by GDI Insurance | Business Insurance, Commercial Property, COVID, Insurance, Risk Management, Safety Tips
Office Building Employers Information for COVID-19
Office building employers, owners and managers can take proactive measures to create a safe and healthy workplace for employees, clients and other guests. This article shares COVID-19 guidance from the Centers for Disease Control and Prevention (CDC) on COVID-19 Employer Information for Office Buildings.
How Office Building Employers Can Protect Employees
Employers should consider the following steps to protect their employees and other building visitors, while slowing the spread of COVID-19:
- Create a COVID-19 workplace health and safety plan by reviewing the CDC Interim Guidance for Businesses and Employers.
- Check the building for hazards associated with prolonged facility shutdown, ensure ventilation systems operate properly and increase air circulation as much as possible.
- Identify where and how workers might be exposed to COVID-19 at work.
- Develop hazard controls using the hierarchy of controls. Consider using a combination of engineering and administrative controls, explained further below.
Engineering Controls
Engineering controls isolate people from hazards. Consider the following example controls:
- Modify seats, furniture and workstations.
- Use methods to physically separate employees in the building, including work areas and common areas.
- Improve building ventilation based on local environmental conditions (e.g., temperature and humidity).
Administrative Controls
Administrative controls change the way people work. Consider the following example controls:
- Encourage employees who have symptoms of COVID-19 to notify their supervisor and stay home.
- Stagger shifts, start times and break times to reduce the number of employees in common areas.
- Post signs in parking areas and entrances that ask guests and visitors to wear cloth face coverings.
- Post instructions and reminders at entrances and in other strategic places about hand hygiene, COVID-19 symptoms, and cough and sneeze etiquette.
- Clean and disinfect high-touch surfaces.
Educate Employees
Employers should consider the following steps to educate employees and supervisors about how to protect themselves at work:
- Develop communication and training that is easy to understand, in preferred languages spoken or read by the employees, and includes accurate and timely information. Suggested topics include signs and symptoms of infection, staying home when ill, social distancing, cloth face coverings, hand hygiene practices, and identifying and minimizing potential routes of transmission at work, at home and in the community.
- Provide information and training on what actions employees should take when they are not feeling well (e.g., workplace leave policies, and local and state health department information).
- Remind employees and clients that the CDC recommends wearing cloth face coverings in public settings where other social distancing measures are hard to maintain. However, wearing a cloth face covering does not replace the need to practice social distancing.
The CDC has posters available for employers to download and print, some of which are translated into different languages.
Develop Special Considerations for Elevators and Escalators
Employers should implement special considerations if their building has elevators or escalators. Consider the following proactive measures:
- Encourage occupants to take stairs when possible, especially when elevator lobbies are crowded or when only going a few flights.
- Designate certain stairwells or sides of stairwells as “up” and “down” to better promote social distancing.
- Use floor markings in elevator lobbies and near escalator entrances to reinforce social distancing. Place decals inside the elevator to identify where passengers should stand if needed.
- Use stanchions in lobbies to mark pathways to help people travel in one direction and stay 6 feet apart.
- Consider limiting the number of people in an elevator and leaving steps empty between passengers on escalators.
- Post signs reminding occupants to minimize surface touching. They should use an object (such as a pen cap) or their knuckle to push elevator buttons.
- Consider adding supplemental air ventilation or local air treatment devices infrequently used elevator cars.
For More Information
Read the CDC’s Interim Guidance for Businesses and Employers for additional recommendations for creating new sick leave policies, and cleaning and developing employee communications to help protect employees and other building guests.
Contact us today for more COVID-19 guidance and resources to protect employees.
California’s Leader in Insurance and Risk Management
As one of the fastest-growing agencies in California, GDI Insurance Agency, Inc. is able to provide its clients with the latest and greatest of what the insurance industry has to offer and much, much more. The GDI team has developed an “insurance cost reduction” quoting plan, that provides you with the best coverage at the best rate!
We are headquartered in Turlock, CA, with locations across the heart of California’s Central Valley, Northern California and beyond to provide a local feel to the solutions and services we provide our clients. We pride ourselves on exceeding our client’s expectations in every interaction to make sure that our clients know how much we value and appreciate their business.
