Human operational error treatment (cover)
A policy's stance on non-malicious human error committed during a maintenance or operations task, the most frequent cause of major data center outages.
Human operational error treatment is how a policy responds to a non-malicious mistake by an operator, technician or engineer during routine maintenance or operations. This kind of error is statistically the most frequent cause of major data center and cloud outages, well ahead of pure hardware failures and natural disasters. A mistargeted command, a poorly followed procedure, a test run in production by mistake: unlike sabotage or clear-cut gross negligence, ordinary error generally falls within the normal hazard of complex human activity. It remains covered under standard property and business interruption policies, with no specific exclusion. For the insurer, the difficulty is technical more than legal. It has to establish that the outage came from the error and not from an underlying hardware defect the error merely exposed. That often takes deep forensic work, while technical logs may be incomplete or themselves hit by the incident. For the insured, this peril is a reason to demonstrate the quality of its change-management procedures and the isolation of its test environments, which underwriters scrutinize more and more.
The engineer behind Amazon Web Services' February 2017 S3 outage had run a routine maintenance command with an overly broad parameter and mistakenly removed more servers than intended. A textbook case of ordinary human error, with no hardware failure and no malicious intent.
human error cover, operator error clause, human error extension
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.