[{"_1":2,"_88":-5,"_89":-5},"loaderData",{"_3":4,"_26":27},"root",{"_5":6,"_17":10,"_18":19,"_20":21,"_22":10,"_23":-5,"_24":-5,"_25":10},"user",{"_7":8,"_9":10,"_11":10,"_12":-5,"_13":-5,"_14":15,"_16":-5},"roles",[],"isAuthenticated",false,"isPremium","planName","subscriptionStatus","featureFlags",{},"insightsBudget","isDevelopmentHost","userPreferences",{},"recaptchaSiteKey","6LcvOJcUAAAAAHsB-gPGfGktcRlKpH7OTIU_dMTD","isImpersonating","impersonation","affiliateStatus","isFreedomPortal","routes/v2/article/layout",{"_28":29,"_30":31},"notFound",true,"relatedArticles",[32,76],{"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":44,"_45":46,"_47":48,"_49":50,"_51":52,"_53":54,"_55":56,"_57":58,"_59":60,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":72,"_73":74,"_75":74},"mediaId",6116530,"mediaKeyId","2732754-95f2c4bbd443cf7a952d37f7004fbb14","parentId",2732754,"title","Legislative committee hears that cyber insurance is available but costly and administratively demanding for Oregon schools and special districts","audioSeconds",3454,"startMs",258000,"endMs",3712000,"viewUrl","/Search/View?dp=1&key=2732754-95f2c4bbd443cf7a952d37f7004fbb14&start=258&end=3712","thumbnailUrl","https://assets.pipeline.soar.com/2732754-95f2c4bbd443cf7a952d37f7004fbb14/thumbnail_258000.jpg","articleUrl","/articles/6116530/Oregon/Legislative-committee-hears-that-cyber-insurance-is-available-but-costly-and-administratively-demanding-for-Oregon-schools-and-special-districts","mediaUrl","https://secure.pipeline.soar.com/6116530-d1172f90efca0373a3051221d329bd93/orig.mp4?Expires=1770445702&Signature=lyDIp3FxU1D5wlLg2wkwK6xAI9idbBYH6ZKAr4g9IX7BmhhyrIwaz7x0-Uf2mX1nAxiaz-Ew2Y636glGJjZ-~O0L-wg5i3zgJ4sZn8ncjwZYypJJ43T1oVXv5JrYrDMDDlLyZtqb-eOeZXTvA7F47DZ0MRNcYznlZ20SchTGlxLAXWWFwtIw0FtFvtu4j4dp7bYc65G4ZpgQFxW8Qw1h7SIJ1p0xAFzpQvEAaZyF7CG~tkFQ1YvmLilDmvG9dQ8zlVaw~S7ncg-4yPi8OSFX304dxt~VKzqROFZc0tXjT8ljF4waPqQs9njMq6OZZRrp7jS0s8JoSolkdw3-cjPRPA__&Key-Pair-Id=KUT5TJCACFTXG","author","Oregon State Legislature","date","2025-03-21T00:00:00Z","article","The Joint Legislative Committee on Information Management and Technology on March 30 heard that cyber insurance is more available than it was in 2023, but higher costs and stringent underwriting requirements mean many small special districts and school districts remain underinsured and struggle to meet coverage prerequisites.

Frank Stratton, executive director of the Special Districts Association of Oregon, told the committee that most special districts buy basic coverage through the Special Districts Insurance Services (SDIS) trust but that limits are low: “$50,000 first party and a hundred thousand dollars third party,” he said, adding that roughly 95% of members take that minimal option because they cannot meet underwriting benchmarks or prefer the low-cost pooled option. Stratton said larger entities sometimes purchase excess coverage in the private market.

Why it matters: Local governments and schools hold sensitive personal data and provide essential services. Witnesses said better cyber hygiene reduces both risk and insurance costs, and that a centralized effort to assess and assist local entities could be more effective than simply researching market availability.

