily injury means physical injury, sickness, disease, death, humiliation, mental injury, mental anguish, emotional distress, suffering, or shock sustained by a person.
Claim means any written assertion of liability or any written demand for financial compensation or nonmonetary relief.
Claim expenses means the following sums incurred in excess of the retention and with our prior consent:
1. all reasonable and necessary fees, costs, and expenses (including the fees of attorneys and experts) incurred in the investigation, defense, or appeal of a claim; and
2. premiums on appeal bonds, attachment bonds, or similar bond, but we will have no obligation to apply for or furnish any such bonds.
Damages means the following amounts incurred in excess of the retention:
1. a monetary judgment or monetary award that you are legally obligated to pay (including pre- or post-judgment interest and awards of claimant’s attorney fees); or
2. a monetary settlement negotiated by us with your consent.
Damages includes punitive damages to the full extent they are insurable under the law of any applicable jurisdiction that most favors coverage.
PLP P0005 CW (06/14) Page 7 of 8
Media Liability Coverage Part
Media activities means the publication, broadcast, dissemination, or release of media content in connection with your professional services.
Media content means the substance of any communication, including but not limited to language, data, facts, fiction, music, photographs, images, artistic expression, or visual or graphic materials.
Pollutants means any solid, liquid, gaseous, biological, radiological, or thermal irritant or contaminant, including smoke, vapor, asbestos, silica, dust, nanoparticles, fibers, soot, fumes, acids, alkalis, chemicals, nuclear materials, germs, mold, and waste. Waste includes, but is not limited to, materials to be recycled, reconditioned, or reclaimed.
Potential claim means any acts, errors, or omissions of an insured or other circumstances reasonably likely to lead to a claim covered under this policy.
Professional services means only those services identified as Covered Professional Services under the Media Liability Coverage Part of the Declarations.
Property damage means physical loss of, physical damage to, or destruction or loss of use of any tangible property.
Retention means the amount stated as such under the Media Liability Coverage Part of the Declarations.
You, your, or insured means a named insured, subsidiary, employee, or acquired entity, as defined in Section III.
Who is an insured.
PLP P0005 CW (06/14) Page 8 of 8
Data Breach and Privacy Security Liability Coverage Part I. What is covered A. We will pay up to the coverage part limit for breach costs in excess of the retention incurred as a result of a breach occurring on or after the retroactive date or 90 days before the beginning of the policy period, whichever is earlier, provided the breach is first discovered by you during the policy period and is reported to us in accordance with Section V. Your obligations.
B. We will also pay up to the coverage part limit for damages and claim expenses in excess of the retention if the performance of your business operations by you or anyone on your behalf (including your subcontractors, outsourcers, or independent contractors) on or after the retroactive date results in a covered claim against you for any actual or alleged:
1. network security breach;
2. privacy liability;
3. breach of contract;
4. contractual indemnity - third party;
5. contractual indemnity - breach costs;
6. deceptive trade practices, but only when asserted against you in conjunction with and based on the same allegations as a covered claim under 1, 2, or 3 above; or
7. unintentional infliction of emotional distress, but only when asserted against you in conjunction with and based on the same allegations as a covered claim under 1, 2, or 3 above,
provided the claim is first made against you during the policy period and is reported to us in accordance with Section V. Your obligations.
II. Coverage
enhancements We will also make the following payments:
Regulatory action sublimit A. We will pay up to the limit stated in the Declarations for damages, claim expenses, and civil or regulatory fines or penalties that are not compensatory in nature for any regulatory action, provided the regulatory action is first brought against you during the policy period, it is brought in connection with and based on the same allegations as a covered claim under Section I. What is covered, B. 1, 2, or 3, it results from the performance of your business operations by you or anyone on your behalf (including your subcontractors, outsourcers, or independent contractors) on or after the retroactive date, and it is reported to us in accordance with Section V. Your obligations.
Any payment we make under this subsection A is subject to the retention, and such payments will be a part of, and not in addition to, the coverage part limit.
Regulatory compensatory
sublimit
B. We will pay up to the limit stated in the Declarations for damages that are intended to compensate the individuals or entities to whom the personally identifiable information or confidential corporate information relates for any regulatory action, provided the regulatory action is first brought against you during the policy period, it is brought in connection with and based on the same allegations as a covered claim under Section I.
What is covered, B. 1, 2, or 3, it results from the performance of your business operations by you or anyone on your behalf (including your subcontractors, outsourcers, or independent contractors) on or after the retroactive date, and it is reported to us in accordance with Section V. Your obligations.
Any payment we make under this subsection B is subject to the retention, and such payments will be a part of, and not in addition to, the coverage part limit.
PCI fines/penalties sublimit C. We will pay up to the limit stated in the Declarations for covered PCI fines/penalties assessed against you (including PCI fines/penalties resulting from a breach of contract), as a result of a breach arising out of the performance of your business PLP P0004 CW (06/14) Page 1 of 10
Data Breach and Privacy Security Liability Coverage Part operations by you or anyone on your behalf (including your subcontractors, outsourcers, or independent contractors) on or after the retroactive date, provided the breach is first discovered by you during the policy period and is reported to us in accordance with Section V. Your obligations.
Any payment we make under this subsection C is subject to the retention, and such payments will be a part of, and not in addition to, the coverage part limit.
PCI assessments sublimit D. We will pay up to the limit stated in the Declarations for covered PCI assessments against you (including PCI assessments resulting from a breach of contract), as a result of a breach arising out of the performance of your business operations by you or anyone on your behalf (including your subcontractors, outsourcers, or independent contractors) on or after the retroactive date, provided the breach is first discovered by you during the policy period and is reported to us in accordance with Section V. Your obligations.
Any payment we make under this subsection D is subject to the retention, and such payments will be a part of, and not in addition to, the coverage part limit.
Supplemental payments E. We will pay reasonable expenses, including loss of wages and a $250 travel per diem, incurred by you if we require you to attend depositions, arbitration proceedings, or trials in connection with the defense of a covered claim, but we will not pay more than an aggregate of $10,000 per claim for such expenses, regardless of the number of insureds.
No retention will apply to amounts we pay under this subsection E, and such amounts will be in addition to, and not part of, the coverage part limit.
III. Who is an
insured
For purposes of this Coverage Part, you, your, or insured means a named insured, subsidiary, employee, or acquired entity, as defined below:
Named insured means the individual, corporation, partnership, limited liability company, limited partnership, or other entity identified in Item 1 of the Declarations.
Subsidiary means any entity of which the named insured has majority ownership before or as of the inception of the policy period.
Employee means any past, present, or future:
1. person employed by the named insured or subsidiary as a permanent, part-time, seasonal, leased, or temporary employee, or any volunteer; or
2. partner, director, officer, or board member (or equivalent position) of the named insured or subsidiary,
but only while in the course of their performance of business operations on behalf of or at the direction of such named insured or subsidiary.
Acquired entity means an entity in which the named insured, during the policy period:
1. acquires substantially all of the assets;
2. acquires the majority of its voting securities, as a result of which it becomes a subsidiary; or
3. merges and leaves the named insured as the surviving entity.
With respect to an acquired entity whose revenues exceed 10% of the annual revenues of the named insured at the time of its creation or acquisition, any coverage under this policy will expire 90 days after the effective date of its creation or acquisition unless, within such 90 day period:
1. the named insured provides us with written notice of such creation or acquisition; PLP P0004 CW (06/14) Page 2 of 10
Data Breach and Privacy Security Liability Coverage Part
2. the named insured provides us with information related to such creation or acquisition as we may reasonably require;
3. the named insured accepts any special terms, conditions, exclusions, or additional premium charge as we may reasonably require; and
4. we agree by written endorsement to provide such coverage.
This policy will apply to an acquired entity only with respect to your business operations performed after the acquisition, merger, or creation.
IV. Defense and
settlement of
claims
Defense We have the right and duty to defend any covered claim, even if such claim is groundless, false, or fraudulent.
We have the right to select and appoint counsel to defend you against a covered claim. You may request in writing that we appoint defense counsel of your own choice, but whether to grant or deny such a request will be at our sole discretion.
Settlement We have the right to solicit and negotiate settlement of any claim but will not enter into a settlement without your consent, which you agree not to withhold unreasonably. If you withhold consent to a settlement recommended by us and acceptable to the party who made the claim, the most we will pay for that claim is the sum of:
1. the amount of our recommended settlement;
2. claim expenses incurred up to the date of our recommendation;
3. 50% of all claim expenses incurred after our recommendation; and
4. 50% of all damages in excess of the settlement amount recommended by us.
V. Your obligations
Notifying us of breaches You must give written notice to us of any breach as soon as possible after it is first discovered by you, but in any event no later than: (a) the end of the policy period; or (b) 30 days after the end of the policy period for a breach discovered in the last 30 days of the policy period.
All such notifications must be in writing and include a description of the breach, and must be submitted to us via the designated email address or mailing address identified in Item 6 of the Declarations.
In addition, you must also inform, or allow us to inform, the appropriate law enforcement authorities for any breach requiring such notification.
Notifying us of claims and
coverage enhancements
You must give written notice to us of any claim, or any other matter covered under Section II.
Coverage enhancements, as soon as possible, but in any event, no later than 60 days after the end of the policy period.
All such notifications must be in writing and include a copy of the claim or other covered matter, and must be submitted to us via the designated email address or mailing address identified in Item 6 of the Declarations.
Notifying us of potential
claims
You have the option of notifying us of potential claims that may lead to a covered claim against you.
In order to do so, you must give written notice to us as soon as possible and within the policy period, and the notice must, to the greatest extent possible, identify the details of the potential claim, including identifying the potential claimant(s), the likely basis for liability, the likely PLP P0004 CW (06/14) Page 3 of 10
Data Breach and Privacy Security Liability Coverage Part demand for relief, and any additional information about the potential claim we may reasonably request.
The benefit to you of notifying us of a potential claim is that if an actual claim arises from the same circumstances as the properly notified potential claim, then we will treat that claim as if it had first been made against you on the date you properly notified us of it as a potential claim, even if that claim is first made against you after the policy period has expired.
All potential claim notifications must be in writing and submitted to us via the designated email address or mailing address identified in Item 6 of the Declarations.
Retention and limits Our obligation to pay breach costs, damages, claim expenses, PCI fines/penalties, or PCI assessments under this Coverage Part is in excess of the retention, which you must pay in connection with each covered breach and/or claim.
All breaches arising from the same circumstances will be treated as a single breach, and you will have to pay only one retention, and only one Each Breach Limit will apply. All such breaches will be deemed to have occurred on the date the first breach occurred.
If a claim, or any other matter covered under Section II. Coverage enhancements, is made against you arising from the same circumstances as a breach, the breach, claim, and coverage enhancement will be treated as a single claim, and you will have to pay only one retention, and only one Each Claim Limit will apply.
VI. Exclusions –
What is not
covered
We will have no obligation to pay any sums under this Coverage Part, including any breach costs, damages, claim expenses, PCI fines/penalties, or PCI assessments, for any breach or claim:
Antitrust/deceptive trade
practices
1. based upon or arising out of any actual or alleged:
a. false, deceptive, or unfair trade practices;
b. unfair competition, impairment of competition, restraint of trade, or antitrust violations;
c. violation of the Sherman Anti-Trust Act, the Clayton Act, the Robinson-Patman Act, all including as may be amended, or any similar foreign, federal, state, or local statutes, rules, or regulations; or
d. deceptive or misleading advertising.
However, this exclusion will not apply to a claim for deceptive trade practices asserted against you in conjunction with and based on the same allegations as a covered claim for a network security breach, privacy liability, or breach of contract.
Assumption of liability 2. based upon or arising out of any actual or alleged liability of others you assume under any contract or agreement; however, this exclusion will not apply to:
a. any liability you would have in the absence of the contract or agreement; or b. any claim for contractual indemnity - third party or contractual indemnity - breach costs.
Bodily injury 3. based upon or arising out of any actual or alleged bodily injury; however, this exclusion will not apply to a claim for unintentional infliction of emotional distress asserted against you in conjunction with and based on the same allegations as a covered claim for a network security breach, privacy liability, or breach of contract.
Breach of warranty/
guarantee
4. based upon or arising out of any actual or alleged breach of express warranties or guarantees, except any warranty or guarantee to maintain the confidentiality of personally identifiable information or confidential corporate information. This exclusion PLP P0004 CW (06/14) Page 4 of 10
Data Breach and Privacy Security Liability Coverage Part will not apply to any liability you would have in the absence of the warranties or guarantees.
Collection of data without
knowledge
5. based upon or arising out of any actual or alleged:
a. collection of personally identifiable information by you (or others on your behalf) without the knowledge or permission of the data subject; or b. use of personally identifiable information by you (or others on your behalf) in violation of applicable law.
Criminal proceedings 6. brought in the form of a criminal proceeding, including but not limited to a criminal investigation, grand jury proceeding, or criminal action.
Employment related liability 7. based upon or arising out of any actual or alleged:
a. obligation under any workers’ compensation, unemployment compensation, employers’ liability, fair labor standards, labor relations, wage and hour, or disability benefit law, including any similar provisions of any foreign, federal, state, or local statutory or common law;
b. liability or breach of any duty or obligation owed by you as an employer or prospective employer; or
c. harassment, wrongful termination, retaliation, or discrimination, including but not limited to adverse or disparate impact.
Excluded costs and
damages
8. to the extent it seeks or includes:
a. fines, penalties, taxes, or sanctions against you, except we will pay:
i. civil or regulatory fines or penalties arising out of a regulatory action, if insurable by law; or
ii. PCI fines/penalties assessed against you, if insurable by law; b. overhead costs, general business expenses, salaries, or wages incurred by you; c. the return, reduction, or restitution of fees, commissions, profits, or charges for goods provided or services rendered;
d. liquidated or multiple damages;
e. restitution, disgorgement of profits, any advantage to which you were not legally entitled, or unjust enrichment;
f. the cost of complying with injunctive relief;
g. special, indirect, or consequential damages; or
h. service credits.
Excluded statutory violations 9. based upon or arising out of any actual or alleged violation of the following laws:
a. the Securities Act of 1933;
b. the Securities Exchange Act of 1934;
c. any state blue sky or securities laws;
d. the Racketeer Influenced and Corrupt Organizations Act, 18 U.S.C. § 1961 et seq.; e. the Employee Retirement Income Security Act of 1974; f. the Fair Debt Collection Practices Act; or
g. the Fair Credit Reporting Act,
all including as may be amended, or any similar provisions of any foreign, federal, state, or local statutory or common law and any rules or regulations promulgated under such laws.
PLP P0004 CW (06/14) Page 5 of 10
Data Breach and Privacy Security Liability Coverage Part Failure to maintain insurance
or bonds
10. based upon or arising out of any actual or alleged failure to procure or maintain adequate insurance or bonds.
Funds transfer 11. for any actual or alleged loss, theft, or transfer of:
a. your funds, monies, or securities;
b. the funds, monies, or securities of others in your care, custody, or control; or c. the funds, monies, or securities in the care, custody, or control of any third party for whom you are legally liable,
including the value of any funds, monies, or securities transferred by you or others on your behalf.
Government investigation/
enforcement
12. based upon or arising out of any actual or alleged governmental investigation or enforcement of any state or federal regulation, including but not limited to any regulation promulgated by the Federal Trade Commission, Federal Communications Commission, or the Securities and Exchange Commission, or ASCAP, BMI, SESAC, or other similar licensing organization; however, this exclusion will not apply to a covered regulatory action.
Industrial control systems/
SCADA
13. based upon or arising out of the use of any control systems used in industrial production, including but not limited to supervisory control and data acquisition (SCADA) systems, distributed control systems, or programmable logic controllers.
Infrastructure interruption 14. based upon or arising out of any actual or alleged failure or interruption of service provided by an internet service provider, telecommunications provider, utility provider, or other infrastructure provider; however, this exclusion will not apply to a breach of personally identifiable information that was stored in the cloud, on remote servers, at a co-location or data hosting service, or any other method of storing data in a location not in your direct control.
Insured vs. insured 15. brought by or on behalf of one insured or affiliate against another insured or affiliate; however, this exclusion will not apply to an otherwise covered claim brought by an employee:
a. based upon or arising out of such employee’s personally identifiable information; or
b. solely based on your business operations performed when such employee was not working for you.
Intellectual property 16. based upon or arising out of any actual or alleged infringement, use, or disclosure of any intellectual property, including but not limited to copyright, trademark, trade dress, patent, service mark, service name, title, or slogan, or any publicity rights violations, cyber squatting violations, moral rights violations, any act of passing-off, or any misappropriation of trade secret.
Intentional acts 17. based upon or arising out of any actual or alleged fraud, dishonesty, criminal conduct, or any knowingly wrongful, malicious, or intentional acts or omissions, except that we will pay claim expenses until there is a final adjudication establishing such conduct.