Contact us today 1-209-634-2929 for your comprehensive office insurance quote!
Source: CDC
by GDI Insurance | Business Insurance, Transportation
FMCSA Record Compliance After COVID-19
Since March 2020, the Federal Motor Carrier Safety Administration (FMCSA) has provided emergency exemptions and waivers for regulations to support COVID-19 emergency relief efforts. The FMCSA has provided waivers and exemptions for hours-of-service rules, pre-employment drug testing, driving skills tests, and renewals for commercial driver’s licenses (CDLs), commercial learners’ permits (CLPs), and medical certifications. Read below to see the FMCSA Record Compliance After COVID-19.
During this time, employers that helped with national emergency efforts and used these waivers or exemptions for their drivers may not have kept up with the documentation necessary for their drivers’ files. It is important for employers to understand that, if they used any of these exemptions or waivers, it should be documented in their drivers’ files, and any paperwork or license updates should be completed as soon as possible.
Exemptions vs. Waivers
Under FMCSA emergency declarations, various exemptions and waivers can be issued. Each one has its own requirements. In general, an exemption is temporary regulatory relief from one or more of the Federal Motor Carrier Safety Regulations (FMCSRs) given to a person or class of persons who are subject to the regulations, or who intend to engage in an activity that would make them subject to the regulations. An exemption provides the person or class of persons with relief from the regulations for up to two years, but it may be renewed.
A waiver is temporary regulatory relief from one or more of the FMCSRs given to a person who is subject to the regulations or who intends to engage in an activity that would be subject to the regulations. A waiver can provide relief for up to three months, but it can continue to be extended.
The waivers under the emergency declaration by the FMCSA during COVID-19 provide relief from specific regulations or provide states with the option to permit waivers for their drivers, both of which are stated in the waiver.
Regulations Affected by Exemptions or Waivers
Parts 390-399 of the FMCSRs are the regulations that are often exempted or waived. Among these regulations are rules relating to hours of service, vehicle maintenance and inspections, and general driver qualifications. Unless otherwise noted, the following regulations are not exempted by emergency declarations:
- Controlled substance and alcohol use and testing
- CDL requirements
- Minimum levels of financial responsibility
- Hazardous materials
The FMCSA will send out a notice for exemptions or waivers to inform the public of the details concerning the exemption or waiver, what type of relief is provided and what regulations still must be followed by drivers.
FMCSA Record Compliance After COVID-19 Exemption Documentation
Motor carriers who used or continue to use the exemptions should document that they are using them. One of the regulations affected by the COVID-19 exemptions is the driver qualification file requirements. Documentation for driver qualification files, such as new hire documentation or documents that need regular updating, likely has not been completed by employers. This documentation can include, but is not limited to:
- New hire driver applications
- Initial and yearly motor vehicle record (MVR) checks
- Road testing documents
- Requests for safety performance history
- Medical examiner certificates
All of these documents are required for new hires, and certain documents need to be updated annually. MVRs are updated annually, and medical examiner certificates must be updated every two years (unless noted otherwise by the physician).
Employers should review their drivers’ files to determine which documents are missing for drivers who were providing direct assistance during the emergency declaration. Once the missing documents are determined, the employer should update the files with the required forms and note the date the files were brought up to compliance. The forms should also explain that the reason for the delay was because the driver used the emergency declaration exemptions. The employer should also provide evidence to prove the driver qualified for the exemption in the file.
Waiver Documentation
Some waivers that have been issued by the FMCSA have included stipulations that drivers must meet for the waivers to apply, while other waivers have not included stipulations. Some examples of waivers with stipulations are for renewals of CDLs or CLPs for drivers whose licenses expired after a certain date. States are permitted, but not required, to extend the validity of CDLs or CLPs due for renewals on or after March 1, 2020. The FMCSA determined it was best to grant the waivers, as many CDL and CLP drivers were unable to renew their licenses or medical certifications due to state licensing agencies reducing their hours of operation or closing their offices.
If a waiver with stipulations for its use was implemented, the employer should document those stipulations in the driver’s file. The recordkeeping must show that the driver qualified for the waiver. For example, if a driver did not renew their CDL, but the state permitted it and the driver was within the parameters of the waiver to do so, then the employer should document that in the driver’s file. Drivers should have their licenses renewed and update any documentation required by the FMCSRs that has been waived. If a driver was able to at any point update any information necessary, they should have done so regardless of the waiver.
