Deerfield Insurance Company
  Evanston Insurance Company
  Essex Insurance Company
  Markel American Insurance Company
  Markel Insurance Company
  Associated International Insurance 
      Company		
InfoProSM
APPLICATION FOR INFORMATION TECHNOLOGY PROFESSIONAL LIABILITY AND
DATA BREACH AND PRIVACY LIABILITY, DATA BREACH LOSS TO INSURED
AND ELECTRONIC MEDIA LIABILITY INSURANCE 

Notice: The liability coverage(s) for which application is made: (1) applies only to “Claims” first made during the “Policy Period”; and (2) the limits of liability shall be reduced by “Claim Expenses” and “Claim Expenses” shall be applied against the deductible.
Please read the policy carefully.
If space is insufficient to answer any question fully, attach a separate sheet. 
If response is none, state NONE.

I.	GENERAL INFORMATION
1.	(a)	Full name of Applicant: 	
	(b)	Principal business premise address: 			
				(Street)	(County)
			
				(City)	(State)	(Zip)
	(c)	Phone Number: 	
	(d)	Date formed/organized (MM/DD/YYYY): 	
	(e)	Number of employees including principals:
		Full-time 	  Part-time 	  Seasonal /Temporary 	  Total	
	(e)	Date formed/organized (MM/DD/YYYY): 	
	(f)	Business is a:  [   ] corporation  [   ] partnership  [   ] individual  [   ] other 	
	(g)	Web site(s):	
2.	(a)	Is the Applicant controlled by, owned by, or commonly owned, affiliated or associated with any
		other organization?	[   ] Yes  [   ] No
	(i)	If Yes, are any services provided to such organization(s)?	[   ] Yes  [   ] No
	(b)	If Yes, to either of the above, provide details.	
3.	During the last year has the Applicant been involved in, or are they presently considering or contemplating:
(a)	Any merger, consolidation or acquisition?	[   ] Yes  [   ] No
(i)	If Yes, provide a complete explanation detailing liabilities assumed and any professional
	liability coverage purchased by any predecessor organization.	
(b)	A change in the nature of business operations?	[   ] Yes  [   ] No
(i)	If Yes, provide details.	
4.	During the last year has the name of the Applicant been changed?	[   ] Yes  [   ] No
	If Yes, provide details including previous name(s).	
II.	ADDITIONAL INFORMATION
1.	If you are a new Applicant with this company, attach:
(a)	Professional qualifications (i.e. resume or c.v.) of each of the owners, partners, officers and key employees of the Applicant(s) named in Part I. Question 1.(a) above.
(b)	Sample contract for services between the Applicant and its clients.
(c)	A list of and description of affiliations with any organization owned by any owner, partner or officer of any Applicant.
2.	If the Applicant is applying for renewal with this company, attach:
(a)	Any changes in any items provided last year pursuant to Items (a), (b), or (c) above.
III.	PROFESSIONAL ACTIVITIES AND SPECIALTY
1.	Do the Applicant’s professional services include any of the following?
(a)	Monitoring, creation or control of: 
(i)	Any aircraft or air-ground equipment of any kind?	[   ] Yes  [   ] No
(ii)	Military defense system or weaponry of any kind?	[   ] Yes  [   ] No
(b)	Processing, storing or transmission any pornographic matter, gaming or game of chance?	[   ] Yes  [   ] No
(c)	Operation of:
(i)	Any web site which includes user generated or user posted content on Applicant’s
	web site?	[   ] Yes  [   ] No
(ii)	Social networking web site(s)?	[   ] Yes  [   ] No
(d)	ACH (automated clearing housing) and/or credit/debit card processing on behalf of third parties
(banks, merchants, etc.)?	[   ] Yes  [   ] No
(e)	Software or services for automated securities (stock, commodity, option, etc.) trading?	[   ] Yes  [   ] No
(f)	Peer to peer file sharing of music and/or video content? 	[   ] Yes  [   ] No
(g)	Digital rights management software?	[   ] Yes  [   ] No
(h)	Digitization of music or video content?	[   ] Yes  [   ] No
If Yes to any of the above, provide the percentage of the Applicant’s operations attributable to each and the nature of involvement.	
					