This exclusion will apply to the named insured only if the conduct was committed or allegedly committed by any:
a. partner, director, officer, or member of the board (or equivalent position) of the named insured; or
b. employee of the named insured if any partner, director, officer, member of the board (or equivalent position) of the named insured knew or had reason to know of such conduct by the employee.
This exclusion will apply separately to each insured and will not apply to any insured who did not commit, participate in, acquiesce to, or ratify such conduct committed by another insured.
PLP P0004 CW (06/14) Page 6 of 10
Data Breach and Privacy Security Liability Coverage Part Pollution/environmental 18. based upon or arising out of any actual, alleged, or threatened discharge, dispersal, release, or escape of pollutants, including any direction or request to test for, monitor, clean up, remove, contain, treat, detoxify, or neutralize pollutants.
Prior acts/notice/knowledge 19. based upon or arising out of any:
a. claim, potential claim, or breach that was the subject of any notice given under any other policy of which this policy is a renewal or replacement; b. claim, potential claim, or breach that was the subject of, or is related to, any prior or pending litigation, claim, written demand, arbitration, administrative or regulatory proceeding or investigation, or licensing proceeding that was filed or commenced against you and of which you had notice prior to the policy period; or c. other matter you had knowledge of prior to the policy period, and you had a reasonable basis to believe could result in a claim or breach.
However, if this policy is a renewal or replacement of a previous policy we issued that provided materially identical coverage, and is part of an unbroken chain of successive policies issued by us, the policy period referred to in paragraphs b and c, above, will be the policy period of the first such policy we issued.
Privacy policy 20. based upon or arising out of any actual or alleged:
a. failure to have or appropriately display a privacy policy; b. failure of your privacy policy to comply with any federal, state, local, or foreign statutes, ordinances, regulations, or other laws; or
c. changing of the terms of your privacy policy.
Professional services 21. based upon or arising out of the rendering of or failure to render professional services by you or anyone on your behalf; however, this exclusion will not apply to an otherwise covered breach or claim resulting in the course of performance of professional services.
Property damage 22. based upon or arising out of any actual or alleged property damage; however, this exclusion will not apply to damage to data, or destruction or loss of use of data.
Sweepstakes/gambling/
lotteries
23. based upon or arising out of any:
a. actual or alleged provision of any sweepstakes, gambling activities, or lotteries; or b. price discounts, prizes, awards, money, or valuable consideration given in excess of a total contracted or expected amount, including but not limited to over redemption or under redemption of coupons, discounts, awards, or prizes.
Unsolicited telemarketing 24. based upon or arising out of any actual or alleged violation of any federal, state, local, or foreign statutes, ordinances, or regulations relating to unsolicited telemarketing, solicitations, emails, faxes, text messages, or any other communications of any type or nature, including but not limited to the Telephone Consumer Protection Act, CAN-SPAM Act, or any “anti-spam” or “do-not-call” statutes, ordinances, or regulations.
VII. Definitions The following definitions apply to this Coverage Part. Additional definitions are contained in Section III. Who is an insured, and in the General Terms and Conditions, Section VI. Definitions applicable to all Coverage Parts.
Affiliate means any person or entity related to any insured through common ownership, control, or management.
Bodily injury means physical injury, sickness, disease, death, humiliation, mental injury, mental anguish, emotional distress, suffering, or shock sustained by a person.
PLP P0004 CW (06/14) Page 7 of 10
Data Breach and Privacy Security Liability Coverage Part Breach means the unauthorized acquisition, access, use, or disclosure of personally identifiable information, including but not limited to that resulting from the loss or theft of a device containing such personally identifiable information.
Breach costs means any of the following reasonable and necessary costs you incur with our prior written consent in response to a breach that triggers your notification obligations pursuant to any foreign, federal, state, or local statute, rule, or regulation, or that you satisfy us poses a significant risk of financial, reputational, or other harm to the affected data subjects:
1. Computer Forensic Costs: costs up to the limit stated in the Declarations for computer forensic analysis conducted by outside forensic experts to confirm a breach and to identify the affected data subjects, as well as outside attorney fees associated with the forensic reports and findings.
2. Notification Costs: the following costs up to the limit stated in the Declarations:
a. Mandatory Notification Costs: for legal services, call center services, and to notify a data subject, a regulator, or any others, as required to satisfy your notification obligations; and/or
b. Voluntary Notification Costs: to voluntarily notify affected data subjects, but only if you satisfy us that the breach poses a significant risk of financial, reputational, or other harm to the affected data subjects.
3. Credit or Identity Protection Costs: costs up to the limit stated in the Declarations to provide each affected data subject with one year (or more as required by law) of services to monitor and/or protect such data subject’s credit or identity:
a. if required by law; or
b. if you satisfy us it mitigates a significant risk of financial, reputational, or other harm to the data subject.
4. Crisis Management and Public Relations Costs: costs up to the limit stated in the Declarations for a public relations or crisis management consultant (and related costs) to:
a. reduce the likelihood of or costs of any claim covered by this policy; or b. to assist you in re-establishing your business reputation.
We will only be responsible to pay breach costs for services provided by a firm on the preapproved Hiscox Preferred Breach Response Providers List.
Prior to a breach, you may request in writing our authorization to obtain services and incur costs from a firm that is not on the pre-approved Hiscox Preferred Breach Response Providers List, but whether to grant or deny such request will be at our sole discretion.
Breach costs will not mean, and we will have no obligation to pay, any of your own costs, salaries, or overhead expenses.
Breach of contract means your unintentional breach of a written contract or public facing privacy policy relating to personally identifiable information or confidential corporate information, including a contract with a merchant bank or payment processor in which you have agreed to comply with a PCI standard, and under which you have actually or allegedly failed to maintain the security or confidentiality of payment card data.
Claim means any written assertion of liability or any written demand for financial compensation or nonmonetary relief.
Claim expenses means the following sums incurred in excess of the retention and with our prior consent:
1. all reasonable and necessary fees, costs, and expenses (including the fees of attorneys and experts) incurred in the investigation, defense, or appeal of a claim; and
2. premiums on appeal bonds, attachment bonds, or similar bond, but we will have no obligation to apply for or furnish any such bonds.
Client means any person or entity for whom you perform the services you normally provide as part of your business operations.
PLP P0004 CW (06/14) Page 8 of 10
Data Breach and Privacy Security Liability Coverage Part Contractual indemnity -
breach costs
means your contractual agreement to indemnify your client, a merchant bank, or a payment processor for breach costs that would be covered by this Coverage Part if you had incurred them, but only to the same extent as though you had incurred them.
Contractual indemnity -
third party
means your contractual agreement to indemnify your client, a merchant bank, or a payment processor for damages or claim expenses that would be covered by this Coverage Part if they arose from a claim against you, resulting from your actual or alleged:
1. violation of any privacy law or consumer data protection law protecting against disclosure of personally identifiable information or confidential corporate information;
2. breach of common law duty relating to personally identifiable information or confidential corporate information; or
3. unintentional breach of a written contract or public facing privacy policy relating to personally identifiable information or confidential corporate information, but only to the same extent as though they arose from a claim against you.
Damages means the following amounts incurred in excess of the retention:
1. a monetary judgment or monetary award that you are legally obligated to pay (including pre- or post-judgment interest and awards of claimant’s attorney fees); or
2. a monetary settlement negotiated by us with your consent.
Damages includes punitive damages to the full extent they are insurable under the law of any applicable jurisdiction that most favors coverage.
Data subject means the person to whom personally identifiable information relates.
Network security breach means negligence by you or others acting on your behalf (including your subcontractors, outsourcers, or independent contractors) in securing your computer system which results in:
1. transmission of malicious software such as a computer virus, worm, logic bomb, or Trojan horse;
2. a denial of service attack against a third party;
3. the unauthorized acquisition, access, use, or disclosure of personally identifiable information or confidential corporate information that is held or transmitted in any form;
4. prevention of authorized electronic access to any computer system, personally identifiable information, or confidential corporate information; or
5. damage to any third party digital asset.
Payment card company
rules
means any payment card company programs, rules, by-laws, policies, procedures, regulations, or requirements, including but not limited to VISA’s CISP, MasterCard’s SDP, Discover Card’s DISC, and AMEX’s DSOP, all as may be amended.
PCI assessments means any amounts assessed against you by a payment card company to recover actual costs incurred by the payment card company, issuing bank, or acquiring bank to:
1. replace credit or debit cards whose card numbers were compromised in a breach; or
2. refund fraudulent charges which resulted from a breach, whether such charges are incurred by a data subject, issuing bank, or acquiring bank.
PCI assessments does not include any PCI fines/penalties.
PCI fines/penalties means any fine or penalty expressly defined and quantified under the payment card company rules for a violation of a PCI standard; however, PCI fines/penalties does not include:
1. any amounts not expressly defined under the payment card company rules for a violation of a PCI standard;
2. civil penalties;
PLP P0004 CW (06/14) Page 9 of 10
Data Breach and Privacy Security Liability Coverage Part
3. any amounts voluntarily agreed to by you; or
4. PCI assessments.
PCI standard means the Payment Card Industry Data Security Standard, as may be amended.
Personally identifiable
information
means the following, in any form, that is in your care, custody, or control, or in the care, custody, or control of any third party for whom you are legally liable:
1. non-public individually identifiable information as defined in any foreign, federal, state, or local statute, rule, or regulation, including but not limited to unsecured protected health information as defined by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended, and any rule or regulation promulgated under HIPAA; or
2. any:
a. social security number or individual taxpayer identification number; b. driver’s license number or state identification number; c. passport number;
d. credit card number; or
e. financial account number or debit card number in combination with any required security code.
Pollutants means any solid, liquid, gaseous, biological, radiological, or thermal irritant or contaminant, including smoke, vapor, asbestos, silica, dust, nanoparticles, fibers, soot, fumes, acids, alkalis, chemicals, nuclear materials, germs, and waste. Waste includes, but is not limited to, materials to be recycled, reconditioned, or reclaimed.
Potential claim means any acts, errors, or omissions of an insured or other circumstances reasonably likely to lead to a claim covered under this policy.
Privacy liability means:
1. violation of any privacy law or consumer data protection law protecting against disclosure of personally identifiable information or confidential corporate information; or
2. breach of a common law duty relating to personally identifiable information or confidential corporate information.
Property damage means physical loss of, physical damage to, or destruction or loss of use of any tangible property.
Regulatory action means any civil regulatory action brought against you by a regulator.
Retention means the amount stated as such under the Data Breach and Privacy Security Liability Coverage Part section of the Declarations.
You, your, or insured means a named insured, subsidiary, employee, or acquired entity, as defined in Section III.
Who is an insured.
PLP P0004 CW (06/14) Page 10 of 10
Cyber Enhancements Coverage Part
I. What is covered If a limit appears on the Declarations indicating you have purchased the coverage, we agree as follows:
A. Cyber business
interruption
We will pay up to the Cyber Business Interruption limit stated in the Declarations for business interruption costs incurred as a result of a business interruption event lasting in excess of the retention, which first occurs and you discover during the policy period and is reported to us in accordance with Section V. Your obligations.
Our obligation to pay business interruption costs:
1. is not triggered unless you take reasonable steps to minimize or avoid the business interruption event; and
2. ends at the hour after either:
a. the interruption to or degradation in the availability of your website, intranet, network, computer system, programs, or data ceases; or
b. the income interruption ceases,
whichever is earlier.
B. Cyber extortion We will pay up to the Cyber Extortion limit stated in the Declarations for cyber extortion costs in excess of the retention incurred as a result of a cyber extortion event that is first made against you during the policy period and is reported to us in accordance with Section V. Your obligations.
C. Hacker damage We will pay up to the Hacker Damage limit stated in the Declarations for hacker damage costs in excess of the retention incurred as a result of a hacker damage event that you first discover during the policy period and is reported to us in accordance with Section V. Your obligations.
II. Coverage
enhancements We will also make the following payments:
Cyber business interruption
consulting costs
A. We will pay up to the limit stated in the Declarations for consulting costs you incur with our prior written consent in connection with a covered business interruption event.
Any payments we make under this subsection A will be a part of, and not in addition to, the Cyber Business Interruption limit.
Hacker damage consulting
costs
B. We will pay up to the limit stated in the Declarations for consulting costs you incur with our prior written consent in connection with a covered hacker damage event.
You must pay the retention stated in the Declarations in connection with any payment we make under this subsection B, and any payments we make will be a part of, and not in addition to, the Hacker Damage limit.
III. Who is an
insured
For purposes of this Coverage Part, you, your, or insured means a named insured, subsidiary, employee, executive, or acquired entity, as defined below:
Named insured means the individual, corporation, partnership, limited liability company, limited partnership, or other entity identified in Item 1 of the Declarations.
Subsidiary means any entity of which the named insured has majority ownership before or as of the inception of the policy period.
Employee means any past, present, or future person employed by the named insured or subsidiary as a permanent, part-time, seasonal, leased, or temporary employee, or any volunteer, but only PLP P0006 CW (06/14) Page 1 of 7
Cyber Enhancements Coverage Part
while in the course of their performance of business operations on behalf of or at the direction of such named insured or subsidiary.
Executive means any past, present, or future partner, director, officer, or board member (or equivalent position) of the named insured or subsidiary, but only while in the course of their performance of business operations on behalf of such named insured or subsidiary.
Acquired entity means an entity in which the named insured, during the policy period:
1. acquires substantially all of the assets;
2. acquires the majority of its voting securities, as a result of which it becomes a subsidiary; or
3. merges and leaves the named insured as the surviving entity.
With respect to an acquired entity whose revenues exceed 10% of the annual revenues of the named insured at the time of its creation or acquisition, any coverage under this policy will expire 90 days after the effective date of its creation or acquisition unless, within such 90 day period:
1. the named insured provides us with written notice of such creation or acquisition;
2. the named insured provides us with information related to such creation or acquisition as we may reasonably require;
3. the named insured accepts any special terms, conditions, exclusions, or additional premium charge as we may reasonably require; and
4. we agree by written endorsement to provide such coverage.
This policy will apply to an acquired entity only with respect to an event which first occurs and is discovered after the acquisition, merger, or creation.
IV. [This section intentionally left blank]
V. Your obligations
Notifying us of events You must give written notice to us of any event as soon as possible, but in any event, no later than ten days after the end of the policy period.
All such notifications must be in writing and include a description of the event, and must be submitted to us via the designated email address or mailing address identified in Item 6 of the Declarations.
In addition, you must also inform, or allow us to inform, the appropriate law enforcement authorities for any event requiring such notification.
Retention Our obligation to make any payments under this Coverage Part is in excess of the retention, and we will not make any payment in connection with a covered event until the total amount of covered costs incurred or, in the case of a business interruption event, the length of the event, exceeds the retention.
Solely with respect to a business interruption event, the retention will not begin to run until you have notified the event to us.
VI. Exclusions –
What is not
covered We will have no obligation to pay any sums under this Coverage Part for any event:
PLP P0006 CW (06/14) Page 2 of 7
Cyber Enhancements Coverage Part
Bodily injury 1. based upon or arising out of any actual or alleged bodily injury.
Chargeback 2. based upon or arising out of any actual or alleged chargeback, liability, or fee incurred by you or your client as a result of a merchant service provider, including any credit card company or bank, wholly or partially reversing or preventing a payment transaction.
Collection of data without
knowledge
3. based upon or arising out of any actual or alleged:
a. collection of personally identifiable information by you (or others on your behalf) without the knowledge or permission of the person to whom the personally identifiable information relates; or
b. use of personally identifiable information by you (or others on your behalf) in violation of applicable law.
Cramming/slamming 4. based upon or arising out of:
a. the imposition of charges for services or content in relation to telephone, cell phone, wireless data, cable television, internet, voice over internet protocol (VoIP), or other similar telecommunications services, which charges have not been adequately disclosed or which services or content have not been requested by the consumer; or
b. the unauthorized switching of telecommunications carriers, including providers of telephone, cell phone, wireless data, cable television, internet, voice over internet protocol (VoIP), or other similar services.
Fraudulent/criminal act 5. involving an intentional, fraudulent, or criminal act committed by or in collusion with an executive, employee, or any person to whom a ransom is entrusted.
Funds transfer 6. involving any actual or alleged loss, theft, or transfer of:
a. your funds, monies, or securities;
b. the funds, monies, or securities of others in your care, custody, or control; or c. the funds, monies, or securities in the care, custody, or control of any third party for whom you are legally liable,
including the value of any funds, monies, or securities transferred by you or others on your behalf.
Government investigation/
enforcement
7. based upon or arising out of any actual or alleged governmental investigation or enforcement of any state or federal regulation, including but not limited to any regulation promulgated by the Federal Trade Commission, Federal Communications Commission, or the Securities and Exchange Commission, or ASCAP, BMI, SESAC, or other similar licensing organization.