Employers should document all pertinent information in their drivers’ files. All conversations with doctors or facilities that provide the services the driver was unable to obtain should be documented to show good faith efforts made by the driver and employer.
Reason for Documenting
Providing as much information for using the waiver or exemption as possible is a best practice for a motor carrier. This information will be of significant use when a Department of Transportation (DOT) audit occurs. By providing this information in drivers’ files, the DOT auditor will understand the reason for the exemption or waivr use and see that the employer made a good faith effort in trying to stay compliant.
Employers must explain the specific waiver the driver used and show how the driver qualified to use that waiver. This information should stay in drivers’ files for as long as the documentation is required to be stored. Employers should refer to the FMCSA regulations for requirements on retention for specific documents.
It is important for employers to be proactive when it comes to FMCSA documentation compliance. If employers are not keeping accurate and complete records, this could lead to significant issues during a DOT audit. By documenting now, employers will be prepared when a DOT audit occurs.
California’s Leader in Insurance and Risk Management
As one of the fastest-growing agencies in California, GDI Insurance Agency, Inc. is able to provide its clients with the latest and greatest of what the insurance industry has to offer and much, much more. The GDI team has developed an “insurance cost reduction” quoting plan, that provides you with the best coverage at the best rate!
We are headquartered in Turlock, CA, with locations across the heart of California’s Central Valley, Northern California and beyond to provide a local feel to the solutions and services we provide our clients. We pride ourselves on exceeding our client’s expectations in every interaction to make sure that our client’s know how much we value and appreciate their business.
by GDI Insurance | Cannabis Industry, GDI Insurance
Cannabis Businesses Legislation Update
Recently, new bipartisan legislation—the Clarifying Law Around Insurance of Marijuana Act of 2021 (Claim Act of 2021)—was introduced to the U.S. Congress. This legislation provides protections for insurers of cannabis businesses and related, legitimate businesses. Since many states are legalizing or have legalized the sale of marijuana, the number of cannabis businesses has increased dramatically over the past decade. However, these businesses have had difficulty finding insurance coverage, as federal law still prohibits the sale of marijuana.
What Is the Claim Act of 2021?
The Claim Act of 2021 creates a safe harbor for insurers (i.e., precludes them from liability) that engage in the business of insurance in connection with a cannabis-related legitimate business, particularly within states that allow for the:
- Use;
- Cultivation;
- Production;
- Manufacture;
- Sale;
- Transportation;
- Display;
- Dispensing;
- Distribution; or
- Purchase of cannabis.
The bill was introduced to prevent cannabis-related businesses from being shut out from basic protections.
What Protections Does the Act Provide?
The Claim Act of 2021 would provide protections to insurers allowing them to provide insurance coverage to cannabis-related businesses without federal penalty. These insurance coverages include:
Since the sale of cannabis is illegal under federal law, many insurance companies will not cover cannabis-related businesses. This bill would prevent insurers from being penalized by federal agencies for providing coverage to such businesses. In particular the Claim Act would:
- Prohibit penalizing or discouraging an insurer from providing coverage to a state-sanctioned and regulated cannabis business, or an associated business;
- Prohibit the termination or limitation of an insurer’s policies solely because the insurer has engaged in the business of insurance in connection with a cannabis-related business;
- Prohibit recommending, incentivizing or encouraging an insurer not to engage in the business of insurance in connection with a policyholder, or downgrade or cancel the insurance offered to a cannabis or cannabis-related business;
- Prohibit the federal government from taking any adverse or corrective supervisory action on a policy to an owner or operator of a cannabis-related business, or real estate or equipment that is leased to a cannabis-related business, solely because the owner or operator is engaged with a cannabis or cannabis-related business; and
- Protect employees of an insurer from any liability solely for engaging in the business of insurance with a cannabis or cannabis-related business.
When Does the Act Apply?
The Claim Act of 2021 only applies to insurers that are providing insurance services to cannabis-related, legitimate businesses, or a state, political subdivision of a state or Native American tribe that exercises jurisdiction over cannabis-related legitimate businesses.
