Aon Risk Solutions Financial Services Group | Professional Risk Solutions

Cyber Risk Solutions Risk. Reinsurance. Human Resources.

2 | Aon Professional Risk Solutions

Defining the Impact Death. Taxes. Cyber Attack?

Cyber risk is no longer considered an emerging risk. Every organization should consider the financial statement impact of cyber exposures. In a best case scenario, a successful cyber attack will highlight the IT system weaknesses of an attacked company. In a worst case scenario, a cyber attack shuts down company operations, stolen data is sold on the dark web and financial losses are suffered by both the company and the company’s customers. The key questions that every organization should ask is: • Can we identify and quantify the damages from a successful cyber attack? • Beyond IT solutions, how do we protect ourselves from cyber risk? In the Aon-sponsored 2015 Global Cyber Impact Report, conducted by the Ponemon Institute, we found that cyber is one of the fastest growing risks for companies across the globe, as mobile technologies advance and cloud computing, corporate bring-your-own-device policies, big data analytics and the Internet of Things are becoming increasingly widespread. About 37 percent of surveyed companies have experienced a “material or significantly disruptive security exploit or data breach” one or more times during the past two years, and the average economic impact of the event was USD 2.1 million , although the range varied between USD 0 and over USD 200 million. Despite similar probable maximum loss valuations for tangible and intangible assets, organizations insure them very differently, as indicated in Table 1.1. While a cyber attack often causes disruption to business and IT operations, catastrophic cyber losses can also result in potential director’s and officer’s liability allegations. In the wake of numerous publicly reported material incidents in 2015, cyber insurance gross written premium is forecast to grow (as indicated in Table 1.2), at the same time insurance carriers are limiting capacity and coverage, while raising premiums for certain industry classes, such as large retail, healthcare and financial institutions.

Table 1.1 – Percentage of PP&E and Information Assets Covered by Insurance 60% 51%

50% 40% 30% 20%

12% 10% 0% The percentage of potential loss to PP&E assets covered by insurance

The percentage of potential loss to information assets covered by insurance

Table 1.2 – Cyber Insurance: Global Gross Written Premium

$12,000 $10,000 $8,000 $6,000 $4,000 $2,000 $0 2002 2004 2006 2010 2013 2014 2018* 2020* Gross Premium in $MM 2018: Estimated by PWC 2020: Estimated by ABI research

Organizations need to consider cyber assets and exposures in the context of financial statement impact compared to historical tangible assets and exposures.

Aon Professional Risk Solutions | 1

Unique Solutions from a Team of Recognized Experts The Aon Professional Risk Solutions team is uniquely qualified to help clients identify, track and mitigate today’s cyber threats. Recognized as one of the industry’s premier resources in cyber risk management, the team includes a dedicated group of more than 50 trained professionals with a strong technical aptitude, enhanced coverage expertise, deep carrier relationships, and claims handling capabilities. Team members collaborate and share expertise in a geographically aligned model, with colleagues based in San Francisco, Denver, Chicago, Miami, New York, London and Bermuda. Our approach includes the following: Strategic Meetings/Discussions – Aon takes a collaborative approach with our clients to identify and analyze exposures. We ensure that our clients’ unique exposures are addressed via risk transfer or alternative solutions. Submission Development – Aon works with our clients to obtain relevant, necessary and favorable underwriting information to present to markets. We coach our clients through underwriting meeting preparation, ensuring the best possible presentation to the underwriting community.

Legal Expertise – Our Claims Management, Advocacy and Legal Practice is made up of over 30 attorneys and claims advocates who assist our clients and brokerage teams in understanding exposure trends, negotiating policy wording and facilitating claims notification and recovery. We recognize that the contract must perform, and as such feel that the strength of our legal expertise around cyber policy wording and claims is a key part of our value. Strategic Negotiations and Placement – Aon utilizes proven and sophisticated negotiation strategies and leveraging techniques to build broad program structures and push the marketplace for superior terms and pricing.