Infrastructure interruption 8. based upon or arising out of any actual or alleged failure or interruption of service provided by an internet service provider, telecommunications provider, utility provider, or other infrastructure provider.
Intellectual property 9. based upon or arising out of any actual or alleged infringement, use, or disclosure of any intellectual property, including but not limited to copyright, trademark, trade dress, patent, service mark, service name, title, or slogan, or any publicity rights violations, cyber squatting violations, moral rights violations, any act of passing-off, or any misappropriation of trade secret.
Misappropriation of funds 10. based upon or arising out of the actual or alleged theft, misappropriation, commingling, or conversion of any funds, monies, assets, or property.
Prior acts/notice/knowledge 11. based upon or arising out of any:
a. claim or event that was the subject of any notice given under any other policy of which this policy is a renewal or replacement;
PLP P0006 CW (06/14) Page 3 of 7
Cyber Enhancements Coverage Part
b. claim or event that was the subject of, or is related to, any prior or pending litigation, claim, written demand, arbitration, administrative or regulatory proceeding or investigation, or licensing proceeding that was filed or commenced against you and of which you had notice prior to the policy period; or c. other matter you had knowledge of prior to the policy period, and you had a reasonable basis to believe could result in a claim or event.
However, if this policy is a renewal or replacement of a previous policy we issued that provided materially identical coverage, and is part of an unbroken chain of successive policies issued by us, the policy period referred to in paragraphs b and c, above, will be the policy period of the first such policy we issued.
Privacy 12. based upon or arising out of any actual or alleged:
a. unauthorized acquisition, access, use, or disclosure of, improper collection or retention of, or failure to protect any non-public personally identifiable information or confidential corporate information that is in your care, custody, or control; or b. violation of any privacy law or consumer data protection law protecting against the use, collection, or disclosure of any information about a person or any confidential corporate information.
Privacy policy violations 13. based upon or arising out of any actual or alleged:
a. failure to have or appropriately display a privacy policy; b. failure of your privacy policy to comply with any federal, state, local, or foreign statutes, ordinances, regulations, or other laws;
c. breach of your privacy policy; or
d. changing of the terms of your privacy policy.
Property damage 14. based upon or arising out of any actual or alleged property damage; however, this exclusion will not apply to damage to data, or destruction or loss of use of data.
Scareware 15. based upon or arising out of any actual or alleged provision or transmission of Scareware, including but not limited to software that produces false or alarming warning messages.
Subsidiary outside control of
named insured
16. experienced by a past or present subsidiary while the named insured does not have majority ownership or management control of it.
Surrender of ransom 17. involving the surrender of a ransom at the location where the illegal threat and ransom demand was first made, unless brought to such location after receipt of the ransom demand for the sole purpose of paying such ransom demand.
Sweepstakes/gambling/
lotteries
18. based upon or arising out of any:
a. actual or alleged provision of any sweepstakes, gambling activities, or lotteries; or b. price discounts, prizes, awards, money, or valuable consideration given in excess of a total contracted or expected amount, including but not limited to over redemption or under redemption of coupons, discounts, awards, or prizes.
Theft of ransom 19. involving the theft of a ransom by way of an immediate threat of force or violence, unless the ransom has been previously negotiated.
Unsolicited telemarketing 20. based upon or arising out of any actual or alleged violation of any federal, state, local, or foreign statutes, ordinances, or regulations relating to unsolicited telemarketing, solicitations, emails, faxes, text messages, or any other communications of any type or nature, including but not limited to the Telephone Consumer Protection Act, CAN-SPAM Act, or any “anti-spam” or “do-not-call” statutes, ordinances, or regulations.
PLP P0006 CW (06/14) Page 4 of 7
Cyber Enhancements Coverage Part
Virtual currency 21. based upon or arising out of any actual or alleged virtual currency, including but not limited to virtual goods exchanged in connection with an Internet game or virtual economy.
VII. Definitions The following definitions apply to this Coverage Part. Additional definitions are contained in Section III. Who is an insured, and in the General Terms and Conditions, Section VI. Definitions applicable to all Coverage Parts.
Bodily injury means physical injury, sickness, disease, death, humiliation, mental injury, mental anguish, emotional distress, suffering, or shock sustained by a person.
Business interruption
costs
means:
1. Business Interruption Hourly Loss Amount: the amount stated as such in the Declarations;
2. Additional Loss Amount: the average hourly gross profit you have generated in the previous six months, minus the “Business Interruption Hourly Loss Amount,” provided you are able to:
a. produce evidence of such amounts; and
b. prove to us that you reasonably expected to earn more than the “Business Interruption Hourly Loss Amount” during the period of the covered business interruption event; and
3. Extra Expense: the reasonable and necessary expenses you incur to mitigate the business interruption event if you satisfy us such expenses are:
a. less than the business interruption costs that would have been incurred otherwise; and
b. in excess of the expenses you would have incurred if the business interruption event had not occurred.
We will pay covered business interruption costs as follows:
1. Regardless of the amount of your actual loss, we will pay the Business Interruption Hourly Loss Amount for each hour of the business interruption event which exceeds the retention.
2. If your actual loss resulting from the business interruption event is greater than the Business Interruption Hourly Loss Amount, then we will also pay the Additional Loss Amount for each hour of the business interruption event which exceeds the retention.
3. We will also pay Extra Expense if you meet the conditions in subpart 3 above.
Business interruption
event
means the interruption to or degradation in the availability of your website, intranet, network, computer system, programs, or data resulting in an income interruption as a direct result of:
1. the activities of a third party that maliciously blocks electronic access to your website, intranet, network, computer system, programs, or data you hold electronically; or
2. a hacker.
Claim means any written assertion of liability or any written demand for financial compensation or nonmonetary relief.
Consulting costs means costs for:
1. a public relations or crisis management consultant (and related costs) to:
a. reduce the likelihood of or costs of any claim that would be covered by this policy; or
b. to assist you in reestablishing your business reputation; PLP P0006 CW (06/14) Page 5 of 7
Cyber Enhancements Coverage Part
2. a computer forensic analysis conducted by outside forensic experts to confirm the identity of the hacker involved in the event; or
3. an information security assessment conducted by outside security experts to identify security improvements to prevent a similar event.
Cyber extortion costs means:
1. the ransom paid or, if the demand is for goods or services, the fair market value at the time of surrender; and
2. the reasonable and necessary fees and expenses incurred by a representative appointed by us to provide you with assistance,
provided you can demonstrate to us:
1. the ransom has been surrendered under duress; and
2. before agreeing to its payment you have made all reasonable efforts to:
a. determine the threat is genuine and not a hoax; and
b. ensure at least one executive has agreed to the payment of the ransom.
Cyber extortion event means your receipt, directly or indirectly, of an illegal threat from a person or entity who is not an insured threatening to:
1. damage, destroy, or corrupt your website, intranet, network, computer system, any programs you use, or data you hold electronically, including by introducing a computer virus, worm, logic bomb, or Trojan horse; or
2. disseminate, divulge, or use any confidential information for which you are legally responsible,
who then demands a ransom for their own benefit as a condition of not carrying out this threat.
Event means a business interruption event, cyber extortion event, or hacker damage event.
Hacker means anyone, including an employee, who gains unauthorized access to your website, intranet, network, computer system, or data you hold electronically via the internet or other external electronic link, solely by circumventing electronically the security systems in place to protect against such unauthorized access. Hacker does not include any executive, or any person who, while on your premises (other than an employee or a third party you have expressly permitted to enter the premises), directly gains unauthorized access to any computer system.
Hacker damage event means a hacker either:
1. damaging, destroying, altering, corrupting, or misusing your website, intranet, network, computer system, programs, or data you hold electronically; or
2. copying or stealing any program or data you hold electronically.
Hacker damage costs means:
1. the reasonable and necessary expenses you incur with our prior written consent to repair or replace your website, intranet, network, computer system, programs, or data you hold electronically to the same standard and with the same contents as before it was damaged, destroyed, altered, corrupted, copied, stolen, or misused; or
2. in the event that your website, intranet, network, computer system, programs, or data you hold electronically cannot be restored to the same standard and with the same contents as before it was damaged, destroyed, altered, corrupted, copied, stolen, or misused, hacker damage costs will mean the reasonable and necessary expenses you incur to make that determination.
Hacker damage costs includes the reasonable and necessary expenses you incur to mitigate the hacker damage event if you satisfy us such expenses are:
PLP P0006 CW (06/14) Page 6 of 7
Cyber Enhancements Coverage Part
1. less than the hacker damage costs that would have been incurred otherwise; and
2. in excess of the expenses you would have incurred if the hacker damage event had not occurred.
Hacker damage costs will not mean, and we will not be obligated to pay, any amounts to research and/or develop the website, intranet, network, computer system, programs, or data.
Income interruption means your gross profit generated on an hourly basis has been reduced to less than 75% of the average hourly gross profit for the 90-day period immediately prior to the business interruption event.
Property damage means physical loss of, physical damage to, or destruction or loss of use of any tangible property.
Retention means:
1. for a business interruption event, the length of time stated as such under the Cyber Business Interruption section of the Declarations;
2. for a cyber extortion event, the amount stated as such under the Cyber Extortion section of the Declarations; or
3. for a hacker damage event, the amount stated as such under the Hacker Damage section of the Declarations.
You, your, or insured means a named insured, subsidiary, employee, executive, or acquired entity, as defined in Section III. Who is an insured.
PLP P0006 CW (06/14) Page 7 of 7
Endorsement 1
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network PLPTCH E9182 CA (07/14) Page 1 of 1
HPAENADREN134
E9182.1 California Amendatory Endorsement
In consideration of the premium charged, and on the understanding this endorsement leaves all other terms, conditions, and exclusions unchanged, it is agreed the Technology Professional Liability Coverage Part is amended as follows:
The definition of Damages in Section VII. Definitions is modified to the extent necessary to provide the following:
Punitive and exemplary damages shall not be insurable in cases where California law governs the claim.
Endorsement effective: 08/08/2024 Certificate No.: MPL1790263.24 Endorsement No: 1 Processed Date: 07/08/2024
Hiscox Inc.
Authorized Representative
Kevin Kerridge
Endorsement 2
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network PLPMED E9122 CA (07/14) Page 1 of 1
HPAENADREN134
E9122. California Amendatory Endorsement
In consideration of the premium charged, and on the understanding this endorsement leaves all other terms, conditions, and exclusions unchanged, it is agreed the Media Liability Coverage Part is amended as follows:
The definition of Damages in Section VII. Definitions is modified to the extent necessary to provide the following:
Punitive and exemplary damages shall not be insurable in cases where California law governs the claim.
Endorsement effective: 08/08/2024 Certificate No.: MPL1790263.24 Endorsement No: 2 Processed Date: 07/08/2024
Hiscox Inc.
Authorized Representative
Kevin Kerridge
Endorsement 3
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network PLPPVY E9102 CA (07/14) Page 1 of 1
HPAENADREN134
E9102.1 California Amendatory Endorsement
In consideration of the premium charged, and on the understanding this endorsement leaves all other terms, conditions, and exclusions unchanged, it is agreed the Data Breach and Privacy Security Liability Coverage Part is amended as follows:
The definition of Damages in Section VII. Definitions is modified to the extent necessary to provide the following:
Punitive and exemplary damages shall not be insurable in cases where California law governs the claim.
Endorsement effective: 08/08/2024 Certificate No.: MPL1790263.24 Endorsement No: 3 Processed Date: 07/08/2024
Hiscox Inc.
Authorized Representative
Kevin Kerridge
Endorsement 4
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network PLPCYB E8643 CW (03/17) Page 1 of 1
HPAENADREN134
E8643.2 Cyber Enhancements Notification Endorsement
In consideration of the premium charged, and on the understanding this endorsement leaves all other terms, conditions, and exclusions unchanged, it is agreed:
For any business interruption event, hacker damage event, or cyber extortion event you must also notify the breach coach at 1-855-447-2627.
Endorsement effective: 08/08/2024 Certificate No.: MPL1790263.24 Endorsement No: 4 Processed Date: 07/08/2024
Hiscox Inc.
Authorized Representative
Kevin Kerridge
Endorsement 5
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network PLPCYB E8649 CW 0817 Page 1 of 2
HPAENADREN134
E8649.1 Amend Definition of Business Interruption Costs (Remove Hourly Loss Amount) In consideration of the premium charged, and on the understanding this endorsement leaves all other terms, conditions, and exclusions unchanged, it is agreed the Cyber Enhancements Coverage Part is amended as follows:
I. In Section I. What is covered, A. Cyber business interruption, paragraph 2 is deleted in its entirety and replaced with the following:
2. ends on the earlier of the date and time that the interruption to or degradation in the availability of your website, intranet, network, computer system, programs, or data:
a. ends; or
b. could have ended had you acted with due diligence and dispatch.
In no event will we be obligated to pay business interruption costs for more than 60 days from the date the business interruption event first occurs.
II. In Section VII. Definitions, the definition of “Business interruption costs” is deleted in its entirety and replaced with the following:
Business interruption costs means income loss and extra expense actually sustained by you due to a business interruption event.
III. In Section VII. Definitions, the definition of “Business interruption event” is deleted in its entirety and replaced with the following:
Business interruption event means the total or partial interruption to or degradation in the availability of your website, intranet, network, computer system, programs, or data resulting in business interruption costs as a direct result of:
1. the activities of a third party that maliciously blocks electronic access to your website, intranet, network, computer system, programs, or data you hold electronically; or
2. a hacker.
IV. The following definitions are added to the end of Section VII. Definitions:
Income loss means the sum of the following:
1. Net Income (Net Profit or Loss before income taxes) that would have been earned if the business interruption event had not occurred; and
2. continuing normal operating expenses incurred, including payroll.
Extra expense means reasonable and necessary expenses you incur to mitigate the business interruption event if you satisfy to us that such expenses are:
1. less than the business interruption costs that would have been incurred otherwise; and
2. in excess of the expenses you would have incurred if the business interruption event had not occurred.
V. In Section VII. Definitions, the definition of “Income interruption” is deleted in its entirety.
VI. The “Business Interruption Hourly Loss Amount” stated in the Cyber Enhancements Coverage Part section of the Declarations is deleted in its entirety.
Endorsement 5
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network PLPCYB E8649 CW 0817 Page 2 of 2
HPAENADREN134
Endorsement effective: 08/08/2024 Certificate No.: MPL1790263.24 Endorsement No: 5 Processed Date: 07/08/2024
Hiscox Inc.
Authorized Representative
Kevin Kerridge
Endorsement 6
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network WCL E6017 CW (04/19) Page 1 of 2
HPAENADREN134
E6017.3 Nuclear Incident Exclusion Clause-Liability-Direct (Broad) Endorsement In consideration of the premium charged, and on the understanding this endorsement leaves all other terms, conditions, and exclusions unchanged, it is agreed:
We will have no obligation to pay any sums under this policy, including any damages, claim expenses, or other covered amounts, for any claim, event, or occurrence:
A. Under any liability coverage, for injury, sickness, disease, death, or destruction:
1. for which you are also insured under a nuclear energy liability policy issued by the Nuclear Energy Liability Insurance Association, Mutual Atomic Energy Liability Underwriters, or Nuclear Insurance Association of Canada, or would be insured under any such policy but for exhaustion of its limit of liability; or
2. resulting from the hazardous properties of nuclear material and with respect to which:
a. any person or organization is required to maintain financial protection pursuant to the Atomic Energy Act of 1954, as amended; or
b. you are, or had this policy not been issued would be, entitled to indemnity from the United States of America, or any agency thereof, under any agreement entered into by the United States of America, or any agency thereof, with any person or organization.
B. Under any Medical Payments coverage, or under any Supplementary Payments provision relating to immediate medical or surgical relief, for expenses incurred with respect to bodily injury, sickness, disease, or death resulting from the hazardous properties of nuclear material and arising out of the operation of a nuclear facility by any person or organization.
C. Under any liability coverage, for injury, sickness, disease, death, or destruction resulting from the hazardous properties of nuclear material, if:
1. the nuclear material is at any nuclear facility owned or operated by you or on your behalf, or has been discharged or dispersed from such a facility;
2. the nuclear material is contained in spent fuel or waste which is or was at any time possessed, handled, used, processed, stored, transported, or disposed of by you or on your behalf; or
3. the injury, sickness, disease, death, or destruction arises out of the furnishing by you of services, materials, parts, or equipment in connection with the planning, construction, maintenance, operation, or use of any nuclear facility, but if such facility is located within the United States of America, its territories or possessions, or Canada, this exclusion (3) applies only to injury to or destruction of property at such nuclear facility.