2.	(a)	Applicant's gross annual revenues:	
(i)	Estimated annual gross revenues for the current year:  $	
	(ii)	For the last twelve (12) month period:	$	
	(iii)	For prior year:	$		
	(b)	Percentage of annual gross revenues for the current year:
		(i)	Domestic		%
		(ii)	Foreign:		%	Identify countries: 	
3.	Provide the percentage of the Applicant’s revenues from the following for the current year:
Computer Services/Consulting	Hardware/Telecomm	Software/Software as a Service

	% Business Process Outsourcing		% Cable TV/Satellite		% CAD 
	% Data Base Administration		% Electronic Components 		% ERM/ERP 
	% Data Processing		% Hardware Sales		% Financial Records
	% Help Desk Service		% Internet Service Provider		% Financial Transactions
	% IT Consulting - Non-Security		% Search Engine		% Insurance Underwriting/
	% IT Consulting - Security		% Search Engine Optimization			Claims
	% IT Staffing/Staff Augmentation		% Telecommunications		% Medical Diagnostics/
	% IT Training		% VAR (ERM/ERP)			Decision Support
	% Network Design/Installation		% VAR (non-ERM/ERP)		% Medical Records/
	% Security Monitoring		% Web Page Design			Imaging
			% Web Page Hosting		% Network Security
					% Pre-Packaged NOC
					% Records Management
4.	Is the Applicant engaged in any business or profession other than as described in Question 3. above?	Yes [   ]  No [   ]
	(a)	If Yes, describe any professional services performed for others not contemplated in Question 3. above and indicate the percentage of gross revenues derived from each activity.
	Professional Services	Percent of Gross Revenues
				%
				%
				%
				%
5.	Does the Applicant utilize the services of independent contractors or sub-consultants?	[   ] Yes  [   ] No
	(a)	If Yes, indicate percentage of billings and whether a certificate of professional liability insurance is required of each. 		
6.	Provide the following for the Applicant’s five largest clients for the last three years:
	Client Name	Professional Services	Gross Revenues
					$	
					$	
					$	
					$	
					$	
7.	Were more than 50% of the Applicant’s gross revenues for any of the last three years derived from
	any one contract?	[   ] Yes  [   ] No
	(a)	If Yes, specify client, professional services and duration of contract. 	
		