Cannabis-related, legitimate businesses include manufacturers, producers, or any person or company that engages in any activity that involves handling cannabis or cannabis products.
If the legislation passes, it would allow cannabis-related, legitimate businesses to obtain the proper insurance coverage necessary to responsibility run their operations. Additionally, insurers would be able to provide coverage to these companies without fear of prosecution or negative consequences. Overall, the Claim Act of 2021 could benefit small businesses in many states that have legalized marijuana.
California’s Leader in Insurance and Risk Management
As one of the fastest-growing agencies in California, GDI Insurance Agency, Inc. is able to provide its clients with the latest and greatest of what the insurance industry has to offer and much, much more. The GDI team has developed an “insurance cost reduction” quoting plan, that provides you with the best coverage at the best rate!
We are headquartered in Turlock, CA, with locations across the heart of California’s Central Valley, Northern California and beyond to provide a local feel to the solutions and services we provide our clients. We pride ourselves on exceeding our client’s expectations in every interaction to make sure that our client’s know how much we value and appreciate their business.
Contact us today 1-209-634-2929 for your comprehensive cannabis insurance quote!
by GDI Insurance | Business Insurance, Cyber Liability, Risk Management, Safety Tips, Small Business
CNA Financial’s “Sophisticated Cyber-Attack“
Commercial insurance carrier CNA was hit by a “sophisticated cyber-attack” that caused major havoc for certain systems, including email. Out of an abundance of caution, they contained the attack by proactively disconnecting their systems leveraging a methodical and carefully organized process. CNA is one of the biggest insurance companies in the U.S., with over 6,000 employees.
GDI Insurance Agency had a $250k+ premium account that most likely would have gone to them, but due to the system outage/failure they couldn’t get final pricing to us and lost the opportunity. Having happened leading into 4/1 (the start of a new quarter was the WORST timing for an insurance company). It’s murphy’s law, what can go wrong will (and when it does it’ll be at the worst possible time). If this happened with our agency, think of the losses they experience with other agencies as well.
CNA Insurance has been working around the clock for a week on the incident, and have just restored their enterprise email system, which is now safe. Adding additional security measures in place to protect their systems.
“The security of our data and that of our insureds’ and other stakeholders is of the utmost importance to us. Should we determine that this incident impacted our insureds’ or policyholders’ data, we’ll notify those parties directly,” the company said.
How CNA Dealt With A Sophisticated Cyber-Attack
“Out of an abundance of caution, we contained the attack we sustained by proactively disconnecting our systems from our network. We are now in the restoration stage and are bringing back our systems leveraging a methodical and carefully organized process. As highlighted here and as an example of this ongoing process, we have restored email access and you can communicate with CNA employees safely and in the normal course of business.”
10 Cyber Security Resolutions to Reduce Your Data Exposures
Sophisticated cyber-attack, threats and trends can change year over year as technology continues to advance at alarming speeds. As such, it’s critical for organizations to reassess their data protection practices at the start of each new year and make achievable cybersecurity resolutions to help protect themselves from costly breaches. The following are resolutions your company can implement to ensure you don’t become the victim of a sophisticated cyber-attack:
- Provide security training—Employees are your first line of defense when it comes to cyber threats. Even the most robust and expensive data protection solutions can be compromised should an employee click a malicious link or download fraudulent software. As such, it’s critical for organizations to thoroughly train personnel on common cyber threats and how to respond.
Employees should understand the dangers of visiting harmful websites, leaving their devices unattended and oversharing personal information on social media. Your employees should also know your cybersecurity policies and know how to report suspicious activity.
- Install strong antivirus software and keep it updated—Outside of training your employees on the dangers of poor cybersecurity practices, strong antivirus software is one of the best ways to protect your data.
Organizations should conduct thorough research to choose software that’s best for their needs. Once installed, antivirus programs should be kept up to date.
- Instill safe web browsing practices—Deceptive and malicious websites can easily infect your network, often leading to more serious cyber attacks. To protect your organization, employees should be trained on proper web usage and instructed to only interact with secured websites.
For further protection, companies should consider blocking known threats and potentially malicious webpages outright.