As used in this endorsement:
Hazardous properties includes radioactive, toxic, or explosive properties; Nuclear material means source material, special nuclear material, or byproduct material; Nuclear reactor means any apparatus designed or used to sustain nuclear fission in a self-supporting chain reaction or to contain a critical mass of fissionable material;
Source material, special nuclear material, and byproduct material have the meanings given them in the Atomic Energy Act of 1954, as amended;
Spent fuel means any fuel element or fuel component, solid or liquid, which has been used or exposed to radiation in a nuclear reactor;
Waste means any waste material:
Endorsement 6
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network WCL E6017 CW (04/19) Page 2 of 2
HPAENADREN134
1. containing byproduct material; and
2. resulting from the operation by any person or organization of any nuclear facility included in paragraph 1 or 2 of the definition of nuclear facility;
Nuclear facility means:
1. any any nuclear reactor;
2. any any equipment or device designed or used for:
a. separating the isotopes of uranium or plutonium;
b. processing or utilizing spent fuel; or
c. handling, processing, or packaging waste;
3. any equipment or device used for the processing, fabricating, or alloying of special nuclear material, if at any time the total amount of such material in your custody at the premises where such equipment or device is located consists of or contains more than 25 grams of plutonium or uranium 233 or any combination thereof, or more than 250 grams of uranium 235; or
4. any structure, basin, excavation, premises, or place prepared or used for the storage or disposal of waste.
Nuclear facility includes the site on which any of the foregoing is located, all operations conducted on such site, and all premises used for such operations;
With respect to injury to or destruction of property, “injury" or "destruction" includes all forms of radioactive contamination of property.
Endorsement effective: 08/08/2024 Certificate No.: MPL1790263.24 Endorsement No: 6 Processed Date: 07/08/2024
Hiscox Inc.
Authorized Representative
Kevin Kerridge
Endorsement 7
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network WCL E6020 CW (09/22) Page 1 of 3
HPAENADREN134
E6020.4 War, Civil War, Cyberwarfare, and NCBR Exclusion Endorsement In consideration of the premium charged, and on the understanding this endorsement leaves all other terms, conditions, and exclusions unchanged, it is agreed the General Terms and Conditions are amended as follows:
I. This policy does not apply to and we will have no obligation to pay any sums under this policy, including any damages, claim expenses, or other covered amounts, for any claim, event, or occurrence based upon or arising out of, directly or indirectly occasioned by, happening through, or in consequence of:
1. war, invasion, acts of foreign enemies, hostilities (whether war is declared or not), civil war, rebellion, revolution, insurrection, military, or usurped power;
2. confiscation, nationalization, requisition, destruction of, or damage to property by or under the order of any government, public, or local authority;
3. cyberwarfare, to the extent not otherwise excluded by paragraph 1; or
4. any NCBR malicious act.
However, this exclusion will not apply to coverage under the General Liability Coverage Part (if purchased) for damage by fire to premises while rented to you or temporarily occupied by you with the owner’s permission. Any payments we make for property damage to such premises will be subject to the Damage to Premises Limit.
II. For purposes of this Endorsement, the following definitions apply:
Cyberwarfare means any:
1. unauthorized access to, or use, alteration, corruption, damage, manipulation, misappropriation, theft, deletion, or destruction of, any computer hardware or electronic data;
2. creation, transmission, or introduction into a computer system, computer network, or electronic data of a computer virus or harmful code; or
3. restriction or inhibition of access to a computer system, computer network, or electronic data, including through a denial-of-service (DoS) attack, committed by, or on behalf of, a state.
In determining by whom any action listed in parts 1. through 3. above is committed we will consider to whom any governing body (including the governing body’s intelligence, law enforcement, or military services) attributes such action, regardless of whether:
A. the computer system, computer network, or electronic data is physically located within the jurisdiction of that governing body; or
B. there are inconsistent statements within different branches or agencies of that governing body (including intelligence, law enforcement, or military services) as to whom the action is attributable to.
However, if:
Endorsement 7
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network WCL E6020 CW (09/22) Page 2 of 3
HPAENADREN134
i. a governing body has not attributed any such action to a state, or any person, group, association, or entity acting on the state’s behalf; and ii. there is at least one media report or a cybersecurity forensic firm report indicating that such action is attributed to a state or any person, group, association, or entity acting on the state’s behalf,
then we will not pay any damages, claim expenses, or other covered amounts resulting from any action listed in parts 1. through 3. above until any governing body attributes such action to a state or any person, group, association, or entity acting on the state’s behalf.
If a governing body does not attribute such action to a state or any person, group, association, or entity acting on the state’s behalf, or declares it is unable to do so, then a media report or cybersecurity forensic firm report will be conclusive evidence that the act was committed by, or on behalf of, a state.
For purposes of this definition, “media report” means an article published by the Associated Press, Reuters, Wall Street Journal, or the British Broadcasting Corporation.
For purposes of this definition, “state” means a sovereign state, state-like entity, quasi-state, proto-state, or a state-sponsored actor or group.
NCBR malicious act means an act or series of acts that harms another person or damages property through the physical release or dispersal of nuclear, chemical, biological, or radiological agents or materials, which is carried out by any person or group of persons, whether acting alone, on behalf of, or in connection with any organization.
means:
1. nuclear reaction, nuclear radiation or radioactive particles, whether released or dispersed by nuclear or conventional devices;
Nuclear, chemical,
biological, or radiological
agents or materials
2. any chemical compound; or
3. any pathogen,
in sufficient concentration to cause harm to people or damage to property.
Endorsement effective: 08/08/2024 Certificate No.: MPL1790263.24 Endorsement No: 7 Processed Date: 07/08/2024
Hiscox Inc.
Endorsement 7
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network WCL E6020 CW (09/22) Page 3 of 3
HPAENADREN134
Authorized Representative
Kevin Kerridge
Endorsement 8
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network PLP E9003 CA (04/19) Page 1 of 3
HPAENADREN134
E9003.2 California Amendatory Endorsement
In consideration of the premium charged, and on the understanding this endorsement leaves all other terms, conditions, and exclusions unchanged, it is agreed the General Terms and Conditions are amended as follows:
I. In Section V. Other provisions affecting coverage, C. Cancellation, part 2 is deleted in its entirety and replaced with the following:
2. Policies in Effective for 60 Days or Less
If this policy has been in effect for 60 days or less, and is not a renewal of a policy we have previously issued, we may cancel this policy by mailing (or emailing) to the named insured at the mailing address (or email address) shown in the Declarations and to the producer of record, if any, advance written notice of cancellation stating the reason for cancellation at least:
a. Ten days before the effective date of cancellation if we cancel for:
i. Non-payment of premium; or
ii. Discovery of fraud by:
(a) The insured or the insured’s representative in obtaining this insurance; or (b) The insured or the insured’s representative in pursuing a claim under the policy. b. 30 days before the effective date of cancellation if we cancel for any other reason.
Policies In Effect For More Than 60 Days
If this policy has been in effect for more than 60 days, we may also cancel this policy by mailing (or emailing) to the named Insured at the address (or email address) shown in the Declarations, and the producer of record, if any, written notice, including the reason for cancellation, stating when not less than 30 days thereafter (or ten days thereafter when cancellation is due to non-payment of premium or discovery of fraud), the cancellation will be effective.
We may only cancel this policy for one or more of the following reasons:
a. Non-payment of premium, including payment due on a prior policy issued by us and due during the current policy term covering the same risks;
b. Discovery of fraud or material misrepresentation by:
Endorsement 8
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network PLP E9003 CA (04/19) Page 2 of 3
HPAENADREN134
i. The insured or the insured’s representative in obtaining this insurance; or ii. The insured or the insured’s representative in pursuing a claim under the policy. c. A judgment by a court or an administrative tribunal that the insured has violated a California or Federal law, having as one of its necessary elements an act which materially increases any of the risks insured against;
d. Discovery of willful or grossly negligent acts or omissions, or of any violations of state laws or regulations establishing safety standards, by the insured or the insured’s representative, which materially increase any of the risks insured against;
e. Failure by the insured or the insured’s representative to implement reasonable loss control requirements, agreed to by the insured as a condition of policy issuance, or which were conditions precedent to our use of a particular rate or rating plan, if that failure materially increases any of the risks insured against; f. A determination by the Commissioner of Insurance that the:
i. Loss of, or changes in, our reinsurance covering all or part of the risk would threaten our financial integrity or solvency; or
ii. Continuation of the policy coverage would:
a. Place us in violation of California law or the laws of the state where we are domiciled; or b. Threaten our solvency.
g. A change by the insured or the insured’s representative in the activities or property of the commercial or industrial enterprise, which results in a materially added, increased or changed risk, is included in the policy.
II. The following is added to Section V. Other provisions affecting coverage::
NR- A Non-renewal
1. If we elect not to renew this policy, we will mail (or email where allowed by applicable law) to the named insured written notice of nonrenewal, stating the reason for nonrenewal, not less than 60 days, but not more than 120 days before the end of the policy period.
2. We are not required to send notice of nonrenewal in the following situations:
Endorsement 8
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network PLP E9003 CA (04/19) Page 3 of 3
HPAENADREN134
a. If the transfer or renewal of a policy, without any changes in terms, conditions or rates, is between us and a member of our insurance group.
b. If the policy has been extended for 90 days or less, provided that notice has been given in accordance with paragraph 1 above.
c. If the named insured has obtained replacement coverage, or if the named insured has agreed, in writing, within 60 days of the termination of the policy, to obtain that coverage. d. if the policy is for a period of no more than 60 days and the named insured is notified at the time of issuance that it will not be renewed.
e. If the named insured requests a change in the terms or conditions or risks covered by the policy within 60 days of the end of the policy period.
f. If we made a written offer to the named insured, in accordance with the timeframes shown in paragraph 1 above, to renew the policy under changed terms or conditions or at an increased premium rate, when the increase exceeds 25%.
Endorsement effective: 08/08/2024 Certificate No.: MPL1790263.24 Endorsement No: 8 Processed Date: 07/08/2024
Hiscox Inc.
Authorized Representative
Kevin Kerridge
Endorsement 9
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network WCL E6085 CW (12/15) Page 1 of 1
HPAENADREN134
E6085.1 Full Prior Acts Endorsement
In consideration of the premium charged, and on the understanding this endorsement leaves all other terms, conditions, and exclusions unchanged, it is agreed the General Terms and Conditions are amended as follows:
In Section VI. Definitions applicable to all Coverage Parts, the definition of “Retroactive date” is deleted in its entirety and replaced with the following:
means the date any named insured, subsidiary, joint venture, or predecessor in business first began performing professional services.
Retroactive date
For purposes of this definition, predecessor in business means any individual or entity of which the named insured has assumed the majority of assets and liabilities, provided that the named insured has continued to perform the professional services that the individual or entity was performing prior to such transfer of assets and liabilities.
Endorsement effective: 08/08/2024 Certificate No.: MPL1790263.24 Endorsement No: 9 Processed Date: 07/08/2024
Hiscox Inc.
Authorized Representative
Kevin Kerridge
Endorsement 10
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network WCLPVY E8511 CW (05/18) Page 1 of 3
HPAENADREN134
E8511.3 Cyber Crime & Cyber Deception Endorsement (DBPSL) In consideration of the premium charged, and on the understanding this endorsement leaves all other terms, conditions, and exclusions unchanged, it is agreed the Data Breach and Privacy Security Liability Coverage Part is amended as follows:
I. The following is added to the end of Section II. Coverage enhancements:
Cyber crime and deception
sublimit
CC-A. We will pay up to the Cyber Crime and Deception Limit of Liability identified below for loss:
1. resulting directly from a fraudulent instruction directing a financial institution to transfer, pay, or deliver money and/or securities from your transfer account; or
2. of money, securities, and/or other property transferred, paid, or delivered as a result of a cyber deception,
provided the loss is first discovered by you during the policy period and is reported to us is accordance with Section V. Your obligations.
Any payment we make under this subsection CC-A will be in excess of the Cyber Crime and Deception Retention identified below, and such payments will be a part of, and not in addition to, the coverage part limit.
II. Solely with respect to the coverage provided by this endorsement, the following is added to the end of Section V. Your obligations:
Notifying us of losses If you discover a loss, or circumstances reasonably likely to lead to a loss of money, securities, and/or other property that in your best estimate will exceed 50% of the Cyber Crime and Deception Retention identified below, you must give written notice to us as soon as possible, but in any event no later than: (i) the end of the policy period; or (ii) 30 days after the end of the policy period for a loss first discovered by you in the last 30 days of the policy period. If you have reason to believe that any loss involves a violation of law, you must also inform, or allow us to inform, the appropriate law enforcement authorities.
Proof of loss Within 120 days of notification to us of a loss, you must give us a detailed, sworn proof of loss.
Examination of your books and
records
We have the right to examine and audit your books and records as they relate to the coverage provided by this endorsement at any time during the policy period and up to three years afterward.
III. Solely with respect to the coverage provided by this endorsement, the following exclusions are added to the end of Section VI.
Exclusions – What is not covered:
We will have no obligation to pay any sums under this Coverage Part for any:
CC-A. loss resulting from the use or purported use of credit, debit, charge, access, convenience, identification, storedvalue, or other cards or the information contained on such cards.
CC-B. loss that is an indirect result of an occurrence or event covered by this Coverage Part, including but not limited to loss resulting from:
1. your inability to realize income that you would have realized had there been no loss covered by this endorsement;
Endorsement 10
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network WCLPVY E8511 CW (05/18) Page 2 of 3
HPAENADREN134
2. payment of damages of any type for which you are legally liable, but we will pay compensatory damages arising directly from a loss covered by this endorsement; or
3. payment of costs, fees, or other expenses you incur in establishing the existence or the amount of loss covered by this endorsement.
CC-C. claim expenses incurred by you which are related to any legal action resulting from a loss covered by this endorsement.
CC-D. loss resulting from seizure or destruction of property by order of governmental authority.
CC-E. loss resulting from any dishonest act committed by you, if the named insured is an individual, or any employee.
CC-F. loss resulting from any actual or alleged unauthorized acquisition, access, use, or disclosure of personally identifiable information or confidential corporate information that is held or transmitted in any form; however, this exclusion will not apply to a fraudulent instruction or a cyber deception directly resulting from the use of such personally identifiable information or confidential corporate information.
IV. Solely with respect to the coverage provided by this endorsement, in Section VI. Exclusions – What is not covered, the “Funds transfer” exclusion is deleted in its entirety and replaced with the following:
for any actual or alleged loss, theft, or transfer of:
a. your funds, monies, or securities;
b. the funds, monies, or securities of others in your care, custody, or control; or c. the funds, monies, or securities in the care, custody, or control of any third party for whom you are legally liable, including the value of any funds, monies, or securities transferred by you or others on your behalf.
However, this exclusion will not apply to the loss, theft, or transfer of any money or securities in your transfer account, or to the loss, theft, or transfer of any money, securities and/or other property resulting from a cyber deception.
V. Solely with respect to the coverage provided by this endorsement, the following definitions are added to the end of Section VII.
Definitions:
Cyber deception means the intentional misleading or deception of an employee through social engineering, pretexting, phishing, spear phishing, or any other confidence trick communicated by email, text, instant message, telephone, or other electronic means, by a person falsely purporting to be your vendor or client, or an employee, which results in your transfer, payment, or delivery of money, securities, and/or other property.
Fraudulent instruction means:
1. an electronic, telegraphic, cable, teletype, telefacsimile, or telephone instruction which purports to have been transmitted by you, but which was in fact fraudulently transmitted by someone else without your knowledge or consent;
2. a written instruction issued by you, which was forged or altered by someone other than you without your knowledge or consent, or which purports to have been issued by you, but was in fact fraudulently issued without your knowledge or consent; or
3. an electronic, telegraphic, cable, teletype, telefacsimile, telephone, or written instruction initially received by you which purports to have been transmitted by an employee but which was in fact fraudulently transmitted by someone else without your or the employee’s knowledge or consent.
Money means:
Endorsement 10
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network WCLPVY E8511 CW (05/18) Page 3 of 3
HPAENADREN134
1. currency, including Bitcoin or any other digital currency, cryptocurrency, or electronic currency, coins, and bank notes in current use anywhere in the world and having a face value; or
2. traveler’s checks, register checks, and money orders held for sale to the public.
Other property means any tangible property other than money that has intrinsic value. Other property does not include software, electronic data, or any other intangible property.
Securities means negotiable or nonnegotiable instruments or contracts representing either money or property and includes:
1. tokens, tickets, revenue, and other stamps (whether represented by actual stamps or unused value in a meter) in current use;
2. casino chips issued by you; or
3. evidences of debt issued in connection with credit or charge cards, which cards are not issued by you,
but does not include money.
Transfer account means any account maintained by you at a financial institution from which you can initiate the transfer, payment, or delivery of money or securities:
1. by means of electronic, telegraphic, cable, teletype, telefacsimile, or telephone instructions communicated directly through an electronic funds transfer system; or
2. by means of written instructions establishing the conditions under which such transfers are to be initiated by such financial institution through an electronic funds transfer system.
