Jack Flug, managing director in Marsh's U.S. FINPRO practice, says that, from a D&O insured's standpoint, there are a number of major issues executives need to be mindful of when obtaining coverage. These include:

• Insured vs. insured exclusions where a carrier does not extend coverage to covered individuals who may benefit from the D& O coverage.
• Personal conduct exclusions.
• Definition of loss.
• Investigation coverage.

He says the development of these issues are “especially fluid” as studies of various areas of implementation of the rules continue.

He adds that one major concern stemming from the Dodd-Frank Wall Street Reform and Consumer Protection Act is the whistleblower provision. It awards an individual reporting improper securities activity 10 percent to 30 percent of the monetary sanctions resulting from the information.

Flug notes that it may be years before the full ramifications of Dodd-Frank become clear, but one known impact is that the Federal Deposit Insurance Corp's oversight authority is expanded over financial institutions, allowing it significant powers over contracts and compensation agreements and recoupment of compensation for responsibility of the failure of an institution.

He notes that Marsh developed a defense coverage for such FDIC action.

Robert Parisi, cyber and technology product leader in Marsh's U.S. FINPRO practice, says more clients are purchasing cyber-risk insurance as they become increasingly aware of the exposure. However, two-thirds of commercial clients still don't buy it despite increased number of incidents.

There are a few reasons for this. Some clients find it too expensive. Others believe putting their own defensive measures in place is enough. Others say it is difficult to quantify the risk.

Parisi calls much of this thinking “outdated” and, outside of not being able to afford the coverage, a poor excuse for not purchasing the coverage.

There is plenty of capacity available and coverage has become more broadly defined. He says it can be tailored to individual needs.

“Quantifying the risk is difficult, but not impossible,” notes Parisi.

As far as cost, insurance as part of an overall risk-management program is “more defensible” today, says Parisi.

One suggestion he makes: clients should do a coverage-gap analysis to determine what insurance purchase should be made.

He says to date, the focus has been on privacy and liability related to cyber coverage. But now there are products dealing with the property side of this exposure. He says there are several markets offering business interruption and extra expense coverage and expanded coverage for system outage for failure of technology. He calls this a “huge enhancement to the coverage” because in the past the coverage pertained only to cyber attack.