Speakers from school and local-government insurance pools described recent market and underwriting changes. Stratton explained that SDIS offers higher tiers (for example, $250,000 first-party and $500,000 third-party limits) only to members that implement controls such as multifactor authentication (MFA) for email and critical services, restricted administrative rights, daily backups, endpoint detection and a written incident-response plan. He warned that SDIS’s self-insured pool has a $2,000,000 aggregate annual cap on payouts.

Greg Harden, cybersecurity specialist and system architect for City County Insurance Services (CIS), said CIS saw 18 cyber claims in the last two-year cycle and that many members still carry minimum coverage. Harden described common claim types as funds-transfer fraud, business-email compromise and, less frequently for CIS in that period, ransomware. He said CIS is reinstating MFA as a requirement for higher-tier coverage and is simplifying tier structure while raising some minimum limits to encourage stronger protections.

For schools, the PACE (Property and Casualty Coverage for Education) trust buys a group policy from a carrier (named in testimony as AIG). According to testimony from Stratton, PACE provides $1,000,000 per member with a stated $500,000 combined limit for all members (as described to the committee); PACE also maintains a member deductible and a larger self-insured aggregate cap. PACE has progressively added underwriting requirements over successive years — rotating passwords, restricted privileges, daily backups, annual staff training, external vulnerability scans and scheduled backup recovery testing — and reported that approximately 265 of about 300 members have met current requirements.

Stratton and Harden described notable claims that illustrate third-party and vendor risks: a payroll and HR vendor breach affecting many school districts produced large notification and monitoring costs (Stratton estimated about $1 million that PACE would pay initially and then seek reimbursement from the vendor), and a separate, widely publicized vendor used by many districts (referred to as ProSchools) suffered a nationwide attack affecting student records.

Representatives from the Department of Administrative Services Risk Management Division (Shelly Hoffman, risk program manager, and Bonnie Robbins, risk consulting unit manager) summarized the state’s experience and insurer expectations. Bonnie Robbins said insurers have returned to the market since 2023 but now routinely require vulnerability scans, MFA, restricted administrative accounts, off-site backups and other controls; underwriters are limiting single-carrier capacity to roughly $5 million and often place sublimits or coinsurance on ransomware.

Robbins said state agencies typically pay first-party breach costs at the agency level (call centers, notifications, credit monitoring, recovery work); the division purchases a commercial cyber policy only for the Oregon Lottery, which in the most recent renewal obtained a layered (“tower”) $20 million program across multiple carriers and reduced its self-insured retention after improving cyber hygiene.

Discussion and recommendations: Presenters urged the committee to focus Center of Excellence resources on practical assessments and direct technical assistance (helping entities complete required controls and creating a statewide inventory of needs), rather than on a basic market availability study. Stratton, who also serves on the Oregon Cybersecurity Advisory Council, said the center could help evaluate vendor security practices and prioritize funding or grants to raise baseline protections.