Cyber Crime and Deception Limit of Liability: $100,000
Cyber Crime and Deception Retention: $2,500
Endorsement effective: 08/08/2024 Certificate No.: MPL1790263.24 Endorsement No: 10 Processed Date: 07/08/2024
Hiscox Inc.
Authorized Representative
Kevin Kerridge
Endorsement 11
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network PLPTCH E8627 CW (07/14) Page 1 of 3
HPAENADREN134
E8627.1 Intellectual Property Enhancement Endorsement
In consideration of the premium charged, and on the understanding this endorsement leaves all other terms, conditions, and exclusions unchanged, it is agreed the Technology Professional Liability Coverage Part is amended as follows:
I. Section I. What is covered is deleted in its entirety and replaced with the following:
We will pay up to the coverage part limit for damages and claim expenses in excess of the retention for covered claims against you resulting from the performance of your technology services by you or anyone on your behalf (including your subcontractors, outsourcers, or independent contractors) on or after the retroactive date, for any actual or alleged:
1. negligent act, error, or omission;
2. negligent misstatement or negligent misrepresentation;
3. unintentional breach of a written contract with your client;
4. breach of any duty of confidentiality, unauthorized interception or recording of images or sound in violation of any civil anti-wiretap statute, or invasion of privacy, including false light, intrusion upon a person’s seclusion, or misappropriation of a person’s picture, name, or voice for commercial gain;
5. intellectual property infringement (but not any patent infringement or misappropriation of trade secret), including but not limited to copyright infringement (including software copyright infringement), trademark infringement, trademark dilution, trade dress infringement, publicity rights violations, cyber squatting violations, moral rights violations, any act of passing-off, or any misappropriation of formats, characters, trade names, character names, titles, plots, musical compositions, voices, slogans, graphic material, or artwork;
6. unfair competition, deceptive trade practices, or false designation of origin, but only if alleged in connection with a covered claim under 5 above;
7. defamation, including but not limited to libel, slander, trade libel, product disparagement, or injurious falsehood; or
8. unintentional infliction of emotional distress, but only if alleged in connection with a covered claim for negligent publication, invasion of privacy, or defamation under 1, 4, or 7 above, provided the claim is first made against you during the policy period and is reported to us in accordance with Section V.
Your obligations.
II. In Section II. Coverage enhancements, subsection A. Software copyright sublimit is deleted in its entirety.
III. The following is added to the end of Section II. Coverage enhancements:
Declaratory relief IP-A. We will pay reasonable attorney fees incurred by you to prosecute your own declaratory relief action if:
Endorsement 11
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network PLPTCH E8627 CW (07/14) Page 2 of 3
HPAENADREN134
1. a claimant has advised you in writing that you are committing copyright or trademark infringement;
2. after that claimant has made such a written assertion, and after you have filed a declaratory relief action directly in response, the claimant files a counterclaim against you alleging copyright or trademark infringement; and
3. the counterclaim is covered under this policy and pending against you while you are prosecuting your declaratory relief action.
You must pay the retention stated in the Declarations in connection with any payment we make under this subsection IP-A, and any payments we make will be a part of, and not in addition to, the coverage part limit.
IV. In Section VI. Exclusions – What is not covered, the “Antitrust/deceptive trade practices” exclusion is deleted in its entirety and replaced with the following:
based upon or arising out of any actual or alleged:
a. false, deceptive, or unfair trade practices;
b. unfair competition, impairment of competition, restraint of trade, or antitrust violations; c. violation of the Sherman Anti-Trust Act, the Clayton Act, the Robinson-Patman Act, all including as may be amended, or any similar foreign, federal, state, or local statutes, rules, or regulations; or d. deceptive or misleading advertising;
however, this exclusion will not apply to the extent any claim is covered under part 6 of Section I. What is covered.
V. In Section VI. Exclusions – What is not covered, the “Bodily injury” exclusion is deleted in its entirety and replaced with the following:
based upon or arising out of any actual or alleged bodily injury; however, this exclusion will not apply to the extent any claim is covered under part 8 of Section I. What is covered.
VI. In Section VI. Exclusions – What is not covered, the “Intellectual property” exclusion is deleted in its entirety and replaced with the following:
Patent/trade secret IP-1. based upon or arising out of any actual or alleged infringement, use, disclosure, or misappropriation of any patent or trade secret.
VII. The following exclusion is added to the end of Section VI. Exclusions – What is not covered:
Client content IP-2. based upon or arising out of any content provided to you by your client; however, we will pay claim expenses for any claims against you based upon or arising out of such content.
Endorsement 11
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network PLPTCH E8627 CW (07/14) Page 3 of 3
HPAENADREN134
Endorsement effective: 08/08/2024 Certificate No.: MPL1790263.24 Endorsement No: 11 Processed Date: 07/08/2024
Hiscox Inc.
Authorized Representative
Kevin Kerridge
Endorsement 12
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network PLPTCH E8621 CW (02/17) Page 1 of 3
HPAENADREN134
E8621.2 Breach of Contract Enhancement Endorsement (Tech) In consideration of the premium charged, and on the understanding this endorsement leaves all other terms, conditions, and exclusions unchanged, it is agreed the Technology Professional Liability Coverage Part is amended as follows:
I. Section I. What is covered is deleted in its entirety and replaced with the following:
We will pay up to the coverage part limit for damages and claim expenses in excess of the retention for covered claims against you resulting from the performance of your technology services by you or anyone on your behalf (including your subcontractors, outsourcers, or independent contractors) on or after the retroactive date, for any actual or alleged:
1. negligent act, error, or omission;
2. negligent misstatement or negligent misrepresentation; or
3. unintentional breach of a written contract with your client, including a written service level agreement forming part of such contract,
provided the claim is first made against you during the policy period and is reported to us in accordance with Section V.
Your obligations.
II. The following is added to the end of Section II. Coverage enhancements:
If you have purchased the Data Breach and Privacy Security Liability Coverage Part, we will pay breach costs for which you have contractually agreed to indemnify your client, provided the breach costs are incurred as a result of a breach occurring on or after the retroactive date, which is first discovered by you during the policy period, and is reported to us in accordance with Section V. Your obligations. We will pay such breach costs only to the same extent such costs would have been paid by us under the Data Breach and Privacy Security Liability Coverage Part had you incurred them.
Contractual indemnities -
client breach costs
BR-A.
You must pay the retention stated in the Declarations in connection with any payment we make under this subsection BR-A, and any payments we make will be a part of, and not in addition to, the coverage part limit.
III. In Section VI. Exclusions – What is not covered, the “Breach of warranty/guarantee” exclusion is deleted in its entirety.
IV. In Section VI. Exclusions – What is not covered, the “Return of fees” exclusion is deleted in its entirety.
V. In Section VI. Exclusions – What is not covered, the “Assumption of liability” exclusion is deleted in its entirety and replaced with the following:
based upon or arising out of any actual or alleged liability of others you assume under any contract or agreement; however, this exclusion will not apply to the extent any claim is covered under Section II. Coverage enhancements, BR-A. Contractual indemnities - client breach costs.
VI. In Section VI. Exclusions – What is not covered, the “Excluded costs and damages” exclusion is deleted in its entirety and replaced with the following:
to the extent it seeks or includes:
a. fines, penalties, taxes, or sanctions against you;
Endorsement 12
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network PLPTCH E8621 CW (02/17) Page 2 of 3
HPAENADREN134
b. overhead costs, general business expenses, salaries, or wages incurred by you; c. liquidated or multiple damages;
d. restitution, disgorgement of profits, any advantage to which you were not legally entitled, or unjust enrichment; e. the cost of complying with injunctive relief; or
f. service credits.
VII. The following definitions are added to the end of Section VII. Definitions:
Breach means the unauthorized acquisition, access, use, or disclosure of non-public personally identifiable information or confidential corporate information, including but not limited to that resulting from the loss or theft of a device containing such information.
Breach costs means any of the following reasonable and necessary costs your client incurs in response to a breach that triggers your client’s notification obligations pursuant to any foreign, federal, state, or local statute, rule, or regulation, or that you satisfy us poses a significant risk of financial, reputational, or other harm to the affected data subjects:
1. Computer Forensic Costs: costs up to the limit stated in the Declarations for computer forensic analysis conducted by outside forensic experts to confirm a breach and to identify the affected data subjects, as well as outside attorney fees associated with the forensic reports and findings.
2. Notification Costs: the following costs up to the limit stated in the Declarations:
a. Mandatory Notification Costs: for legal services, call center services, and to notify a data subject, a regulator, or any others, as required to satisfy your client’s notification obligations; and/or
b. Voluntary Notification Costs: to voluntarily notify affected data subjects, but only if you satisfy us that the breach poses a significant risk of financial, reputational, or other harm to the affected data subjects.
3. Credit or Identity Protection Costs: costs up to the limit stated in the Declarations to provide each affected data subject with one year (or more as required by law) of services to monitor and/or protect such data subject’s credit or identity:
a. if required by law; or
b. if you satisfy us it mitigates a significant risk of financial, reputational, or other harm to the data subject.
4. Crisis Management and Public Relations Costs: costs up to the limit stated in the Declarations for a public relations or crisis management consultant (and related costs) to:
a. reduce the likelihood of or costs of any claim covered by this policy; or b. to assist your client in re-establishing their business reputation.
Breach costs will not mean, and we will have no obligation to pay, any of your or your client’s own costs, salaries, or overhead expenses.
Endorsement 12
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network PLPTCH E8621 CW (02/17) Page 3 of 3
HPAENADREN134
Endorsement effective: 08/08/2024 Certificate No.: MPL1790263.24 Endorsement No: 12 Processed Date: 07/08/2024
Hiscox Inc.
Authorized Representative
Kevin Kerridge
Endorsement 13
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network WCLPVY E8530 CW (01/17) Page 1 of 3
HPAENADREN134
E8530.1 Telephone Toll Fraud Sublimit Endorsement
In consideration of the premium charged, and on the understanding this endorsement leaves all other terms, conditions, and exclusions unchanged, it is agreed the Data Breach and Privacy Security Liability Coverage Part is amended as follows:
I. The following is added to the end of Section II. Coverage enhancement(s):
Telephone toll fraud sublimit TT-A. We will pay up to the Telephone Toll Fraud Limit of Liability identified below for long distance telephone charges incurred by you as a result of a telephone toll fraud, provided the telephone toll fraud first occurs and is discovered by you during the policy period and is reported to us is accordance with Section V. Your obligations.
If you incur charges for a period exceeding 30 days from the date on which the telephone toll fraud first occurs, we will only be obligated to pay such charges that are incurred during the first 30 days.
Any payment we make under this subsection TT-A will be subject to the Telephone Toll Fraud Retention identified below, and such payments will be a part of, and not in addition to, the coverage part limit.
II. Solely with respect to the coverage provided by this Endorsement, the following is added to the end of Section V. Your obligations:
Notifying us of telephone toll
fraud
You must give written notice to us of any telephone toll fraud, or circumstances reasonably likely to lead to a telephone toll fraud, that in your best estimate will exceed 50% of the Telephone Toll Fraud Retention identified below, as soon as possible after it is first discovered by you, but in any event no later than 90 days after you discover such telephone toll fraud or circumstances.
IV. Solely with respect to the coverage provided by this Endorsement, the following Section is added to the policy:
TT-I. The following are conditions precedent to the payment by us of any long distance telephone charges incurred by you as a result of a telephone toll fraud:
Conditions
applicable to
telephone toll fraud
losses
TT-1. you must inform, or allow us to inform, the appropriate law enforcement authorities if you have reason to believe that any telephone toll fraud involves a violation of law; TT-2. you must give us a detailed, sworn proof of loss within 120 days of notification to us of a telephone toll fraud; and
TT-3. we have the right to examine and audit your books and records as they relate to the coverage provided by this Endorsement at any time during the policy period and up to three years afterward.
V. The following exclusions are added to the end of Section VI. Exclusions – What is not covered:
We will have no obligation to pay any sums under this Coverage Part for:
TT-1. any telephone toll fraud resulting from the use of telephone lines directly controlled by more than one voice computer system;
TT-2. any telephone toll fraud resulting from the failure to install and maintain in operating condition a call disconnect feature to terminate a caller’s access after three unsuccessful attempts to enter an account code; TT-3. any telephone toll fraud resulting from the failure to incorporate a system password or change a system password every 60 days;
Endorsement 13
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network WCLPVY E8530 CW (01/17) Page 2 of 3
HPAENADREN134
TT-4. claim expenses incurred by you which are related to any legal action resulting from a telephone toll fraud; TT-5. any telephone toll fraud resulting from any dishonest act committed by you, if the named insured is an individual, or by any employee, or board member, trustee, director, or officer (or equivalent position) of the named insured or subsidiary; or
TT-6. any telephone toll fraud resulting from any actual or alleged unauthorized acquisition, access, use, or disclosure of personally identifiable information or confidential corporate information that is held or transmitted in any form; however, this exclusion will not apply to a telephone toll fraud directly resulting from the use of such personally identifiable information or confidential corporate information.
VII. The following definitions are added to the end of Section VII. Definitions:
Account code means a confidential and protected string of characters that identifies or authenticates a person and permits that person to gain access to your voice computer system for the purpose of making long distance toll calls or utilizing voice mail box messaging capabilities or similar functional features of the system.
System administration means the performance of any security function, including but not limited to:
1. defining authorized persons to access the system;
2. adding, deleting, or changing account codes or passwords;
3. installing or deleting any system option which directs telephone call routing or adds, drops, or moves telephone lines; or
4. any other activity allowed by a hardware or software-based system option that has been incorporated by a manufacturer or a vendor into a voice computer system, provided the system is not intended for the sole use of the manufacturer or vendor.
System maintenance means performing hardware and software installation, diagnostic and correction, and similar activities that are performed in the usual custom and practice by a manufacturer or vendor to establish or maintain the basic operational functionality of a voice computer system.
System Password means a confidential and protected string of characters that identifies or authenticates a person and permits that person to gain access to your voice computer system to perform system administration or system maintenance or a component of either.
Telephone toll fraud means the fraudulent use or fraudulent manipulation of an account code or system password required to gain access into your voice computer system which results in long distance telephone charges incurred by you.
Voice computer system means a computer system installed in one location which functions as a private branch exchange (PBX), voice mail processor, or automated call attendant, or provides a similar capability used for the direction or routing of telephone calls in a voice communications network.
Telephone Toll Fraud Limit of Liability: $100,000 in the aggregate Telephone Toll Fraud Retention: $2,500
Endorsement effective: 08/08/2024 Certificate No.: MPL1790263.24 Endorsement No: 13 Processed Date: 07/08/2024
Hiscox Inc.
Endorsement 13
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network WCLPVY E8530 CW (01/17) Page 3 of 3
HPAENADREN134
Authorized Representative
Kevin Kerridge
Endorsement 14
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network WCLPVY E8531 CW (01/18) Page 1 of 2
HPAENADREN134
E8531.1 Amend Personally Identifiable Information and Regulatory Action Endorsement (EU General Data Protection Regulation)
In consideration of the premium charged, and on the understanding this endorsement leaves all other terms, conditions, and exclusions unchanged, it is agreed the Data Breach and Privacy Security Liability Coverage Part is amended as follows:
I. In Section VII. Definitions, the definition of “Personally identifiable information” is deleted in its entirety and replaced with the following:
Personally identifiable
information
means the following, in any form, that is in your care, custody, or control, or in the care, custody, or control of any third party for whom you are legally liable:
1. non-public individually identifiable information as defined in any foreign, federal, state, or local statute, rule, or regulation, including but not limited to:
a. unsecured protected health information as defined by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), or
b. personal data, as defined by the EU General Data Protection Regulation (2016/679),
both as amended, and any rule or regulation promulgated thereunder; or
2. any:
i. social security number or individual taxpayer identification number; ii. driver’s license number or state identification number; iii. passport number;
iv. credit card number; or
v. financial account number or debit card number in combination with any required security code.
II. In Section VII. Definitions, the definition of “Regulatory action” is deleted in its entirety and replaced with the following:
Regulatory action means any civil regulatory action brought against you by a regulator, including any action arising under the EU General Data Protection Regulation (2016/679), as amended, and any rule or regulation promulgated thereunder.
Endorsement effective: 08/08/2024 Certificate No.: MPL1790263.24 Endorsement No: 14 Processed Date: 07/08/2024
Hiscox Inc.
