Meeting_Body
FINANCE, BUDGET, AND AUDIT COMMITTEE
JULY 16, 2026
Subject
SUBJECT: CYBERSECURITY LIABILITY INSURANCE PROGRAM
Action
ACTION: APPROVE RECOMMENDATION
Heading
RECOMMENDATION
Title
AUTHORIZE the Chief Executive Officer to negotiate and purchase a cybersecurity liability insurance policy with up to $50 million in limits at a cost not-to-exceed $2.7 million for the 12-month period effective September 1, 2026, to September 1, 2027.
Issue
ISSUE
Metro’s cybersecurity liability insurance policy expires September 1, 2026. Insurance underwriters will not commit to final pricing until three weeks before the current program expires. Consequently, staff recommends a not-to-exceed amount for this renewal pending final pricing. Metro purchases an insurance policy to cover cybersecurity liability exposures. Cybersecurity is the practice of being protected against criminal or unauthorized use of systems and electronic data.
Background
BACKGROUND
For this current renewal, Marsh USA, LLC (Marsh), the insurance broker for Metro, was requested to market Metro’s cybersecurity liability insurance program to qualified insurance carriers. Marsh, through its partnership with Howden, a London broker, has received quotes from the incumbent carrier, which has A.M. Best ratings indicative of acceptable financial soundness and ability to pay claims. The premium indications below are based on current market expectations and expire on September 1, 2026.
Marsh provides a not-to-exceed number that serves three functions. First, the number provides an amount to cover the recommended premium and contingency that staff can present to the Board to obtain approval for the binding of the program. Second, the number allows the broker ample time to continue to negotiate with underwriters to ensure that Metro obtains the most competitive pricing available. And third, the not-to-exceed amount allows Metro to secure the quoted premium during the board cycle process prior to quote expiration.
Discussion
DISCUSSION
Public entities continue to be targeted for cyber-attacks as the cyber risk environment evolves. According to Marsh’s Cyber Risk Intelligence Center, of the over 1,300 cyber claims they have seen in 2025, 13% of those claims are related to ransomware incidents. Privacy and regulatory claims frequency are on the rise in connection with broader privacy regulations.
Public entities with strong cyber risk controls have the greatest advantage in the current marketplace. Adhering to guidelines set forth by agencies such as the Federal Transit Administration (FTA) and the Cybersecurity and Infrastructure Security Agency (CISA) is critical for public entities like Metro. These organizations provide cybersecurity frameworks, risk assessments, and audits for public entities to comply with.
Metro has completed the Marsh Cyber Self-Assessment, which provides a review of cybersecurity controls. Marsh’s analytics suggest purchasing between $40 million and $85 million in coverage. The proposed program, from carrier BRIT Re, a Lloyd's of London consortium, provides up to $50 million in coverage on a claims-made basis with a $5 million self-insured retention (SIR). Attachment A summarizes the premium options, and Attachment B summarizes the coverages. .
Determination_Of_Safety_Impact
DETERMINATION OF SAFETY IMPACT
Approval of this recommendation positively impacts the safety of Metro’s patrons and employees. Cyber Liability insurance carriers will review security procedures utilized in cyber programs to mitigate potential risks or hazards and provide an overall risk assessment of Metro’s practices and assets as they underwrite the program. Carriers may provide best-practice guidance to enhance Metro’s risk profile, and the policy will limit Metro’s liability for claims resulting from a cyber-attack or data breach event.
Financial_Impact
FINANCIAL IMPACT
Funding of $2.9 million for this action is included in the FY27 Adopted Budget in cost center 0531, Risk Management - Non Departmental Costs, under projects 100001 General Overhead, 300022 - Rail Operations - A Line, 300033 - Rail Operations C Line, 300044 - Rail Operations - B Line, 300066 - Rail Operations - E Line, 300077 - K Line, 301012 - Bus Operations - G Line, 306001 - Operations Transportation, 306002 - Operations Maintenance, 320011 - Union Station and 610061 - Owned Property.
Since this is a multi-year contract, the cost center manager and the Chief Risk, Corporate Safety, and Asset Management Officer will be accountable for budgeting the cost in the future year.
Impact to Budget
The source of funding for this action will come from federal, state, and local funding sources that are eligible for bus and rail operations.
Equity_Platform
EQUITY PLATFORM
The proposed action supports Metro’s ability to safely serve the communities and customers who rely on Metro’s transportation services and assets by providing insurance coverage that will allow Metro to secure the resources required to respond to a cyber incident and ensure the integrity of internal and external data resources.
Vehicle_Miles_Traveled _Outcome
VEHICLE MILES TRAVELED OUTCOME
Vehicle Miles Traveled (VMT) and VMT per capita in Los Angeles County are lower than national averages, the lowest in the SCAG region, and on the lower end of VMT per capita statewide, with these declining VMT trends due in part to Metro’s significant investment in rail and bus transit.* Metro’s Board-adopted VMT reduction targets align with California’s statewide climate goals, including achieving carbon neutrality by 2045. To ensure continued progress, all Board items are assessed for their potential impact on VMT.
While this item does not directly encourage taking transit, sharing a ride, or using active transportation, it is a vital part of Metro operations, as it provides cybersecurity liability coverage for Metro’s assets. Because the Metro Board has adopted an agency-wide VMT Reduction Target, and this item supports the agency's overall function, it is consistent with the goals of reducing VMT.
*Based on population estimates from the United States Census and VMT estimates from Caltrans’ Highway Performance Monitoring System (HPMS) data between 2001-2019.
Implementation_of_Strategic_Plan_Goals
IMPLEMENTATION OF STRATEGIC PLAN GOALS
The recommendation supports strategic plan goal # 5), “Provide responsive, accountable and trustworthy governance within the LA Metro organization.” The responsible administration of Metro’s risk management programs includes the use of insurance to mitigate large service disruptions and financial risks resulting from cybersecurity events.
Alternatives_Considered
ALTERNATIVES CONSIDERED
Various limits of coverage were considered, as outlined in Attachment A, for the cybersecurity liability insurance program. All options include an SIR of $5 million for the same program. Option A, Metro’s current limit, provides $50 million in coverage, Option B provides $75 million, and Option C provides $100 million in coverage.
Option A, which is within Marsh’s analytics limits range, is recommended as the best value option while retaining a reasonable amount of risk over the coverage limit.
Next_Steps
NEXT STEPS
Upon Board approval of this action, staff will advise Marsh to proceed with the placement of the cybersecurity liability insurance program outlined herein, effective September 1, 2026.
Attachments
ATTACHMENTS
Attachment A - Coverage Options and Premiums
Attachment B - Coverage Description
Prepared_by
Prepared by: William Douglas, Director, Risk Management, (213) 922-2105
Claudia Castillo del Muro, Executive Officer, Risk Management, (213) 922-4518
Bryan Sastokas, Deputy Chief Information Technology Officer, (213) 922-5510
Reviewed_By
Reviewed by:
Arnold Hackett, Senior Advisor to the Chief Executive Officer, (213) 922-7403
Kenneth Hernandez, Chief Risk, Corporate Safety, and Asset Management Officer, (213) 922-2990