Ending: Committee staff said they will collect and circulate more detailed claims data, vendor incident information and written testimony submitted after the hearing. No formal action or vote occurred during the informational session; the committee then opened a public hearing on House Bill 3228.","mediaType","Video","parentTitle","Joint Committee On Information Management and Technology 03/21/2025 1:00 PM","oneSentenceSummary","The Joint Legislative Committee on Information Management and Technology on March 30 heard that cyber insurance is more available than it was in 2023, but higher costs and stringent underwriting requirements mean many small special districts and school districts remain underinsured and struggle to meet coverage prerequisites.","taxTitle","Information Management and Technology, Joint, Committees, Legislative, Oregon","taxId",18221,"location","Oregon","headline","","shortSummary",{"_33":77,"_35":36,"_37":38,"_39":78,"_41":79,"_43":80,"_45":81,"_47":82,"_49":83,"_51":84,"_53":85,"_55":56,"_57":58,"_59":86,"_61":62,"_63":64,"_65":87,"_67":68,"_69":70,"_71":72,"_73":74,"_75":74},6116525,"League of Women Voters supports House Bill 3228 and urges adding AI considerations and a resilience fund",680,3632000,4312000,"/Search/View?dp=1&key=2732754-95f2c4bbd443cf7a952d37f7004fbb14&start=3632&end=4312","https://assets.pipeline.soar.com/2732754-95f2c4bbd443cf7a952d37f7004fbb14/thumbnail_3632000.jpg","/articles/6116525/Oregon/League-of-Women-Voters-supports-House-Bill-3228-and-urges-adding-AI-considerations-and-a-resilience-fund","https://secure.pipeline.soar.com/6116525-185d15e02fb16101870c547dc888fb51/orig.mp4?Expires=1770445702&Signature=AsMgy0QsTlNRcx5Drl9ROyMtohEbHuFPpANj8Wy1MtM0B4gg6m3sWpQLUoQIqmRaeFhN2ozeBHwdB3KpRLEwZYUfiAj~4iRn3RUl5mbdAE-TTztRZ~Khh8v6AfEy5njlV8Ni1zQFz7OF-tTKXu7bpTJIZLYegZTeeprFchiGFhTPp778ZizPTri9Y9qKI3QC73fLxb8Nvp2I3qq1fbbiYq~kJPXOlne7e7rWdACt1O0h43~en4xy4qralTn2TgkLEUiUNAhZedgIQmq9C4jPdhSdBVBI5KKec7e3D7VE9nSMYMAEUW6dQvQHNKcYHju0~j245fN9PPN5l-F49X~9HA__&Key-Pair-Id=KUT5TJCACFTXG","The Joint Legislative Committee on Information Management and Technology opened a public hearing on House Bill 3228 on March 30. Committee staff described the measure as directing the Oregon Cybersecurity Advisory Council to study use of cybersecurity insurance by Oregon public bodies and to submit findings to the committee by Dec. 31, 2025; the bill would also establish an Oregon Cybersecurity Resilience Fund and appropriate monies to the Higher Education Coordinating Commission for distribution to the Oregon Cybersecurity Center of Excellence to assist public bodies with insurance requirements and incident response.

Rebecca Gladstone, past president and current cybersecurity lead for the League of Women Voters of Oregon, testified in support “with modifications,” emphasizing that training, protocols and preventive measures are not discretionary and that a resilience fund would help jurisdictions implement needed protections. Gladstone said federal funding is uncertain and that a state fund would ensure vulnerable entities can meet insurance prerequisites and perform incident response.

Lindsay Washburn, testifying for the League in her role as an AI governance and policy expert, urged the committee to broaden HB 3228’s scope to include artificial intelligence risks. Washburn said modern cyber attacks increasingly leverage AI, and she recommended renaming the proposed fund the “Oregon Digital Resilience Fund” and expanding the Oregon Cybersecurity Center of Excellence’s role to include AI expertise to address algorithmic bias, automated decision-making errors and AI-specific vulnerabilities.

No other in-person witnesses spoke; committee staff noted additional written testimony may be submitted within 48 hours of the hearing. Committee leadership closed the public hearing and said staff will circulate schedules for upcoming meetings and follow-up materials.

Ending: The measure remains at the public hearing stage; legislators will receive the Advisory Council’s study and the proposal to create a state resilience fund if the bill advances. Witnesses recommended the study prioritize practical assessments and funding to help local governments and schools meet insurance underwriting requirements.","At a public hearing on House Bill 3228, the League of Women Voters of Oregon told the Joint Legislative Committee on Information Management and Technology that the bill should fund assistance for public bodies to meet cyber insurance requirements and suggested expanding the study to include artificial intelligence risks.","actionData","errors"]

Article not found

Legislative committee hears that cyber insurance is available but costly and administratively demanding for Oregon schools and special districts

League of Women Voters supports House Bill 3228 and urges adding AI considerations and a resilience fund