Endorsement 14
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network WCLPVY E8531 CW (01/18) Page 2 of 2
HPAENADREN134
Authorized Representative
Kevin Kerridge
Endorsement 15
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network WCL E6314 CW (01/19) Page 1 of 14
HPAENADREN134
E6314.2 Coverage Enhancement Amendatory Endorsement
In consideration of the premium charged, and on the understanding this endorsement leaves all other terms, conditions, and exclusions unchanged, it is agreed:
The General Terms and Conditions is amended as follows:
Amend Cancellation (Pro-Rata)
1. In Section V. Other provisions affecting coverage, C. Cancellation, is deleted in its entirety and replaced with the following:
C. Cancellation 1. This policy may be canceled by the named insured by giving written notice, which must include the date the cancellation will be effective, to us at the address stated in the Declarations.
2. This policy may be canceled by us by mailing to the named insured by registered, certified, or other first class-mail, at the named insured’s address stated in Item
1. of the Declarations, written notice stating when the cancellation will be effective, such date not to be less than 60 days after the date of the notice of cancellation, or ten days if the cancellation is due to non-payment of premium.
3. The mailing of such notice will be sufficient proof of notice, and this policy will terminate at the date and hour specified in such notice.
4. If this Policy is canceled by us or the named insured, we will return a pro rata portion of the premium.
5. Payment or tender of any unearned premium by us will not be a condition precedent to the effectiveness of the cancellation, but such payment will be made as soon as possible.
Amend Other Insurance Provision (Reputational Harm)
2. In Section V. Other provisions affecting coverage, the following is added to the end of part H. Other insurance:
In the event you sustain reputational harm under the Reputational harm sublimit which is covered under both the Data Breach and Privacy Security Liability Coverage Part and the Cyber Enhancements Coverage Part, whether due to the publication of related or continuing acts, errors, incidents, breaches, or events, we will pay only under one Coverage Part, which will be the Coverage Part that provides the most favorable coverage.
The Cyber Enhancements Coverage Part is amended as follows:
Amend Definition of Business Interruption Costs (Remove Hourly Loss Amount)
3. A. In Section I. What is covered, A. Cyber business interruption, paragraph 2 is deleted in its entirety and replaced with the following:
2. ends on the earlier of the date and time that the interruption to or degradation in the availability of your website, intranet, network, computer system, programs, or data:
a. ends; or
b. could have ended had you acted with due diligence and dispatch.
In no event will we be obligated to pay business interruption costs for more than 60 days from the date the business interruption event first occurs.
B. In Section VII. Definitions, the definition of “Business interruption costs” is deleted in its entirety and replaced with the following:
Endorsement 15
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network WCL E6314 CW (01/19) Page 2 of 14
HPAENADREN134
Business interruption
costs
means income loss and extra expense actually sustained by you.
C. In Section VII. Definitions, the definition of “Business interruption event” is deleted in its entirety and replaced with the following:
Business interruption
event
means the total or partial interruption to or degradation in the availability of your website, intranet, network, computer system, programs, or data resulting in business interruption costs as a direct result of:
1. the activities of a third party that maliciously blocks electronic access to your website, intranet, network, computer system, programs, or data you hold electronically; or
2. a hacker.
D. The following definitions are added to the end of Section VII. Definitions:
Income loss means the sum of the following:
1. Net Income (Net Profit or Loss before income taxes) that would have been earned; and
2. continuing normal operating expenses incurred, including payroll.
Extra expense means reasonable and necessary expenses you incur to mitigate the business interruption event if you satisfy to us that such expenses are:
1. less than the business interruption costs that would have been incurred otherwise; and
2. in excess of the expenses you would have incurred if the business interruption event had not occurred.
E. In Section VII. Definitions, the definition of “Income interruption” is deleted in its entirety.
F. The “Business Interruption Hourly Loss Amount” stated in the Cyber Enhancements Coverage Part section of the Declarations is deleted in its entirety.
Bricking Costs Sublimit ($100k)
4. A. The following is added to the end of Section II. Coverage enhancements:
Bricking costs sublimit BC-A. We will pay up to $100,000, in the aggregate, for bricking costs resulting from a bricking event that first occurs on or after the retroactive date and is discovered by you during the policy period.
You must pay the retention before we will be obligated to make any payment under this subsection BC-A, and any payments we make will be a part of, and not in addition to, the Hacker Damage limit stated in the Declarations.
B. Solely with respect to the coverage provided by this endorsement, the following definitions are added to the end of Section VII. Definitions:
Endorsement 15
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network WCL E6314 CW (01/19) Page 3 of 14
HPAENADREN134
Bricking costs means the reasonable and necessary expenses incurred by you with our prior consent to rebuild, repair, or replace any hardware on which any data asset is stored due to a bricking event, provided:
1. such hardware, or any component thereof, can no longer be used for any or all of its purposes, and either:
a. the hardware or component cannot be restored to functionality after reasonable efforts have been made; or
b. it is reasonably estimated:
i. to cost less to replace the hardware or component than it would to restore the hardware or component’s functionality; or
ii. that the cost to replace the hardware or component will be less than the additional loss that will be incurred if the hardware or component is not replaced; and
2. replacement of such hardware or component is reasonable and necessary to reduce or mitigate loss.
Bricking costs will not mean costs to rebuild, repair, or replace the hardware to a level beyond which existed prior to the bricking event, unless:
1. the hardware can only be reasonably replaced with an upgraded or enhanced hardware or component; and
2. the updated or enhanced hardware or component is necessary to repair, rebuild, or replace the hardware.
Bricking event means the total or partial loss of hardware caused by the unauthorized reprogramming of software (including firmware).
C. Solely with respect to the coverage provided by this endorsement, in Section VI. Exclusions – What is not covered, the “Property damage” exclusion is deleted in its entirety and replaced with the following:
Property damage 14. for any actual or alleged property damage; however, this exclusion will not apply to:
a. damage to data, or destruction or loss of use of data; or b. a bricking event covered under Section II. Coverage enhancements, BC-A.
Bricking costs sublimit.
Dependent Business Interruption and System Failure Extension
5. A. The following are added to the end of Section II. Coverage enhancements:
Dependent business DB-A. We will pay up to:
interruption and dependent
system failure sublimit
1. $1,000,000, in the aggregate, for business interruption costs you incur in excess of the retention resulting from:
a. a cyber extortion event;
b. a hacker damage event; and/or
c. the acquisition, access, or disclosure of personally identifiable information or confidential corporate information by a person or Endorsement 15
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network WCL E6314 CW (01/19) Page 4 of 14
HPAENADREN134
entity, or in a manner, that is unauthorized by the dependent business,
experienced by or made against any dependent business that first occurs on or after the retroactive date and is discovered by you during the policy period.
2. $1,000,000, in the aggregate, or the Cyber Business Interruption limit stated in the Declarations, whichever is lower for business interruption costs you incur in excess of the retention resulting from any dependent system failure,
experienced by or made against any dependent business that first occurs on or after the retroactive date and is discovered by you during the policy period.
Any payments we make for business interruption costs you incur under this subsection DB-A will be a part of, and not in addition to, the Cyber Business Interruption limit stated in the Declarations.
System failure sublimit DB-B. We will pay up to $1,000,000, in the aggregate, limit stated in the Declarations for business interruption costs you incur in excess of the retention resulting from a system failure that first occurs on or after the retroactive date and is discovered by you during the policy period.
Any payments we make for business interruption costs you incur under this subsection DB-B will be a part of, and not in addition to, the Cyber Business Interruption limit stated in the Declarations.
B. Solely with respect to the coverage provided by Section II. Coverage enhancements, DB-A. Dependent business interruption and dependent system failure sublimit, the definitions of “Cyber extortion event”, “Event”, Hacker”, and "Hacker damage event” are deleted in their entirety and replaced with the following:
Cyber extortion event means a dependent business’s receipt, directly or indirectly, of an illegal threat from a person or entity who is not an insured threatening to:
1. damage, destroy, or corrupt the dependent business’s website, intranet, network, computer system, any programs the dependent business uses, or data the dependent business holds electronically, including by introducing a computer virus, worm, logic bomb, or Trojan horse; or
2. disseminate, divulge, or use any confidential information for which the dependent business is legally responsible,
who then demands a ransom for their own benefit as a condition of not carrying out this threat.
Event means a business interruption event, cyber extortion event, hacker damage event, system failure, or dependent system failure.
Hacker means anyone, including an employee of the dependent business, who gains unauthorized access to the dependent business’s website, intranet, network, computer system, or data the dependent business holds electronically via the internet or other external electronic link, solely by circumventing electronically the security systems in place to protect against such unauthorized access. Hacker does not include any Endorsement 15
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network WCL E6314 CW (01/19) Page 5 of 14
HPAENADREN134
executive, or any person who, while on the dependent business’s premises (other than an employee or a third party the dependent business has expressly permitted to enter the premises), directly gains unauthorized access to any computer system.
Hacker damage event means a hacker either:
1. damaging, destroying, altering, corrupting, or misusing the dependent business’s website, intranet, network, computer system, programs, or data it holds electronically; or
2. copying or stealing any program or data the dependent business holds electronically.
C. The following definitions are added to the end of Section VII. Definitions:
Dependent business means an individual or entity that:
1. is not owned, operated, or controlled by the named insured or any subsidiary or acquired entity; and
2. provides outsourced business processes or information technology services for the named insured or any subsidiary or acquired entity pursuant to a written contract.
Dependent system failure means any unintentional and unplanned total or partial outage of a dependent business’s computer system that is not caused by the:
1. unauthorized acquisition, access, use, or disclosure of personally identifiable information, including but not limited to that resulting from the loss or theft of a device containing such personally identifiable information; or
2. failure by the dependent business or by others on the dependent business’s behalf (including its subcontractors, outsourcers, or independent contractors) in securing the dependent business’s computer system.
Information technology
services
means computer and electronic technology services, including cloud computing and other hosted computer resources.
Outsourced business
processes
means services supporting the operation of the named insured or any subsidiary or acquired entity’s business, including human resources, call center, and fulfillment.
System failure means any unintentional and unplanned total or partial outage of the named insured or any subsidiary or acquired entity’s computer system that is not caused by the:
1. unauthorized acquisition, access, use, or disclosure of personally identifiable information, including but not limited to that resulting from the loss or theft of a device containing such personally identifiable information; or
2. failure by you or by others on your behalf (including your subcontractors, outsourcers, or independent contractors) in securing the named insured or any subsidiary or acquired entity’s computer system.
D. In Section VI. Exclusions – What is not covered, the “Infrastructure interruption” exclusion is deleted in its entirety and replaced with the following:
Infrastructure interruption 8. based upon or arising out of any actual or alleged failure or interruption of service provided by an internet service provider, telecommunications provider, utility provider, or other infrastructure provider; however, this exclusion will not apply Endorsement 15
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network WCL E6314 CW (01/19) Page 6 of 14
HPAENADREN134
to business interruption costs otherwise covered under Section II. Coverage enhancements, DB-A. Dependent business interruption and dependent system failure sublimit.
E. Solely with respect to the coverage provided by Section II. Coverage enhancements, DB-A. Dependent business interruption sublimit, the following exclusion is added to the end of Section VI. Exclusions – What is not covered:
Supply chain providers DB-1. with respect to business interruption costs only, based upon or arising out of any total or partial interruption of the insured’s business due to any failure or act committed by, event or breach impacting, or outage of, a supply chain provider of the named insured or any subsidiary or acquired entity.
F. Solely with respect to the coverage provided by Section II. Coverage enhancements, DB-B. System failure sublimit, the following exclusion is added to the end of Section VI. Exclusions – What is not covered:
DB-2. with respect to business interruption costs resulting from a system failure only, based upon or arising out of any:
a. total or partial interruption of computer system owned or leased by any person or entity that is not an insured;
Excluded system failure losses
b. unauthorized acquisition, access, use, or disclosure of personally identifiable information, including but not limited to that resulting from the loss or theft of a device containing such personally identifiable information, that is not under the insured organization’s direct control; or c. any security failure or extortion threat against an entity that is not an insured.
Reputational Harm Coverage($250k)
6. A. The following is added to the end of Section II. Coverage enhancements:
Reputational harm sublimit RH-A. We will pay up to $250,000, per incident, for reputational harm resulting directly from the publication of an otherwise covered event, provided:
1. the event first occurs during the policy period and is reported to us in accordance with Section VII. Notice; and
2. the publication of such event occurs no later than the end of the policy period or 90 days after the end of the policy period for events first discovered by you in the last 90 days of the policy period.
You must pay the retention before we will be obligated to make any payment under this subsection RH-A, and any payments we make will be a part of, and not in addition to, the limit stated in the Declarations as applicable.
B. The following definitions are added to the end of Section VII. Definitions:
Publication means any report or communication that has been publicized to the general public through any media channel, including but not limited to television, print media, radio or electronic networks, the internet, or electronic mail.
Reputation means trust that your customers or clients have in doing business with you or in purchasing your products or services.
Endorsement 15
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network WCL E6314 CW (01/19) Page 7 of 14
HPAENADREN134
Reputational harm means income loss you sustain for a period greater than ten hours but no greater than six months due to your loss of clients, customers, or sales resulting from damage to your reputation or brand.
Reputational harm does not include any costs:
1. to rehabilitate your reputation or brand, including legal costs or expenses; or
2. directly caused by a publication of any occurrence other than a covered event.
C. Solely with respect to reputation harm, the following provision is added to the end of the Coverage Part:
The following are conditions precedent to the payment by us of any reputational harm:
1. You must complete and sign a written, detailed, and affirmed proof of loss within 90 days after your discovery of the publication of an event (unless such period has been extended by us in writing) which will include, at a minimum, the following information:
VIII. Conditions applicable
to reputational harm
a. a full description of the circumstances surrounding the reputational harm, including, without limitation, the time, place, and cause of the loss; b. a detailed calculation of any reputational harm; and c. all underlying documents and materials that reasonably relate to or form part of the basis of the proof of such reputational harm.
2. Any costs incurred by you in connection with establishing or proving reputational harm, including but not limited to preparing a proof of loss, will be your obligation, and are not covered under this policy.
3. In determining the amount of income loss covered under Section II. Coverage enhancements, RH-A. Reputational harm, due consideration will be given to the prior experience of your business, and to the probable business you could have performed had no publication of an event occurred.
Provided, such income loss will not include income that would likely have been earned as a result of an increase in volume of business due to favorable business conditions caused by the interruption of any other entity's business. Income loss will be calculated on a daily basis.
4. If we and the named insured do not agree on the amount of reputational harm, either party may make a written demand for an appraisal of the reputational harm. If such demand is made, each party will select a competent and impartial appraiser. The appraisers will then jointly select an umpire. If the appraisers cannot agree on an umpire, they may request that such selection be made by a judge of a court having jurisdiction. Each appraiser will separately state the amount of reputational harm. If the appraisers do not agree on the amount of the reputational harm, they will submit their differences to the umpire. Agreement by the umpire and at least one of the appraisers regarding the amount of the reputational harm will be binding on you and us. Each party will pay their respective chosen appraiser and will equally share the costs of the umpire.
Endorsement 15
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network WCL E6314 CW (01/19) Page 8 of 14
HPAENADREN134
The Data Breach and Privacy Security Liability Coverage Part is amended as follows:
Amend Personally Identifiable Information and Regulatory Action Endorsement (EU General Data Protection Regulation)
7. A. In Section VII. Definitions, the definition of “Personally identifiable information” is deleted in its entirety and replaced with the following:
Personally identifiable
information
means the following, in any form, that is in your care, custody, or control, or in the care, custody, or control of any third party for whom you are legally liable:
1. non-public individually identifiable information as defined in any foreign, federal, state, or local statute, rule, or regulation, including but not limited to:
a. unsecured protected health information as defined by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), or b. personal data, as defined by the EU General Data Protection Regulation (2016/679),
both as may be amended, and any rule or regulation promulgated under such law act or regulation; or
2. any:
i. social security number or individual taxpayer identification number; ii. driver’s license number or state identification number; iii. passport number;
iv. credit card number; or
v. financial account number or debit card number in combination with any required security code.
B. In Section VII. Definitions, the definition of “Regulatory action” is deleted in its entirety and replaced with the following:
Regulatory action means any civil regulatory action brought against you by a regulator, including any action arising under the EU General Data Protection Regulation (2016/679), as amended, and any rule or regulation promulgated thereunder.
Reputational Harm Coverage
8. A. The following is added to the end of Section II. Coverage enhancements:
Reputational harm sublimit RH-A. We will pay up to $250,000, per incident, for reputational harm resulting directly from the publication of an otherwise covered breach, provided:
1. the breach first occurs during the policy period and is reported to us in accordance with Section VII. Notice; and
2. the publication of such breach occurs no later than the end of the policy period or 90 days after the end of the policy period for breaches first discovered by you in the last 90 days of the policy period.
You must pay the retention before we will be obligated to make any payment under this subsection RH-A, and any payments we make will be a part of, and not in addition to, the coverage part limit.
