Comprehensive - The Swedish Club

Home / Cyber Insurance Forms / Comprehensive

Cyber Questionnaire – Comprehensive

Step 1 of 3

33%

Supplier Information

Company name

Subsidairies (if applicable)

Any merges or acquisitions in the last 5 years?

Yes

If Yes, please provide details of how policies and procedures have been integrated

Are you involved in any Joint Ventures?

Yes

If Yes, please provide details of how policies and procedures have been integrated

Industry

Description of Service Provided

Estimated Annual Turnover

Domiciled Location

Annual IT budget

% Specific to Information Security

Number of Employees

Employees specific to the Security Team

Data

Please select the data collected and stored within the organisation

PII

Yes

PCI

Yes

PHI

Yes

Biometric

Yes

Other? Please list:

Please select the regulations which apply to the organisation

PCI

Yes

SOX

Yes

HIPAA

Yes

GDPR/CCPA

Yes

Other? Please list:

Please select the specific certificates and/or audits obtained by the organisation

ISO 27001

Yes

NIST

Yes

NIST

Yes

BIMCO

Yes

Cyber Essentials

Yes

Other? Please list:

Governance and Policy

Is Cyber Security recognised at a Board level?

Yes

Comments:

Has a Chief Information Security Officer (CISO) or equivalent been appointed?

Yes

Comments:

Has a Chief Privacy Officer or equivalent been appointed?

Yes

Comments:

Is Cyber Security a part of overall Risk Management?

Yes

Comments:

Do you maintain an Information Security Policy that covers both Corporate and Operational technology?

Yes

Comments:

Offshore Asset Information

Do you have any offshore assets?

Yes

Comments:

Fleet size?

Comments:

Please provide a vessel schedule broken down by the following

Passenger Vehicles

Bulkers

Containers

Gas

Tankers

Brown Water

On a scale from 1 to 5, please state the avarage level of automation and technology sophistication across the fleet (5 being fully automated)?

Please enter a number from 1 to 5.

Who manages the Cyber security onboard the vessels?

You/Insured

Yes

If Yes, please complete below

Vessel Owner

Yes

If Yes, send for Vessel Owner Completion

Third Party Ship Manager

Yes

If Yes, please send for Ship Manager Completion

Other Third Party

Yes

If Yes, please send for Third Party Completion

IT & OT Vessel System Security

Do you have an individual responsible for cyber?

Yes

Comments

Have you implemented the recommendations detailed within the BIMCO Guidelines on Cyber Security for Vessels?

Yes

Comments

Is there any deviation away from any standards enforced across the organisation?

Yes

Comments

Do you have a Cyber Incident Response Plan specific to Vessel networks?

Yes

Comments

Do all crew members have to undergo mandatory Cyber security training, at least annually?

Yes

Comments

Are all Captains/Masters and/or critical bridge crew provided training and awareness on GPS Spoofing and Jamming?

Yes

Comments

Do you utilise any Operational Technology Endpoint Cyber Security Software (e.g. Carbon Black or Cylance OT)?

Yes

Comments

Do you implement any application whitelisting onboard the Vessels?

Yes

Comments

Do you utilise any log monitoring technology to alert you of any suspicious behavior on the Vessel network?

Yes

Comments

Do you block all removable media onboard the Vessels?

Yes

Comments

Do you have vulnerability and patch management strategy specifically for Vessels?

Yes

Comments

How regularly are critical Vessel Systems (IT,OT or other) patched?

Time (in Days, Weeks, Months)

Are all Vessel chart updates validated, tested and checked for integrity prior to AIS/ECDIS upload?

Yes

Comments

Can bridge crew revert to paper charts in the vent of an AIS/ECDIS outage?

Yes

Comments

Are Vessel networks segmented from the wider corporate network?

Yes

Comments

Is this limited in anyway (per asset, location etc.)?

Yes

Comments

Onboard the Vessel, are networks segmented by Critical OT, Business and Crew networks?

Yes

Comments

Is this limited in anyway (per asset, location etc.)?

Yes

Comments

Are any Critical Vessel networks (i.e. Business and Crew excluded) connected directly to the internet?

Yes

Comments

Onboard the Vessels, do you have any legacy systems no longer supported by vendor/manufacturer and are these adequately protected?

Yes

Comments

Do you perform regular backups of Vessel systems (especially Critical System data)?

Yes

Comments

Do you have a Business Continuity Plan and Disaster Recovery Plan specific for Vessel networks?

Yes

Comments

Do you regularly test backups for validity and restore?

Yes

Comments

Do you have regular Cyber Security Table Top Exercises or other Practice Drills specific to Vessel networks?

Yes

Comments

Claims History

1. Have you suffered a physical or logical security breach in the past 3 years?

Yes

If yes, please provide more details

2. Has your security posture been impacted or had the potential to be impacted as a result of a breach on a third party supplier over the past 3 years?

Yes

If yes, please provide more details

Please chose which team within The Swedish Club is best suited to handle your request.

Team Sweden

Team Greece

Team Norway

Team UK

Team Hong Kong

Team Singapore

Declaration

I/We declare that the statements and answers within this application form are, to the extent of knowledge, true and no facts have been purposefully miss-stated or suppressed. I/We aim to iform Insurers of any material changes to the facts stated above before the inception of the contract of insurance.

Date

MM slash DD slash YYYY

Name

Your Title

You will receive a copy of the Form Entries sent to this address

Declaration of Identity and Information Accuracy

By submitting this form, I confirm that I am the person identified above, I am authorized to provide this information, and it is accurate to the best of my knowledge.