200 50+ Over

cyber claims handled since 2012

global dedicated professionals

$400M+ in premium placed in 2015

Industry specialist brokers aligned with Aon industry practices

More than

Dedicated cyber professionals in U.S., London and Bermuda

1500 PRS clients

2 | Aon Professional Risk Solutions

Industry Practices Entertainment/ Hospitality

Healthcare

Industrials & Materials/ Automotive

Higher Education

Life Sciences

Retail

Energy/Power

Public Sector

Technology

Food, Agriculture & Beverage

Transportation & Logistics/Rail

Real Estate/ Construction

Financial Institutions

Aon Professional Risk Solutions | 3

A Proven Approach to Cyber Coverage The Aon Cyber Solutions Framework helps clients identify, address and respond to their unique cyber risks. Our solutions framework broadens the typical scope for addressing cyber risk, as our services go beyond risk transfer. We do this by: • engaging with our clients for pre-breach planning and incident response services; • identifying and quantifying the unique risks that they face;

Aon Cyber Tool www.aoncyberdiagnostic.com

• assisting our clients with the selection and implementation of appropriate risk transfer solutions; and • ensuring the continuity of operations through claims consulting. Cyber risk is not static, and as such our framework serves as a tool for holistic cyber risk management.

Aon Proprietary Peer Benchmarking

D&O Cyber Risk Evaluation

Aon Cyber Insight Model

Captive & Insurance Management

Claims Advocacy Claims Processing

Cyber Coverage Gap Analysis

Discover

Risk Identification

Deliver

Develop

Risk Quantification

Cyber Evaluation & Assessment

Cyber Risk Loss Modeling

Pre Breach Planning

Risk Financing Decision Platform

4 | Aon Professional Risk Solutions

Solution Assessment & Design

Aon Benfield Reinsurance Capacity

Risk Transfer

Risk Mitigation & Management

Network Security Breach Table Top Exercise

Risk Retention

Incident Response Services

Claims Consulting

Network Business Interruption Claims Preparation

A Menu-Based Analytic Approach Cyber analytics provide companies with organization-specific data points to evaluate various approaches to cyber risk, via risk transfer or risk retention solutions. Cyber analytics become especially meaningful when overlaid with traditional peer benchmarking. We believe in a menubased approach, based on the depth, breath and scope of desired analysis. As such, we provide analytic tools to fit our clients’ needs. We have numerous solutions available through Aon, as well as through relationships with partner vendors. Aon Cyber Insight Model • Total Cost of Risk Cyber Program Analysis

The Aon Cyber Insight Model is a tool which allows for informed decision making based on the following metrics:

• Severity of First and Third Party Cyber Losses • Sub-limit Exhaustion Analysis • Probability of Cyber Loss

Unlimited losses represent exposure to Cyber losses, as if no insurance were purchased

Based on ABC Corporation’s Cyber Insight, the biggest First Party exposure is Notification costs.

Based on ABC Corporation’s Cyber Insight, the biggest Third Party exposure is Class Action.

Aon Global Risk Consulting • Risk Financing Decision Platform - Actuarial analysis that builds upon the Cyber Insight Model to include Network Business Interruption. • Cyber Evaluation and Risk Quantification – – Benchmarks an organization’s information security program to international best practices and standards, and identifies material gaps and deficiencies for remediation – Aon’s X-V Analysis: Leverages property loss experience to quantify maximum foreseeable and expected loss metrics using scenarios identified in the cyber evaluation process, taking into account operational models, financial performance, and business continuity and mitigation strategies Aon Professional Risk Solutions | 5

Aon Strategic Market Approach – Differentiating our Clients The key to a successful go to market strategy is to differentiate our clients. We do this by executing on the following: • Placement Strategy Discussion • Submission Creation • Coverage Priority Matrix

New Program Incepts

• Underwriting Meeting Preparation – Aon/Client Discussion

14-21 Days

30-45 Days

• Market Meeting or Conference Call • Worldwide Market Access

21 Days

Gather underwriting information

Placement strategy discussion

6 | Aon Professional Risk Solutions

7 Days

Insurers evaluate submission/ Underwriting meetings

Create coverage specifications via priority Matrix

Negotiation Period – Time will depend upon the size of the tower

Cyber Solutions and Services Aon Net News®

Cyber Diagnostic Tool

Aon Net News®, is a weekly electronic newsletter focused on identifying exposure and insurance issues via original and third party intellectual capital content in the areas of: • Privacy and Security Cyber Liability • Miscellaneous Commercial Professional Liability • Technology Errors and Omissions • Media Liability • Intellectual Property Infringement

Aon’s proprietary online questionnaire compares an organization’s cyber preparedness versus peers. The tool helps identify the key internal and external factors that may affect an organization’s level of exposure to cyber risk, gives insight into the relevant cyber risk drivers, and provides practical guidance on a cyber governance framework. The report addresses five key risk areas: • Overall Profile • IT Infrastructure & Hardware • IT Application & Software • Data Privacy Governance • Cyber Attack, System Failures & Data Breaches https://www.aoncyberdiagnostic.com/

Cyber Diagnostic Report

Aon Professional Risk Solutions | 7

Aon Client Promise The Aon Client Promise framework includes the five pillars of our promise, a comprehensive training curriculum, and a robust methdology for ensuring a consistent client experience. Aon Client Promise

Aon Client Promise Methodology

Comprised of five pillars—partnership, expertise, innovation, excellence, and results—the Aon Client Promise articulates the commitment we make to our clients.