B. The following definitions are added to the end of Section VII. Definitions:
Endorsement 15
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network WCL E6314 CW (01/19) Page 9 of 14
HPAENADREN134
Income loss means the sum of the following:
1. Net Income (Net Profit or Loss before income taxes) that would have been earned; and
2. continuing normal operating expenses incurred, including payroll.
Publication means any:
1. report or communication that has been publicized to the general public through any media channel, including but not limited to television, print media, radio or electronic networks, the internet, or electronic mail; or
2. notice to data subjects affected by a breach.
Reputation means trust that your customers or clients have in doing business with you or in purchasing your products or services.
Reputational harm means income loss you sustain for a period greater than ten hours but no greater than six months due to your loss of clients, customers, or sales resulting from damage to your reputation or brand.
Reputational harm does not include any:
1. costs to rehabilitate your reputation or brand, including legal costs or expenses;
2. breach costs; or
3. costs directly caused by a publication of any occurrence other than a covered breach.
C. Solely with respect to the coverage provided in this Endorsement, the following provision is added to the end of the Coverage Part:
The following are conditions precedent to the payment by us of any reputational harm:
1. You must complete and sign a written, detailed, and affirmed proof of loss within 90 days after your discovery of the publication of a breach (unless such period has been extended by us in writing) which will include, at a minimum, the following information:
VIII. Conditions applicable
to reputational harm
a. a full description of the circumstances surrounding the reputational harm, including, without limitation, the time, place, and cause of the loss; b. a detailed calculation of any reputational harm; and c. all underlying documents and materials that reasonably relate to or form part of the basis of the proof of such reputational harm.
2. Any costs incurred by you in connection with establishing or proving reputational harm, including but not limited to preparing a proof of loss, will be your obligation, and are not covered under this policy.
3. In determining the amount of income loss covered under Section II. Coverage enhancements, RH-A. Reputational harm, due consideration will be given to the Endorsement 15
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network WCL E6314 CW (01/19) Page 10 of 14
HPAENADREN134
prior experience of your business, and to the probable business you could have performed had no publication of a breach occurred.
Provided, such income loss will not include income that would likely have been earned as a result of an increase in volume of business due to favorable business conditions caused by the interruption of any other entity's business. Income loss will be calculated on a daily basis.
4. If we and the named insured do not agree on the amount of reputational harm, either party may make a written demand for an appraisal of the reputational harm.
If such demand is made, each party will select a competent and impartial appraiser.
The appraisers will then jointly select an umpire. If the appraisers cannot agree on an umpire, they may request that such selection be made by a judge of a court having jurisdiction. Each appraiser will separately state the amount of reputational harm. If the appraisers do not agree on the amount of the reputational harm, they will submit their differences to the umpire. Agreement by the umpire and at least one of the appraisers regarding the amount of the reputational harm will be binding on you and us. Each party will pay their respective chosen appraiser and will equally share the costs of the umpire.
Telephone Toll Fraud Sublimit
9. A. The following is added to the end of Section II. Coverage enhancements:
Telephone toll fraud sublimit TT-A. We will pay up to $100,000, in the aggregate, for long distance telephone charges incurred by you as a result of a telephone toll fraud, provided the telephone toll fraud first occurs and is discovered by you during the policy period and is reported to us is accordance with Section V. Your obligations.
If you incur charges for a period exceeding 30 days from the date on which the telephone toll fraud first occurs, we will only be obligated to pay such charges that are incurred during the first 30 days.
Any payment we make under this subsection TT-A will be subject to the retention and not the amount stated as such in the Declarations, and such payments will be a part of, and not in addition to, the coverage part limit.
B. Solely with respect to the coverage provided by this Endorsement, the following is added to the end of Section V. Your obligations:
Notifying us of telephone toll
fraud
You must give written notice to us of any telephone toll fraud, or circumstances reasonably likely to lead to a telephone toll fraud, that in your best estimate will exceed 50% of the retention identified above, as soon as possible after it is first discovered by you, but in any event no later than 90 days after you discover such telephone toll fraud or circumstances.
C. Solely with respect to the coverage provided by this Endorsement, the following Section is added to the Coverage Part:
TT-I. The following are conditions precedent to the payment by us of any long distance telephone charges incurred by you as a result of a telephone toll fraud:
Conditions
applicable to
telephone toll fraud
losses
TT-1. you must inform, or allow us to inform, the appropriate law enforcement authorities if you have reason to believe that any telephone toll fraud involves a violation of law;
Endorsement 15
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network WCL E6314 CW (01/19) Page 11 of 14
HPAENADREN134
TT-2. you must give us a detailed, sworn proof of loss within 120 days of notification to us of a telephone toll fraud; and
TT-3. we have the right to examine and audit your books and records as they relate to the coverage provided by this Endorsement at any time during the policy period and up to three years afterward.
D. The following exclusions are added to the end of Section VI. Exclusions – What is not covered:
We will have no obligation to pay any sums under this Coverage Part for:
TT-1. any telephone toll fraud resulting from the use of telephone lines directly controlled by more than one voice computer system;
TT-2. any telephone toll fraud resulting from the failure to install and maintain in operating condition a call disconnect feature to terminate a caller’s access after three unsuccessful attempts to enter an account code; TT-3. any telephone toll fraud resulting from the failure to incorporate a system password or change a system password every 60 days;
TT-4. claim expenses incurred by you which are related to any legal action resulting from a telephone toll fraud; TT-5. any telephone toll fraud resulting from any dishonest act committed by you, if the named insured is an individual, or by any employee, or board member, trustee, director, or officer (or equivalent position) of the named insured or subsidiary; or
TT-6. any telephone toll fraud resulting from any actual or alleged unauthorized acquisition, access, use, or disclosure of personally identifiable information or confidential corporate information that is held or transmitted in any form; however, this exclusion will not apply to a telephone toll fraud directly resulting from the use of such personally identifiable information or confidential corporate information.
E. The following definitions are added to the end of Section VII. Definitions:
Account code means a confidential and protected string of characters that identifies or authenticates a person and permits that person to gain access to your voice computer system for the purpose of making long distance toll calls or utilizing voice mail box messaging capabilities or similar functional features of the system.
System administration means the performance of any security function, including but not limited to:
1. defining authorized persons to access the system;
2. adding, deleting, or changing account codes or passwords;
3. installing or deleting any system option which directs telephone call routing or adds, drops, or moves telephone lines; or
4. any other activity allowed by a hardware or software-based system option that has been incorporated by a manufacturer or a vendor into a voice computer system, provided the system is not intended for the sole use of the manufacturer or vendor.
System maintenance means performing hardware and software installation, diagnostic and correction, and similar activities that are performed in the usual custom and practice by a manufacturer or vendor to establish or maintain the basic operational functionality of a voice computer system.
Endorsement 15
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network WCL E6314 CW (01/19) Page 12 of 14
HPAENADREN134
System password means a confidential and protected string of characters that identifies or authenticates a person and permits that person to gain access to your voice computer system to perform system administration or system maintenance or a component of either.
Telephone toll fraud means the fraudulent use or fraudulent manipulation of an account code or system password required to gain access into your voice computer system which results in long distance telephone charges incurred by you.
Voice computer system means a computer system installed in one location which functions as a private branch exchange (PBX), voice mail processor, or automated call attendant, or provides a similar capability used for the direction or routing of telephone calls in a voice communications network.
The Cyber Enhancements Coverage Part, Data Breach and Security Liability Coverage Part, Technology Professional Liability Coverage Part, and Media Liability Coverage Part (if purchased) are amended as follows:
I. In Section III. Who is an insured of the Media Liability Coverage Part, the definition of “Acquired entity” is deleted in its entirety and replaced with the following:
Acquired entity means an entity in which the named insured, during the policy period:
1. acquires substantially all of the assets;
2. acquires the majority of its voting securities, as a result of which it becomes a subsidiary; or
3. merges and leaves the named insured as the surviving entity.
With respect to an acquired entity whose revenues exceed 20% of the annual revenues of the named insured at the time of its creation or acquisition, any coverage under this policy will expire 90 days after the effective date of its creation or acquisition unless, within such 90 day period:
1. the named insured provides us with written notice of such creation or acquisition;
2. the named insured provides us with information related to such creation or acquisition as we may reasonably require;
3. the named insured accepts any special terms, conditions, exclusions, or additional premium charge as we may reasonably require; and
4. we agree by written endorsement to provide such coverage.
This policy will apply to an acquired entity only with respect to your media activities or your advertising of your professional services performed after the acquisition, merger, or creation.
II. In Section III. Who is an insured of the Technology Professional Liability Coverage Part, the definition of “Acquired entity” is deleted in its entirety and replaced with the following:
Acquired entity means an entity in which the named insured, during the policy period:
1. acquires substantially all of the assets;
2. acquires the majority of its voting securities, as a result of which it becomes a subsidiary; or
3. merges and leaves the named insured as the surviving entity.
With respect to an acquired entity whose revenues exceed 20% of the annual revenues of the named insured at the time of its creation or acquisition, any coverage under this policy will expire 90 days after the effective date of its creation or acquisition unless, within such 90 day period:
1. the named insured provides us with written notice of such creation or acquisition; Endorsement 15
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network WCL E6314 CW (01/19) Page 13 of 14
HPAENADREN134
2. the named insured provides us with information related to such creation or acquisition as we may reasonably require;
3. the named insured accepts any special terms, conditions, exclusions, or additional premium charge as we may reasonably require; and
4. we agree by written endorsement to provide such coverage.
This policy will apply to an acquired entity only with respect to your technology services performed after the acquisition, merger, or creation. If a claim results from technology services performed both before and after the acquisition, merger, or creation of an acquired entity, this policy will apply only to that portion of the claim attributable to the technology services performed after the acquisition, merger, or creation.
III. In Section III. Who is an insured of the Cyber Enhancements Coverage Part, the definition of “Acquired entity” is deleted in its entirety and replaced with the following:
Acquired entity means an entity in which the named insured, during the policy period:
1. acquires substantially all of the assets;
2. acquires the majority of its voting securities, as a result of which it becomes a subsidiary; or
3. merges and leaves the named insured as the surviving entity.
With respect to an acquired entity whose revenues exceed 20% of the annual revenues of the named insured at the time of its creation or acquisition, any coverage under this policy will expire 90 days after the effective date of its creation or acquisition unless, within such 90 day period:
1. the named insured provides us with written notice of such creation or acquisition;
2. the named insured provides us with information related to such creation or acquisition as we may reasonably require;
3. the named insured accepts any special terms, conditions, exclusions, or additional premium charge as we may reasonably require; and
4. we agree by written endorsement to provide such coverage.
This policy will apply to an acquired entity only with respect to an event which first occurs and is discovered after the acquisition, merger, or creation.
IV. In Section III. Who is an insured of the Data Breach and Privacy Security Liability Coverage Part, the definition of “Acquired entity” is deleted in its entirety and replaced with the following:
Acquired entity means an entity in which the named insured, during the policy period:
1. acquires substantially all of the assets;
2. acquires the majority of its voting securities, as a result of which it becomes a subsidiary; or
3. merges and leaves the named insured as the surviving entity.
With respect to an acquired entity whose revenues exceed 20% of the annual revenues of the named insured at the time of its creation or acquisition, any coverage under this policy will expire 90 days after the effective date of its creation or acquisition unless, within such 90 day period:
1. the named insured provides us with written notice of such creation or acquisition;
2. the named insured provides us with information related to such creation or acquisition as we may reasonably require;
Endorsement 15
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network WCL E6314 CW (01/19) Page 14 of 14
HPAENADREN134
3. the named insured accepts any special terms, conditions, exclusions, or additional premium charge as we may reasonably require; and
4. we agree by written endorsement to provide such coverage.
This policy will apply to an acquired entity only with respect to your business operations performed after the acquisition, merger, or creation.
Endorsement effective: 08/08/2024 Certificate No.: MPL1790263.24 Endorsement No: 15 Processed Date: 07/08/2024
Hiscox Inc.
Authorized Representative
Kevin Kerridge
Endorsement 16
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network INT E9998 CW (01/15) Page 1 of 1
HPAENADREN134
E9998.2 TRIA Not Purchased Endorsement
Terrorism Risk Insurance Act, as amended
Not Purchased Endorsement
This Endorsement is issued in accordance with the terms and conditions of the federal Terrorism Risk Insurance Act.
It is hereby noted that the Company has made available coverage for insured losses directly or indirectly resulting from an “act of terrorism" and the Insured has declined or not confirmed to purchase this coverage.
This Insurance therefore affords no coverage for losses directly or indirectly resulting from an "act of terrorism" except to the extent, if any, otherwise provided by this Policy.
The term "act of terrorism" means an act that is certified by the Secretary of the Treasury, in accordance with the provisions of the federal Terrorism Risk Insurance Act, to be an act of terrorism pursuant to such Act. The criteria contained in the Terrorism Risk Insurance Act for an “act of terrorism” include the following:
1 The act resulted in insured losses in excess of $5 million in the aggregate, attributable to all types of insurance subject to the Terrorism Risk Insurance Act; and
1 The act is a violent act or an act that is dangerous to human life, property or infrastructure and is committed by an individual or individuals as part of an effort to coerce the civilian population of the United States or to influence the policy or affect the conduct of the United States Government by coercion.
All other terms, conditions, insured coverage and exclusions of this Insurance including applicable limits and deductibles remain unchanged and apply in full force and effect to the coverage provided by this Insurance.
All other terms and conditions remain unchanged.
Endorsement effective: 08/08/2024 Certificate No.: MPL1790263.24 Endorsement No: 16 Processed Date: 07/08/2024
Hiscox Inc.
Authorized Representative
Kevin Kerridge
Endorsement 17
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network PLPTCH E8673 CW (10/23) Page 1 of 3
HPAENADREN134
E8673.2 Privacy, Biometrics, and Cyber Incidents Endorsement (Tech) In consideration of the premium charged, and on the understanding this endorsement leaves all other terms, conditions, and exclusions unchanged, it is agreed:
I. The Technology Professional Liability Coverage Part (if purchased) is amended as follows:
A. Section I. What is covered is deleted in its entirety and replaced with the following:
I. What is covered We will pay up to the coverage part limit for damages and claim expenses in excess of the retention for covered claims against you resulting from the performance of your technology services by you or anyone on your behalf (including your subcontractors, outsourcers, or independent contractors) on or after the retroactive date, for any actual or alleged:
1. negligent act, error, or omission, or negligent misstatement or negligent misrepresentation, including any of the foregoing that results:
a. from a cyber incident you sustain which prevents or impedes your performance of technology services; or
b. in a cyber incident impacting your client; however, this subsection b will not include an actual or suspected data breach sustained by your client; or
2. unintentional breach of a written contract with your client, including an unintentional breach resulting from a cyber incident you sustain that prevents or impedes your performance of technology services,
provided the claim is first made against you during the policy period and is reported to us in accordance with Section V. Your obligations.
B. In Section VI. Exclusions – What is not covered, the “Collection of data without knowledge/ consumer privacy” exclusion is deleted in its entirety and replaced with the following:
based upon or arising out of any actual or alleged:
a. unauthorized or improper acquisition, access, use, disclosure, collection, possession, handling, storage, dissemination, destruction, capture, sale, purchase, or retention of, or failure to protect or safeguard any nonpublic personally identifiable information, biometric identifiers, biometric data, biometric information, confidential and sensitive information, genetic information, or confidential corporate information; b. violation of any federal, state, local, or foreign privacy law, biometric information law, consumer data protection law, or any common law governing, relating to, or protecting against the use, collection, or disclosure of any information about a person or any conduct, data, or information described in subpart a above; C. In Section VII. Definitions, the following is added to the end of the definition of “Damages”:
Endorsement 17
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network PLPTCH E8673 CW (10/23) Page 2 of 3
HPAENADREN134
Damages does not include any amounts owed by you under a written contract, including a client services agreement, regarding an actual or suspected data breach of personally identifiable information or confidential corporate information that is held or transmitted in any form.
II. The General Liability Coverage Part (if purchased) is amended as follows:
In Section VI. Exclusions – What is not covered, D. Exclusions applicable to the entire general liability coverage part, the “Privacy” exclusion is deleted in its entirety and replaced with the following:
We will have no obligation to pay any sums under this Coverage Part for medical expenses, or for any claim, including any damages or claim expenses, for bodily injury, property damage, or personal and advertising injury:
Privacy, biometrics, and cyber based upon or arising out of any actual or alleged:
incidents
PR-1.
a. unauthorized or improper acquisition, access, use, disclosure, collection, possession, handling, storage, dissemination, destruction, capture, sale, purchase, or retention of, or failure to protect or safeguard any non-public personally identifiable information, biometric identifiers, biometric data, biometric information, confidential and sensitive information, genetic information, or confidential corporate information;
b. violation of any federal, state, local, or foreign privacy law, biometric information law, consumer data protection law, or any common law governing, relating to, or protecting against the use, collection, or disclosure of any information about a person or any conduct, data, or information described in subpart a above;
c. denial of service or delay, disruption, impairment, failure, or outage of any part of a computer system or network;
d. unauthorized or unlawful access to any electronic data or any part of a computer system or network, including through the transmission of any malicious code, such as a computer virus, worm, logic bomb, malware, spyware, Trojan horse, or other fraudulent or unauthorized computer code; or e. threat, hoax, trick, or demand relating to subparts a through d above.