IV.	RISK MANAGEMENT 
1.	Does the Applicant have a:
	(a)	Policy for the testing and documentation of all software and system development?	[   ] Yes  [   ] No
	(b)	Pre-implementation review or evaluation process in place?	[   ] Yes  [   ] No
	(c)	Procedure for testing for security vulnerabilities throughout the lifecycle of the Applicant’s
		products?	[   ] Yes  [   ] No
		If Yes,
		(i)	Describe the Applicant’s procedure for contacting clients in the event a potential problem is
			found:						
	(ii)	Does the Applicant provide patches, bug fixes or other corrections free of charge?	[   ] Yes  [   ] No
		(iii)	Does the Applicant have a designated security manager?	[   ] Yes  [   ] No
	(d)	Formal process for customer complaint resolution?	[   ] Yes  [   ] No
		If Yes, describe.	
	(e)	Perform background checks on employees with access to sensitive client data including work at
		client sites and access to client networks?	[   ] Yes  [   ] No
2.	Do all of the Applicant’s clients provide written acceptance of all software and/or system development
	prior to production and/or implementation?	[   ] Yes  [   ] No
3.	Has the Applicant ever discontinued or replaced any product for reasons other than a routine technology
	upgrade?	[   ] Yes  [   ] No
	(a)	If Yes, provide details.	
4.	In the last three years, has the Applicant:
	(a)	Filed any suits to collect fees?	[   ] Yes  [   ] No
		(i)	If Yes, how many?	
	(b)	Filed an intellectual property suit against a third party?	[   ] Yes  [   ] No
5.	Indicate the percentage of the Applicant’s business using each type of contact below:
	(a)	Applicant’s Standard Contract/License Agreement/Letter of Engagement		%
	(b)	Modified Applicant Letter of Engagement		%
	(c)	Client Contract Agreement/Letter of Engagement		%
	(d)	Purchase Order		%
	(e)	No Contract		%
6.	Do the Applicant’s contracts contain:
	(a)	Hold harmless clause in favor of:	[   ] Applicant    [   ] Client    [   ] Mutual     [   ] None 
	(b)	Limitation of liability in favor of:	[   ] Applicant    [   ] Client    [   ] Mutual     [   ] None
	(c)	Disclaimer of warranties?	[   ] Yes  [   ] No
	(d)	Ownership of intellectual property (IP) clause?	[   ] Yes  [   ] No
7.	Can standard contracts be modified?	[   ] Yes  [   ] No
	(a)	If Yes, who can approve modifications:
		(i)	General Counsel/Attorney?	[   ] Yes  [   ] No
		(ii)	Principal, President, CEO or COO?	[   ] Yes  [   ] No
		(iii)	Vice President, Director or Manager?	[   ] Yes  [   ] No
		(iv)	Other		[   ] Yes  [   ] No
8.	Does the Applicant perform background checks on all employees and contractors with access to sensitive data on the Applicant’s network or on client networks?	[   ] Yes  [   ] No
9.	Does the Applicant host or store any private or confidential information for clients	[   ] Yes  [   ] No
	(a)	If Yes, describe type and volume of confidential information. 	
10.	Do the Applicant’s clients or other third parties rely on the Applicant's network for access to software
	and/or data?	[   ] Yes  [   ] No
If Questions 9. and 10. above are both answered No, skip to Section VI.
V.	NETWORK SECURITY – By attachment provide explanation of any No response.
A.	Basic Controls
1.	Does the Applicant:
	(a)	Have written information security and acceptable use policies?	[   ] Yes  [   ] No
		(i)	If Yes, are they disseminated to all users annually or more frequently?	[   ] Yes  [   ] No
	(b)	Have either a trained staff member or outside contractor responsible for managing its information
		security?	[   ] Yes  [   ] No
		(i)	If Yes, which of the following applies:
				[   ] Network security only   [   ] Network security and privacy compliance
	(c)	Reassess its information security policy and procedures?	[   ] Yes  [   ] No
		(i)	If Yes, how frequently:  [   ] Less than annually    [   ] Annually or more frequently
	(d)	Securely configure firewalls, routers and other security appliances?	[   ] Yes  [   ] No
		(i)	If Yes, which of the following applies:
		[   ] Change default admin passwords     [   ] Remove unneeded services
	(e)	Use anti-virus and anti-spyware software?	[   ] Yes  [   ] No
		(i)	If Yes, which of the following applies:
		[   ] On all desktop computers with automatic update
		[   ] On all computers and servers with automatic update 
		[   ] Scanning all incoming email
2.	How does the Applicant manage its:
	(a)	Security patch notifications from its major systems vendors?  [   ] No automatic notice
	[   ] Automatic notice (where available) and implement in more than 30 days
	[   ] Automatic notice (where available) implement in 30 days or less
	(b)	Change control process to ensure that modifications to its network do not compromise security before implementing them in production? [   ] No security testing    
		[   ] Some upgrades subject to security testing    [   ] All upgrades subject to security testing
3.	How does the Applicant limit access to its network? [   ] No controls or use shared log on ID’s 
	[   ] Unique user ID’s    [   ] Unique user ID’s and role based access to sensitive data 
4.	Does the Applicant have a process to delete systems access within 48 hours of employee termination?
		[   ] Yes  [   ] No
5.	Is sensitive data in databases, logs, files, backup media, etc. stored securely for example by means
	of encryption or truncation?	[   ] Yes  [   ] No
6.	Does the Applicant store sensitive information on any of the following media? If Yes, is it encrypted?
			Sensitive Data	Encrypted
	(a)	Laptop hard drives?	[   ] Yes  [   ] No	[   ] Yes  [   ] No
	(b)	PDA’s / other mobile devices?	[   ] Yes  [   ] No	[   ] Yes  [   ] No