- Create strong password policies—Ongoing password management can help prevent unauthorized attackers from compromising your organization’s password-protected information. Effective password management protects the integrity, availability and confidentiality of an organization’s passwords.
Above all, you’ll want to create a password policy that specifies all of the organization’s requirements related to password management. This policy should require employees to change their password on a regular basis, avoid using the same password for multiple accounts and use special characters in their password.
- Use multi-factor authentication—While complex passwords can help deter cybercriminals, they can still be cracked. To further prevent cybercriminals from gaining access to employee accounts, multi-factor authentication is key. Multi-factor authentication adds a layer of security that allows companies to protect against compromised credentials.
Through this method, users must confirm their identity by providing extra information (e.g., a phone number, unique security code) when attempting to access corporate applications, networks and servers.
- Get vulnerability assessments—The best way to evaluate your company’s data exposures is through a vulnerability assessment. Using a system of simulated attacks and stress tests, vulnerability assessments can help you uncover entry points into your system.
Following these tests, security experts compile their findings and provide recommendations for improving network and data safety.
- Patch systems regularly and keep them updated—A common way cybercriminals gain entry into your system is by exploiting software vulnerabilities. To prevent this, it’s critical that you update applications, operating systems, security software and firmware on a regular basis.
- Back up your data—In the event that your system is compromised, it’s important to keep backup files. Failing to do so can result in the loss of critical business or proprietary data.
- Understand phishing threats and how to respond—In broad terms, phishing is a method cybercriminals use to gather personal information. In these scams, phishers send an email or direct users to fraudulent websites, asking victims to provide sensitive information.
These emails and websites are designed to look legitimate and trick individuals into providing credit card numbers, account numbers, passwords, usernames or other sensitive information.
Phishing is becoming more sophisticated by the day, and it’s more important than ever to understand the different types of attacks, how to identify them and preventive measures you can implement to keep your organization safe.
As such, it’s critical to train employees on common phishing scams and other cybersecurity concerns. Provide real-world examples during training to help them better understand what to look for.
- Create an incident response plan—Most organizations have some form of data protection in place. While these protections are critical for minimizing the damages caused by a breach, they don’t provide clear action steps following an attack.
That’s where cyber incident response plans can help. While cybersecurity programs help secure an organization’s digital assets, cyber incident response plans provide clear steps for companies to follow when a cyber event occurs. Response plans allow organizations to notify impacted customers and partners quickly and efficiently, limiting financial and reputational damages.
For additional cyber risk management guidance and insurance solutions, contact us today.
California’s Leader in Insurance and Risk Management
As one of the fastest-growing agencies in California, GDI Insurance Agency, Inc. is able to provide its clients with the latest and greatest of what the insurance industry has to offer and much, much more. The GDI team has developed an “insurance cost reduction” quoting plan, that provides you with the best coverage at the best rate!
We are headquartered in Turlock, CA, with locations across the heart of California’s Central Valley, Northern California and beyond to provide a local feel to the solutions and services we provide our clients. We pride ourselves on exceeding our client’s expectations in every interaction to make sure that our client’s know how much we value and appreciate their business.
Contact us today 1-209-634-2929 for your comprehensive cyber liability insurance quote!
by GDI Insurance | Cyber Liability, Insurance, Risk Management
Preventing Ransomware Exposures from Remote Desk Protocol
Remote desk protocol (RDP)—which is a network communications protocol developed by Microsoft—consists of a digital interface that allows users to connect remotely to other servers or devices. Through RDP ports, users can easily access and operate these servers or devices from any location. RDP has become an increasingly useful business tool—permitting employees to retrieve files and applications stored on their organization’s network while working from home, as well as giving IT departments the ability to identify and fix employees’ technical problems remotely. This guidance for preventing ransomware exposures is especially important with remote workers.
Unfortunately, RDP ports are also frequently being leveraged as a vector for launching ransomware attacks, which entail a cybercriminal deploying malicious software to compromise a device (or multiple devices) and demand a large payment be made before restoring the technology for the victim. In fact, a recent report from Kaspersky found that nearly 1.3 million RDP-based cyberattacks occur each day, with RDP reigning as the top attack vector for ransomware incidents.
Don’t let RDP contribute to a costly ransomware incident for your organization. Review the following guidance to learn more about how ransomware attacks can occur via RDP and best practices for minimizing the likelihood of such an incident.
