Metro - File #: 2026-0442

• File #: 2026-0442
• Type: Program
• Status: Agenda Ready
• File created: 6/2/2026
• In control: Finance, Budget and Audit Committee
• On agenda: 7/16/2026
• Title: AUTHORIZE the Chief Executive Officer to negotiate and purchase a cybersecurity liability insurance policy with up to $50 million in limits at a cost not-to-exceed $2.7 million for the 12-month period effective September 1, 2026, to September 1, 2027.
• Sponsors: Finance, Budget and Audit Committee
• Indexes: Audit, Budgeting, Expo Line Operating Project (Project), Federal Transit Administration, General Overhead (Project), Insurance, Los Angeles Union Station, Metro Busway G Line, Metro Rail A Line, Metro Rail B Line, Metro Rail C Line, Metro Rail E Line, Operations and Maintenance, Operations Maintenance (Project), Operations Transportation (Project), Owned Property (Project), Policy, Privacy, Program, Purchasing, Rail Operations - Blue Line (Project), Rail Operations - Green Line (Project), Rail Operations - Red Line (Project), Rail Operations Control Center, Rail Operations-Crenshaw Line (Project), Safety, Security, Union Station Property Management (Project)

Meeting_Body
FINANCE, BUDGET, AND AUDIT COMMITTEE
JULY 16, 2026

Subject
SUBJECT: CYBERSECURITY LIABILITY INSURANCE PROGRAM

Action
ACTION: APPROVE RECOMMENDATION

Heading
RECOMMENDATION

Title
AUTHORIZE the Chief Executive Officer to negotiate and purchase a cybersecurity liability insurance policy with up to $50 million in limits at a cost not-to-exceed $2.7 million for the 12-month period effective September 1, 2026, to September 1, 2027.

Issue
ISSUE

Metro's cybersecurity liability insurance policy expires September 1, 2026. Insurance underwriters will not commit to final pricing until three weeks before the current program expires. Consequently, staff recommends a not-to-exceed amount for this renewal pending final pricing. Metro purchases an insurance policy to cover cybersecurity liability exposures. Cybersecurity is the practice of being protected against criminal or unauthorized use of systems and electronic data.

Background
BACKGROUND

For this current renewal, Marsh USA, LLC (Marsh), the insurance broker for Metro, was requested to market Metro's cybersecurity liability insurance program to qualified insurance carriers. Marsh, through its partnership with Howden, a London broker, has received quotes from the incumbent carrier, which has A.M. Best ratings indicative of acceptable financial soundness and ability to pay claims. The premium indications below are based on current market expectations and expire on September 1, 2026.

Marsh provides a not-to-exceed number that serves three functions. First, the number provides an amount to cover the recommended premium and contingency that staff can present to the Board to obtain approval for the binding of the program. Second, the number allows the broker ample time to continue to negotiate with underwriters to ensure that Metro obtains the most competitive pricing available. And third, the not-to-exceed amount allows Metro to secure the quoted premium during the board cycle process prior t...