	(c)	Flash drives or other portable storage devices?	[   ] Yes  [   ] No	[   ] Yes  [   ] No
	(d)	Back-up tapes?	[   ] Yes  [   ] No	[   ] Yes  [   ] No
7.	Is encryption used in the transmission of sensitive information via e-mail?	[   ] Yes  [   ] No
8.	How does the Applicant:
	(a)	Log access attempts to its network?  [   ] No log  [   ] Log unsuccessful attempts only  [   ] Log all attempts 
	(b)	Audit access to sensitive information by authorized users? [   ] No audits  [   ] In response to incidents
		[   ] Random audits quarterly or more frequently
9.	Is access to equipment, such as servers and workstations, and storage media containing
	sensitive data physically protected?	[   ] Yes  [   ] No
	(a)	If Yes, how is it physically controlled?  [   ] Areas open to employees only [   ] Role based access controls  
10.	Is a vulnerability scan or penetration test performed on all Internet-facing applications and systems
	before they go into production and at least quarterly thereafter?	[   ] Yes  [   ] No
11.	Is an intrusion detection or intrusion prevention system used in the Applicant's network?	[   ] Yes  [   ] No
12.	Does the Applicant ensure sensitive data is permanently removed (e.g., degaussing, overwriting with
	1’s and 0’s, physical destruction but not merely deleting) from hard drives and other storage media
	before equipment is discarded or sold and from paper records prior to disposal?	[   ] Yes  [   ] No
	(a)	If Yes, how is data permanently removed?
		[   ]  Paper records with sensitive data shredded 
		[   ] Data permanently removed before equipment sold or discarded 
13.	Are security alerts from the intrusion detection or intrusion prevention system (IDS/IPS) continuously
	monitored and are the latest IDS/IPS signatures installed?	[   ] Yes  [   ] No
14.	Are there regular internal or external audit reviews of the Applicant’s network?	[   ] Yes  [   ] No
(a)		If Yes, attach a copy of the last examination/audit of the Applicant’s network operations, security and internal control procedures, PCI or HIPAA compliance. 
B.	Collection or Storage of Sensitive Information on Web Sites and Servers
	Check if not applicable.  [   ]
1.	Does the Applicant require individual user ID’s and passwords for any areas of its web site where
	sensitive data is collected?	[   ] Yes  [   ] No
2.	Are all sessions where sensitive data is entered encrypted with a Secure Socket Layer (SSL)?	[   ] Yes  [   ] No
3.	Does the Applicant have any sensitive data on its web server or on any device connected to its web
	server?	[   ] Yes  [   ] No
	(a)	If Yes, is this data encrypted?	[   ] Yes  [   ] No
4.	In the development of the Applicant's web applications, has the Applicant adopted Open Web 
	Application Security Project (OWASP) or other best practices to defend against known web attacks
	(Cross Scripting, SQL Injection, etc.)?	[   ] Yes  [   ] No
C.	Wireless and Remote Access to Applicant’s Network
	Check if not applicable.  [   ]
1.	Does the Applicant secure remote access to its network?	[   ] Yes  [   ] No
	(a)	If Yes,
		[   ] ID/password only [   ] VPN or equivalent  [   ] VPN or equivalent with two factor authentication  
		[   ] No remote access  
2.	Does the Applicant require minimum security standards (anti-virus, firewall, etc.) for any computers
	used to access the network remotely?	[   ] Yes  [   ] No
3.	Does the Applicant have a wireless network?	[   ] Yes  [   ] No
	If Yes, 
	(a)	Are all wireless access points to the Applicant's network encrypted with WPA/WPA2 or more
		recent standard (e.g., not unencrypted or using WEP standard)?	[   ] Yes  [   ] No
	(b)	Is there a firewall between all wireless access points and the parts of the Applicant's network on
		which sensitive information is stored?	[   ] Yes  [   ] No
	(c)	Does the Applicant have a repeatable process to identify rogue/unauthorized wireless devices
		connected to its wireless network?	[   ] Yes  [   ] No
D.	Payment (Credit and Debit) Card Handling
	Check if not applicable.  [   ]
1.	Does the Applicant:
(a)	Store any payment card information on its network?	[   ] Yes  [   ] No
(i)	If Yes, is it for one time use or does the Applicant retain it for re-use or regular 
	subscription/installment payments?  [   ] One time use  [   ] Retain at least some for future use
	(ii)	Is it masked, encrypted and purged in compliance with PCI standards?	[   ] Yes  [   ] No
2.	Does the Applicant process any payment card transaction over wireless networks?	[   ] Yes  [   ] No
3.	Does the Applicant store Card Security Code/Card Verification Value (CSC/CVV) data on its network?
		[   ] Yes  [   ] No
4.	Is the Applicant certified as complying with the applicable PCI standard?	[   ] Yes  [   ] No
	(a)	If Yes, indicate the person or outside firm which certified the Applicant and the date of the last
			PCI audit. 	
E.	Data Breach Loss to Insured Coverage
	Check if coverage not requested. [   ]
1.	Are alternative facilities available in the event of a shutdown/failure of the network system?	[   ] Yes  [   ] No
2.	Does the Applicant maintain proof of and documented procedures for routine backups?	[   ] Yes  [   ] No
3.	Are key data and software code stored:
	(a)	On redundant storage device?	[   ] Yes  [   ] No
	(b)	At secured offsite storage?	[   ] Yes  [   ] No
4.	Does the Applicant have a written disaster recovery plan?	[   ] Yes  [   ] No
VI.	Electronic Media Coverage (including Software Copyright)  Check if coverage Not Requested  [   ]
1.	For all software or products the Applicant develops, does the Applicant:
	(a)	Have an intellectual property review process?	[   ] Yes  [   ] No
			(i)	If Yes, describe the process: 	
					
