The Archdiocese of Cincinnati works with the Bishops’ Plan Trust to provide Boiler & Machinery Insurance.  Liberty Mutual Insurnace Company is the carrier for the Archdiocese’s Boiler & Machinery Insurance coverage.

Liberty will not charge for the inspections.  They will perform inspection and file the paperwork allowing our clients to get their certificate.  The locatoin still needs to pay for certificates.

As part of our service agreement, Liberty is also doing a complementary inspection of the other features in the boiler rooms which includes general condition of mechanicals.

• To request a boiler inspection please call 877.526.0020 or email: LMEBInspections@libertymutual.com
  • At the time of your call, please identify your location as a member of the Bishops Plan Trust and give the operator the following information:
  • Policy#: YB2-L9L-480466-015
  • Address, City, State and ZIP Code of Location(s) to be inspected
  • Person to contact for scheduling inspection(s)
  • Contact phone and/or email

• • If your location experiences damage or breakdown to a boiler or machinery, other than normal wear and tear, contact Gallagher Bassett Services at 833-273-5479 to submit a claim.
  • Jurisdictional Inspection Preparation Guideline
  • Jurisdictional Inspections Instructions

The Archdiocese of Cincinnati Self Insurance Program does not include cybersecurity.

Program coverage is available to individual AOC entities who provide acceptable applications!

Learn More and Review the Cyber Insurance Coverage Applications

The following notes the current underwriting standards in three categories, RED-YELLOW-GREEN, to better client risk profiles and improve coverage and premium rates.  Your path to coverage is dependent on your organization’s ability to demonstrate you clear these hurdles.

RED

Critical:  Absent these steps cyber insurance coverage is unlikely

1. Identity Access Management – Put the following behind multifactor authentication (MFA):
   • Employee email
   • Remote Access (Virtual Private Network (VPN) and Remote Desktop Protocol (RDP))
   • Privileged Access (Admin accounts)
2. Endpoint Protection – Deploy Endpoint Detection & Response Solution (EDR) on all managed endpoints and servers and place in blocking mode.
3. Backups – Maintain segmented, encrypted, offline or immutable backups of critical data, with separate credentials for access protected by MFA, and test recovery at least annually.
4. Patching and Vulnerability Management – Have a documented plan that addresses:
   • Segmented End of Life (EOL) software and hardware.
   • Regular patching and scanning cadence.
   • Demonstrated ability to apply critical security patches immediately (<48 hours), particularly in response to high profile zero-day exploits.
5. Cybersecurity Awareness and Phishing Training – Train all new employees upon hire and retrain annually for all users. Conduct quarterly phishing campaigns on all users.

YELLOW

Preferred: May help you secure more competitive pricing and coverage

1. Email Filtering – Utilize strong email filtering tools that block malicious attachments, suspicious file types, and executables. Utilize tools that can run suspicious attachments in a isolated environment or sandbox. Employ SPF, DKIM, and DMARC.
2. Privileged Access Management (PAM) – Incorporate privileged access account security measures and/or an integrated PAM tool that actively manages admin accounts and maintains audit logs. Utilize domain/service account restrictions across the environment and separate from day-to-day accounts. Limit the number of service accounts in the DA group (<5). Review vendor access regularly. Turn off local admin control on all owned/managed endpoints or implement compensating controls
3. Segmentation – Segment your network by operational function, data classification, operational risk, and geography. Incorporate safeguards to prevent lateral movement across your network.
4. Security Operations Center (SOC) – Utilize a 24/7 SOC, either internal, third party, or hybrid.
5. Security Monitoring – Invest in a security information and event monitoring (SIEM) tool.
6. Encryption – Encrypt all critical data, in-transit and at rest on servers. Encrypt all end user devices, especially those with critical data.

GREEN

Desirable: May help you be classified as best-in-class within your risk profile segment.

1. Password Management – Require strong user passwords that must be periodically changed. Provide employees with a password manager.
2. Data Loss Prevention and Intrusion Detection – Invest in a tool that monitors data loss (DLP) and place in blocking mode. Invest in an intrusion detection system (IDS).
3. Data Governance – Have a unified data governance solution to help manage and govern your data.
4. Plans – Have written Disaster Recovery (DRP), Business Continuity (BCP), and Incident Response (IRP) Plans in place and updated yearly. Have a Ransomware Playbook and conduct regular tabletop exercises.
5. Standards – Follow an information security framework (i.e., IS2700, NIST SP 800-53,171, CSF, CIS Controls, HITRUST and COBIT).
6. Vendor Management – Require cyber insurance, ask for indemnification, and enforce minimum security standards.
7. Access Management – Utilize a zero-trust security framework with just-in-time (JIT) access.

General Liability Coverage is available for personal injury and property damage where the Archdiocese of Cincinnati, parishes, institutions, cemeteries and agencies covered by the Self-Insurance Program may be legally liable.  Location incident reports documenting an event with photos, witnesses and contact information should be prepared as soon as possible.  

Report all incidents to Gallagher Basset Services, Inc.  833.273.5479

Coverage is provided for sudden and accidental damage to property owned or leased by the Archdiocese of Cincinnati, parishes, affiliated schools and organizations participating in the Archdiocesan Self-Insurance Program (SIP).  This includes buildings, their contents and equipment, fine arts, money and securities.  Coverage is provided on a ‘Replacement Cost’ basis and is always subject to program exclusions.  Please note:  Unoccupied property damages are valued at Actual Cash Value.  Property damage valuation for a structure compromised, or more susceptible to property damage, due to deterioration and /or lack of proper maintenance schedules is subject to less than replacement cost reimbursement.

Property Deductible: $10,000*.

Report all incidents to Gallagher Bassett Services, Inc.  833.273.5479

*Emergency Services for Sudden and Accidental events are eligible for a maintenance deductible reduction to $1,000. 

The Risk Management Office has contracted with First Onsite Property Restoration, a nationwide provider of emergency response for property damage.  This service provides guaranteed response times and service fees, even in times of widespread storm events. To report an incident call First Onsite 800.622.6433.  One call to First Onsite will also initiate the claim process with Gallagher Bassett.  Deductible is reduced only if First Onsite engagement is deemed necessary.