Preventing Ransomware Exposures via RDP
RDP-based ransomware attacks usually stem from organizations leaving their RDP ports exposed to the internet. Although doing so can seem more convenient for employers in the scope of remote work operations, internet-exposed RDP ports are easy for cybercriminals to identify and offer a clear access point for deploying harmful attacks.
The typical process of an RDP-based ransomware attack is as follows:
- Scanning—First, a cybercriminal utilizes a port-scanning tool to search the internet for any exposed RDP ports. These scanning tools are often free and relatively simple to operate for attackers of varying skill levels.
- Gaining access—After identifying an exposed RDP port, the cybercriminal then gains access to the targeted server or device by using stolen credentials. Attackers can secure these credentials by either purchasing them on the dark web or implementing a brute-force tool that can rapidly input a series of usernames and passwords until the correct combination is found.
- Disabling security features—Once the cybercriminal has accessed the targeted server or device, they attempt to make it as defenseless against an attack as possible by disabling any existing security features (e.g., antivirus software, data encryption tools and system backup capabilities).
- Executing the attack—From there, the cybercriminal is able to steal sensitive data and deploy a ransomware attack on a vulnerable server or device. Some attackers even install backdoors during this step to allow for easy access during future attacks.
Like other ransomware incidents, RDP-based attacks can result in devastating ramifications for the impacted organization—including business interruption issues, reputational damages and large-scale financial loss.
Download our Case Study Today!
Strengthening RDP Against Ransomware
Although RDP-based ransomware attacks have become increasingly common, there are several ways for you to bolster your organization’s RDP security and lessen the risk of such an incident impacting your operations. Consider the following best practices:
- Close your RDP connection. First and foremost, ensure that your RDP connection is not open to the internet.
- Establish a virtual private network (VPN). To keep your RDP port from being exposed to the internet, be sure to establish a VPN. This will allow remote employees to securely access your organization’s RDP port, while also making the port far more difficult for cybercriminals to locate online.
- Elevate authentication protocols. Because cybercriminals require login credentials to properly execute an RDP-based ransomware attack, make sure you have effective user authentication protocols in place. Specifically, encourage employees to develop unique passwords for all of their devices and accounts. These passwords should be an appropriate length, refrain from using common words or phrases, and contain several special characters. In addition to strong passwords, consider requiring multifactor authentication for RDP port access as an extra layer of protection.
- Implement login attempt limits. To stop cybercriminals from being able to deploy brute-force tools to secure login credentials during an attack, update RDP port protection features to detect when multiple failed login attempts have occurred in a short period of time. Establish a limit on how many incorrect logins can occur before the user is blocked from further attempts—therefore halting an attack.
- Utilize adequate security software. Ensure all workplace technology is equipped with top-rated security software—including antivirus programs, a firewall, data encryption features and a gateway server—to deter attempted attacks. Update this software on a regular basis.
- Restrict employee access. Be sure to uphold the principle of least privilege by only providing employees with RDP access if they absolutely need it to conduct their work tasks. These employees should be trusted and trained in appropriate RDP usage. After all, granting extra employees unnecessary RDP permissions simply creates additional security gaps.
- Have a plan. Lastly, make sure your organization has an effective cyber incident response plan in place that addresses RDP-based ransomware attack scenarios. This plan should promote the backup storage of any critical data in multiple secure locations (both on-site and off-site) to minimize potential losses. Practice this plan regularly with staff and make updates as needed.
For additional risk management guidance and insurance solutions, contact us today.
California’s Leader in Insurance and Risk Management
As one of the fastest-growing agencies in California, GDI Insurance Agency, Inc. is able to provide its clients with the latest and greatest of what the insurance industry has to offer and much, much more. The GDI team has developed an “insurance cost reduction” quoting plan, that provides you with the best coverage at the best rate!
We are headquartered in Turlock, CA, with locations across the heart of California’s Central Valley, Northern California and beyond to provide a local feel to the solutions and services we provide our clients. We pride ourselves on exceeding our client’s expectations in every interaction to make sure that our client’s know how much we value and appreciate their business.
Contact us today 1-209-634-2929 for your comprehensive cyber liability insurance quote!