(b)	Have a policy or employee training program in place to prevent IP infringement?	[   ] Yes  [   ] No
(c)	Require new employees and contractors to acknowledge that they may not use any code or other
	proprietary information from prior employers in work done for the Applicant?	[   ] Yes  [   ] No
2.	Does the Applicant conduct prior review of any content for its own web site or to provided to clients as
part of the Applicant's professional services, including blogs, if applicable, for copyright infringement, trademark infringement, libel or slander, violation or rights of privacy or publicity?	[   ] Yes  [   ] No
(a)	If Yes, who is responsible for these reviews (internal counsel, outside counsel, etc.)?	
			
3.	Does the Applicant post or permit employees to post, anonymous entries on blogs, bulletin boards
	or other forums related to the Applicant’s business?	[   ] Yes  [   ] No
4.	Does the Applicant have take down procedure to comply with DMCA safe harbor provisions 
	if hosting content posted by third parties on their servers or web site?	[   ] Yes  [   ] No  [   ] NA
5.	Does the Applicant obtain clear rights to intellectual property (IP) supplied by third parties if such IP is
	displayed on their web site or provided to a client as part of the Applicant's professional services?	[   ] Yes  [   ] No
VII.	CLAIMS/HISTORY
1.	Has the Applicant at any time during the last five (5) years had any incidents, claims, suits or 
	proceedings arising out of professional services or an unauthorized access, intrusion, breach, 
	compromise, or misuse of the Applicant’s network including embezzlement, fraud, theft of
	proprietary information, denial of service, electronic vandalism or sabotage, computer virus or
	other incident whether or not reported to its insurance carrier?	[   ] Yes  [   ] No
	If Yes, attach a description of each incident including the cause, status of claim, amounts demanded or paid, date of claim, steps taken to mitigate exposure in the future and if applicable internal costs, cost to third parties and length of time involved in recovery.
2.	Has the Applicant at any time during the last three (3) years had any incidents, claims or suits 
	involving the following and/or is the Applicant aware if any fact, circumstance, situation or incident
	related to the following which might give rise to a claim:
	(a)	Infringement of copyright, trademark, trade dress, rights of privacy or rights of publicity?	[   ] Yes  [   ] No
	(b)	Libel, slander or other form of disparagement, arising out the Applicant's web site or other
		electronic media?	[   ] Yes  [   ] No
	If Yes, to either of the above provide details. 	
	
3.	Is the Applicant and/or any of its principal, partner, owner, officer, director, employee, manager or 
	managing member or any person(s) or organization(s) proposed for this insurance aware of any fact,
	circumstance, situation, incident or allegation of negligence or wrongdoing, which might afford
	grounds for any claim such as would fall under the proposed insurance?	[   ] Yes  [   ] No
	(a)	If Yes, provide details.	
		