Discover We will collaborate to understand both your near- and long-term business priorities, how we can add value to your organization, and help you respond to changing market dynamics.

Aon Client Promise Academy The Academy offers unique learning experiences focused on listening for and responding to client needs, building knowledge of the full breadth of Aon capabilities, and understanding the pillars of the Aon Client Promise.

Develop We will jointly author a plan to define how we will work together during the year, outline our commitments to you, and define how we will measure our success. Deliver We will follow through on our plan, executing with excellence and tracking outcomes. Review We will seek your input on how we are doing both through informal feedback sessions and annual surveys.

8 | Aon Professional Risk Solutions

Contacts We’re First Last here to empower results First Last 555.555.5555 555.555.5555 Aon professionals can provide your organization with the experience, [email protected] [email protected] tools and deep industry expertise required to address today’s cyber threats. Contact the following representatives to learn more about First Last First Last specialized solutions from the Aon Professional 555.555.5555 555.555.5555 Risk Solutions team. [email protected]

[email protected]

Eric Seyfried Christian First Last Hoffman First Last East Coast Leader U.S. Professional Risk Solutions 555.555.5555 555.555.5555 Team Leader [email protected] [email protected] [email protected] [email protected] +1 212.441.1406 +1 212.441.2263 Stephanie Dingman Stephanie Snyder Tomlinson Central Leader U.S. Cyber Sales Leader [email protected] [email protected] +1 312.381.5146 +1 312.381.5078 Brent Rieth West Coast Leader [email protected] +1 415.486.7162

About the Business Unit Iquiandus aut ventian ihitat volo coreper undundae. Ehenis

sequidit, con esequid quo tem et everciist min non rem esequi

eossim si sit occatur anderupturi quid ut dolorerum repudam

optatus ad excerat iistrum andam, es nossimil et esequat is

commod ma doluptate re volum comniss untiosto verum

perem ea cum non plique quis voluptatet dolorro esciet a

eos nullabo. Itatio imagnim eum suntion corente dolorest

dolupta volorio rumquasit volut et eum illab inci dolupta

harchiciae rempele ctatquam, omnim dollorrum ipsunt

turestem eum volendi doluptaquo derum nossequibus.

adi de plab idis aria coreperum que nimpore icientem. Mo commos dolupta quiam, soluptas secusdanist qui cum imin exceped eatur si sercili tiosam quam exceped quiae miliatum aut quias ipicabo. Genis conseceaque ma venim quia cus exero estrum am quatibus eatias il imus comnis et reperore possint Gita dolupta simporero con es atem natur si ut alibusdant, soluptat a dolupta temosaperio eseque eturion

Ra debitio reptusam et magnis et deribus sequist ruptat exerum est esed quae dit laborectur? Xernatur remoluptas doluptatur? Is ipsam site odis as nonsequidel ipite sa sequiduntium exeri ducillacia pre ne core porectur accupid quia ipsam quas am fuga. Nam lacerspedit assin re di ut aceped maio. Equodit, as. Aborecae. Nimoluptate dolorent hillecta de derio.

About Aon Aon plc (NYSE:AON) is the leading global provider of risk management, insurance and reinsurance brokerage, and human resources solutions and outsourcing services. Through its more than 72,000 colleagues worldwide, Aon unites to empower results for clients in over 120 countries via innovative and effective risk and people solutions and through industry-leading global resources and technical expertise. Aon has been named repeatedly as the world’s best broker, best insurance intermediary, best reinsurance intermediary, best captives manager, and best employee benefits consulting firm by multiple industry sources. Visit aon.com for more information on Aon and aon.com/ manchesterunited to learn about Aon’s global partnership with Manchester United. © Aon plc 2016. All rights reserved. The information contained herein and the statements expressed are of a general nature and are not intended to address the circumstances of any particular individual or entity. Although we endeavor to provide accurate and timely information and use sources we consider reliable, there can be no guarantee that such information is accurate as of the date it is received or that it will continue to be accurate in the future. No one should act on such information without appropriate professional advice after a thorough examination of the particular situation.

www.aon.com

Risk. Reinsurance. Human Resources.