This exclusion will apply even if the claim against you alleges negligence or other wrongdoing in the:
i. failure to prevent any cyber incident listed in subparts a through d above or any resulting property damage, bodily injury, or personal and advertising injury; or
ii. failure to report any incident to the authorities.
Endorsement 17
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network PLPTCH E8673 CW (10/23) Page 3 of 3
HPAENADREN134
Endorsement effective: 08/08/2024 Certificate No.: MPL1790263.24 Endorsement No: 17 Processed Date: 07/08/2024
Hiscox Inc.
Authorized Representative
Kevin Kerridge
Endorsement 18
NAMED INSURED: Mendocino Unified School District dba Mendocino Community Network WCL E6065 CW (07/14) Page 1 of 1
HPAENADREN134
E6065.3 Change of Mailing Address Endorsement
In consideration of the premium charged, and on the understanding this endorsement leaves all other terms, conditions, and exclusions unchanged, it is agreed:
Solely for the purposes of mailing, the following address is added to Item 1 of the Declarations:
PO Box 2445 Mendocino, CA 95460
Endorsement effective: 08/08/2024 Certificate No.: MPL1790263.24 Endorsement No: 18 Processed Date: 07/08/2024
Hiscox Inc.
Authorized Representative
Kevin Kerridge
Hiscox Inc.
5 Concourse Parkway
Suite #2150
Atlanta, GA 30328
INT N0146 CW (10/20)
CYBER NOTICE
In light of the continually evolving cyber risk environment, starting January 1, 2021, Hiscox Inc. policies incepting on or after January 1, 2021 will include specific language affirmatively stating whether we are covering or excluding losses caused by cyber events.
Your Hiscox Pro™ policy will include the following endorsement(s), depending on the type of coverage(s) you have purchased:
Miscellaneous Professional Liability
(Including all tailor-made products)
Cyber Exclusion Endorsement explaining the intent to
exclude losses arising from described cyber events or
incidents.
This endorsement potentially reduces the scope of
coverage offered under the policy.
Technology Professional Liability Cyber Clarification Endorsement affirmatively stating our intent to cover specified covered losses arising from
described cyber events or incidents.
This endorsement clarifies and does not alter the intended scope of coverage offered under your policy.
General Liability Cyber Exclusion Endorsement explaining the intent to exclude losses arising from described cyber events or
incidents.
This endorsement potentially reduces the scope of
coverage offered under the policy.
Any limitations contained in the above referenced endorsement(s) will not apply to otherwise covered losses explicitly described in the endorsement(s), or to loss covered in a Network Security and Privacy or other similar endorsement you have purchased, if applicable.
If you have additional questions or concerns about the endorsement or this Notice, please contact your authorized insurance agent or broker. Thank you for your business and we look forward to continue providing you with quality service.
Hiscox Inc.
5 Concourse Parkway
Suite #2150
Atlanta, GA 30328
INT N0146 CW (10/20)
Technology, Privacy and Cyber Policyholder Guide
www.hiscoxbroker.com
Congratulations on your purchase of a Hiscox Privacy and Data Breach Protection Policy!
This Policyholder Guide provides details of the risk management tools made available to you, as a Hiscox Technology and Privacy policyholder, and how you access them.
I) How to notify Hiscox when you have a claim
Claims Service
We understand how important the claims handling process is to our policyholders, and our dedicated inhouse technology claims attorneys believe in a “fast and fair” claims approach, which includes:
A dedicated claims inbox for receiving claim notifications, monitored multiple times per day New claim acknowledgement within 1 business day
Assigned claims representative contact with policyholder/broker within 2 business days An open dialogue throughout the claims process
Claim Notification
The specific provisions regarding proper notification of a claim against your policy are contained in your policy wording and endorsements. However, if you ever have any questions about when or how to notify us of a claim, please contact your agent or broker. Alternatively, you can contact the Hiscox Tech and Privacy/Data Breach Claims Department: [email protected]
Guide Contents
I) How to notify Hiscox when you have a claim
Provides details on Hiscox claims service and contact information for claim notification.
II) How to access the complimentary risk management tools Provides details on how to access the value added services available to help you to reduce your risk, for which you have qualified for complimentary access as a Hiscox Technology Protection policyholder.
III) Breach preparedness and response
Suffered a data breach? This Policyholder Guide provides details on how to access available resources, including a toll-free hotline to a Breach Coach® to get your started.
Technology, Privacy and Cyber Policyholder Guide
www.hiscoxbroker.com
II) How to access the complimentary risk management tools
a) Risk Management Assistance
As a complimentary service to this policy, we are pleased to provide a free, confidential risk management and loss prevention service, consisting of an initial consultation and up to 1-hour of legal services to assist you in better understanding and minimizing risks that commonly lead to the types of claims covered under this policy.
If you have a question about minimizing these types of liability risks in your business, please email your question to: [email protected]
Please include your Hiscox Policy Number which can be found on the Declaration Page of your policy.
A Hiscox representative will get back to you within 1 (one) business day with a referral to a nationally recognized law firm with a practice specifically focused on your industry1. Please note that any inquiries made to this service will not constitute a notice of claim or potential claim under your policy. For all claim or potential claim matters, please follow the notification provisions in your policy. Please also note that this service is not intended to respond to questions regarding your insurance policy or coverage. For all such inquiries, please contact your agent or broker.
Complimentary Risk Management Tools
As a Hiscox Technology or Privacy Protection policyholder, you qualify for complimentary access to value added services meant to help you reduce your risk. Due to the coverage you have purchased, you have qualified for complimentary access to the following services (detailed on the following pages):
a) Risk Management Assistance
b) BreachProtection™ Breach Prevention Resources
c) Hiscox eRisk Hub® Breach Response Resource and Information Web Portal d) Control Risks Cyber Extortion Response (contingent on purchase of Hiscox Cyber Extortion policy)
Technology, Privacy and Cyber Policyholder Guide
www.hiscoxbroker.com
b) BreachProtection™ Breach Prevention Resources2
Don’t let a breach catch you unprepared.
As a qualified Hiscox Technology Protection policyholder, you now have free access to BreachProtection™. BreachProtection provides comprehensive risk management tools through BreachProtection.com and subject-matter specialists to help answer your questions.
Getting Started Using breachprotection.com
BreachProtection.com provides unlimited access to:
Online compliance materials: Federal and state compliance materials regarding data security, data breaches, and data privacy, including:
• summaries of federal and state laws with links to statutes and regulations • sample policies and procedures
• continuing updates and electronic notification of changes to the online materials.
Email updates: Periodic newsletters provide information on changes in federal and state laws regarding data security, data breach, and data privacy issues. Additional emails provide notice of matters requiring immediate attention.
Online support: Receive support from privacy/security specialists regarding:
• healthcare, HIPAA and HITECH compliance issues
• data breach prevention and computer forensic issues
• data security best practices
Procedures and sample forms
• Risk assessment procedures
• Guidance to improve safeguards (administrative/physical/technical) • Procedures for responding to a data breach and customizing an Incident Response Plan • Pre-publication checklists
Workforce training
• Online training programs
• Employee training bulletins
• Periodic webinars
Data Breach Response
• Breach notification law summaries
• HIPAA/HITECH security breach guidance
• Links to your data breach response provider
Getting started
To ensure you get timely access to these services, email [email protected] or call the BreachProtection Account Specialists at 559-577-1248. Please provide: (1) the name of your business as it appears on your Hiscox insurance policy; (2) your Hiscox insurance policy or certificate number; and (3) your Hiscox insurance policy expiration date.
Technology, Privacy and Cyber Policyholder Guide
www.hiscoxbroker.com
c) Hiscox eRisk Hub® Breach Response Resource and Information Web Portal3 Register now! Don’t wait until you have suffered a breach. Be prepared.
As a qualified Hiscox Technology Protection policyholder, you now have free access to the Hiscox eRisk Hub® portal, powered by NetDiligence®.
Hiscox eRisk Hub is a private, web-based portal containing information and technical resources provided to assist you in the timely reporting, response and recovery from a data breach event.
Please note the following:
1. The Hiscox eRisk Hub portal is a private site for Hiscox Technology Protection policyholders only. Do not share portal access instructions with anyone outside your organization. You are responsible for maintaining the confidentiality of the Hiscox access code provided to you.
2. Up to three individuals from your organization may register and use the portal. Ideal candidates include your company’s Risk Manager, Compliance Manager, Privacy Officer, IT Manager or Legal Counsel.
3. This portal contains a directory of experienced providers of cyber risk management and breach recovery services. Hiscox does not endorse these companies or their respective services. Before you engage any of these companies, we urge you to conduct your own due diligence to ensure the companies and their services meet your needs. Unless otherwise indicated or approved, payment for services provided by these companies is your responsibility.
4. Should you experience a data breach event, you may choose to call the Breach Coach® listed in the portal for immediate triage assistance. Your initial consultation of up to one hour is free of charge.
Please be aware that the Breach Coach® service is provided by a third-party law firm. Therefore, calling the Breach Coach® does not satisfy the claim notification requirements of your policy.
We are pleased to provide our qualified Hiscox Technology Protection Insurance policyholders with free access to this portal. To register:
1. go to www.eriskhub.com/hiscox.php
2. complete the registration form. Your Hiscox access code is 08663
3. once registered, you can access the portal immediately.
For more information or questions, email [email protected].
Key features of the Hiscox eRisk Hub® portal
• Breach Response Services:
– Incident Roadmap – includes suggested steps to take following a breach event. – Breach Coach® – a resource to support you in managing your response, including a free initial consultation.
– Breach Response Team – a list of data breach service providers at predetermined rates. • eRisk resources – a directory to quickly find external resources with expertise in pre- and postbreach disciplines.
Technology, Privacy and Cyber Policyholder Guide
www.hiscoxbroker.com
d) Control Risks Cyber Extortion Response
Since 1975, Control Risks has advised clients on the resolution of more than 2,600 cases of extortive crime in 129 countries. Their dedicated team of Response consultants responds to an average of 155 cases of extortive crime per year, including threat extortions.
Alongside their Response division, Control Risks has a specialist Cyber team (with expertise in providing cyber threat intelligence, incident prevention and cyber breach response services).
For Cyber response services including cyber extortions, Control Risks’ approach is to assist the affected business to manage the incident, identify its objectives and follow the resulting plan of action.
As part of their crisis management assistance, Control Risks will involve internal and external experts, including their IT Forensics partner, MWR InfoSecurity, whose technical experts will assist in IT forensic investigations, and legal and public relations experts to help clients respond to and contain the fallout from a cyber-attack4.
To contact Control Risks in the event of a cyber extortion incident or advise regarding cyber extortion management:
Control Risks
Control Risks Response Team
888 245 8654
Technology, Privacy and Cyber Policyholder Guide
www.hiscoxbroker.com
III) Breach Preparedness and Response
Knowing what to do in the event of a data breach can make the situation much less daunting, helping to minimize the impact to your business. We have produced this quick guide to assist you in responding to a breach event.
Our philosophy: it is not our place to mandate exactly how you respond to such a critical event for your business, but rather we should provide you with the necessary resources and guidance to help minimize the impact the event has on your business. The following provides you with details on quickly accessing the resources available to guide you and assist you in responding to the event.
PRIOR TO A BREACH
Register at BreachProtection™ (see registration details in this document) for risk management policies, procedures, training, and other tools to help your company prevent and better respond to a breach of confidential information.
Register at Hiscox eRisk Hub® (see registration details in this document) to assist you in getting a response plan in place with access to the third party resources available to help you more efficiently and cost-effectively respond to and recover from a breach.
IF A BREACH OCCURS
Step 1: Engage the expert resources available to you
A) Contact the Breach Coach® at the toll free Hiscox Breach Response Hotline Registered members of the Hiscox eRisk Hub® are entitled to one hour of free consultation with a Breach Coach®.
You may request the assistance of a Breach Coach® by phone or email. As part of your request, be sure to provide your company name, along with the names of all other companies and/or individuals that may be involved in the breach event.
1-855-HISCO-BR(447-2627)
[email protected]
An attorney from Baker Hostetler is on call 24 hours a day/7 days a week.
B) Notify Hiscox
At such as critical time, it is important that the claims handling process be fast and fair. Engaging our dedicated in-house claim attorneys early in the process provides you with additional experienced professionals to assist you in your breach response. This also provides for an open dialogue throughout the process so you can worry about properly responding to the breach and not worry about your insurance.
Please work with your broker or agent to properly notify Hiscox of the breach event…the specific provisions for formal notification of a claim or breach event against your policy are contained in your policy wording and endorsements.
If you or your agent or broker have any questions or need to contact us regarding claim notification, you can contact the Hiscox Tech and Privacy/Data Breach Claims Department: [email protected] Technology, Privacy and Cyber Policyholder Guide
www.hiscoxbroker.com
Step 2: Work with the expert resources to determine next and appropriate steps Hiscox Claims specialists and/or the Breach Coach® are available to assist you in determining what steps to take and how to engage the breach response providers from the pre-approved Hiscox Preferred Breach Response Providers List. This list is comprised of specialists available to provide the legal, forensics, notification, call center and credit or identity protection services in response to your breach.
The Hiscox Claims specialists and/or Breach Coach® can help you determine:
if a forensics investigation is needed,
if breach notifications are required,
the potential for regulatory investigations,
the potential for legal action,
your next steps.
Be prepared
Today a breach of confidential information is almost inevitable. By registering for and using the breach prevention and breach response services as well as promptly engaging your Breach Coach® and the Hiscox Claims specialists in the event you have a breach, you are taking appropriate steps to lessen the impact the breach event has on your business.
4 Technology Protection Policyholder Guide
hiscoxusa.com/broker
About Hiscox in the US
Hiscox, the international specialist insurer, is headquartered in Bermuda and listed on the London Stock Exchange (LSE:HSX). There are three main underwriting parts of the Group - Hiscox London Market, Hiscox UK and Europe and Hiscox International. Hiscox International includes operations in Bermuda, Guernsey and the USA. Hiscox ASM Ltd, Hiscox Underwriting Ltd and Hiscox Syndicates Ltd are authorized and regulated by the UK Financial Services Authority. The ability of syndicates at Lloyd’s to do business in the USA, and its territories, is restricted as they are not US-based insurers.
Hiscox Inc., a Delaware corporation headquartered in New York, d/b/a Hiscox Insurance Agency in CA, is a licensed insurance intermediary for admitted and surplus lines business. Hiscox Inc. underwrites on behalf of, and places business with, Hiscox Insurance Company Inc., other domestic insurers, and syndicates at Lloyd's (www.lloyds.com). Hiscox Insurance Company Inc. (NAIC Number 10200) is a Chicago, IL domiciled insurer, which is admitted or licensed to do business in all 50 states and the District of Columbia.
Inquiries as to insurance or other products or services should be directed to an insurance agent or broker licensed to conduct business in the relevant US state. For further information about an insurer's ability to do business in the USA and US territories please contact a licensed agent or broker for advice.
This communication provides general information on Hiscox’s products and services only and is not intended to be, and does not constitute, a solicitation of business by syndicates at Lloyd’s from or in respect of the USA or US territories. Coverages are subject to underwriting and may not be available in all states. The information contained herein is not a part of an insurance policy, and may not be used to modify any insurance policy that might be issued. In the event the actual policy forms are inconsistent with any information provided herein, the language of the policy forms shall govern.
1 The law firm, or other resource utilized for this risk management assistance, is solely responsible for all content and advice provided. 2 BreachProtection™ is solely responsible for all content and advice provided on breachprotection.com. The information provided through breachprotection.com does not constitute legal or other professional advice. Please consult your attorney or other professional advisor to discuss your specific situation and obtain the appropriate legal or other expert advice. 3 Coverage for the costs of engaging the services of a law firm or breach response service provider are subject to the terms and conditions of your policy, which in some instances may require the prior approval by Hiscox. Please familiarize yourself with the terms and conditions of your policy.
Information provided through the Hiscox eRisk Hub® portal does not constitute legal advice. Please consult your, attorney or other professional advisor to discuss your specific situation and obtain the appropriate legal or other expert advice. 4 Coverage for the costs of engaging the services of Control Risks are subject to the terms and conditions of your policy, which in some instances may require the prior approval by your insurance carrier. Please familiarize yourself with the terms and conditions of your policy.