4.	Has any application for similar insurance made on behalf of the Applicant, its predecessors, subsidiaries, 
	affiliates, and/or for any other person(s) or organization(s) proposed for this insurance ever been declined, 
	cancelled or nonrenewed?	[   ] Yes  [   ] No
	(a)	If Yes, provide details. 	
				
5.	Has the Applicant and/or any of its principals, partners, owners, officers, directors, managers and/or
	managing members or employees its predecessors, subsidiaries, affiliates, and/or any other
	person or organization proposed for this insurance been involved in or have knowledge of any
	pending or completed investigative or administrative proceedings or governmental regulatory
	proceedings, actions or notices regarding data privacy?	[   ] Yes  [   ] No]
	(a)	If Yes, provide details on a separate sheet.
6.	List current and prior Professional Liability Insurance for each of the last three (3) years:
	If None, check here [   ]
								Inception-
Insurance	Limits of				Expiration Dates		Retroactive/
Company	Liability	Deductible	Premium	(MM/DD/YYYY)	Prior Acts Date

		
7.	Does the Applicant carry General Liability Insurance?	[   ] Yes  [   ] No
	(a)	If Yes, provide: Insurer: 		Limits of Liability: 	
		(i)	Does coverage include Products/Completed Operations Hazards?	[   ] Yes  [   ] No

NOTICE TO THE APPLICANT - PLEASE READ CAREFULLY
No fact, circumstance, situation or incident indicating the probability of a claim, loss or action for which coverage may be afforded by the proposed insurance is now known by any person(s) or entity(ies) proposed for this insurance other than that which is disclosed in this application. It is agreed by all concerned that if there be knowledge of any such fact, circumstance, situation or incident any claim subsequently emanating therefrom shall be excluded from coverage under the proposed insurance.  
This application, information submitted with this application and all previous applications and material changes thereto of which the underwriting manager, Company and/or affiliates thereof receives notice is on file with the underwriting manager, Company and/or affiliates thereof and is considered physically attached to and part of the policy if issued. The underwriting manager, Company and/or affiliates thereof will have relied upon this application and all such attachments in issuing the policy. 
For the purpose of this application, the undersigned authorized agent of the person(s) and entity(ies) proposed for this insurance declares that to the best of his/her knowledge and belief, after reasonable inquiry, the statements in this application and in any attachments, are true and complete. The underwriting manager, Company and/or affiliates thereof are authorized to make any inquiry in connection with this application. Signing this application does not bind the Company to provide or the Applicant to purchase the insurance. 
If the information in this application or any attachment materially changes between the date this application is signed and the effective date of the policy, the Applicant will promptly notify the underwriting manager, Company and/or affiliates thereof, who may modify or withdraw any outstanding quotation or agreement to bind coverage.
The undersigned declares that the person(s) and entity(ies) proposed for this insurance understand that the liability coverage(s) for which this application is made apply(ies):
(i)	Only to “Claims” first made during the “Policy Period” and reported to the Company during the “Policy Period” or within sixty days after the expiration date of the “Policy Period,” unless the extended reporting period is exercised. If the extended reporting period is exercised, the policy shall also apply to “Claims” first made during the extended reporting period and reported to the Company during the extended reporting period or within sixty days after the expiration of the extended reporting period;
(ii)	The limits of liability contained in the policy shall be reduced, and may be completely exhausted by “Claim Expenses” and, in such event, the Company will not be liable for “Claim Expenses” or the amount of any judgment or settlement to the extent that such costs exceed the limits of liability in the policy; and 
(iii)	“Claim Expenses” shall be applied against the “Deductible”. 

Must be signed within 60 days of the proposed effective date.

Name of Applicant		Title (Officer, partner, etc.)

Signature of Applicant		Date

Notice to Applicants: Any person who knowingly and with intent to defraud any insurance company or other person files an application for insurance or statement of claim containing any materially false information or conceals for the purpose of misleading, information concerning any fact material thereto, commits a fraudulent insurance act, which is a crime and subjects the person to criminal and civil penalties.