Expect to See Surcharges on Your Policy for the L.A. Fires
Even if you have a business or a home that was not affected by the recent wildfires in Los Angeles, you will likely see a surcharge to help pay for them on your next property insurance policy renewal.
The state-run California FAIR Plan, which is the market of last resort when policyholders are unable to find coverage from private carriers, expects its total loss from the Palisades and Eaton fires to come in at $4 billion.
Under its charter and state law, if it exhausts its funds, the plan can surcharge all commercial property and homeowner’s insurers in the state after approval from the state insurance commissioner.
Commissioner Ricardo Lara approved the Fair Plan’s request in early February to surcharge insurers a total of $1 billion, which will be assessed depending on each insurer’s market share. Under state law, those carriers are allowed to pass half of their assessment on to their policyholders in the state. It’s unclear how much each policy will be surcharged, but the fee will partly be based on the size of each policyholder’s annual premium.
Without the assessment, the FAIR Plan would run out of funds by the end of March and be unable to pay all of the claims from the fires, as well as claims from unrelated or future events and operating expenses, including the cost of increasing staff to respond to the disaster.
The state of play
The L.A. fires are one of the costliest natural disasters in the history of the country. Consulting firm Milliman estimates that the wildfires will cost $23 billion to $39 billion in insured losses.
As of Feb. 11, the Fair Plan had paid out about $800 million in claims, leaving it with about $1.2 billion in cash on hand.
It has also tapped reinsurance, which is basically insurance for insurance companies. It has multiple layers of reinsurance, but it cannot access all of them until it spends more of its funds on claims. It now has access to the first tranche of coverage worth $350 million after it met its $900 million deductible.
The FAIR Plan can access additional layers of reinsurance based on the claims incurred and outstanding reserves up to a $5.78 billion limit. To access all layers of available reinsurance, the plan would have to pay out about $3.5 billion, including the $900 million deductible, and copays. That’s more than its cash in hand.
After accounting for its reinsurance package, the FAIR Plan expects to pay out $2.3 billion of the remaining $3.1 billion reserved for unpaid losses from the fires.
How it will affect your policy
To help the plan pay for the $1 billion shortfall, it will surcharge each property insurer in the state based on their market share two years prior to the assessment. Every carrier that sells commercial property and homeowner’s insurance in the state will be assessed.
Here are the market shares of the top 10 insurers in 2023, the year assessments will be based on:
- State Farm 19.7%
- Farmers 14.7%
- Liberty Mutual 6.5%
- CSAA 6.4%
- Mercury 6%
- Allstate 5.7%
- AAA of Southern California 5.5%
- USAA 5.3%
- Travelers 4.3%
- Nationwide 3.1%
Avoiding Wage & Hour Lawsuits in a Connected, Remote Work World
While wage and hour lawsuits filed against employers around the country declined between 2022 and 2023, there were still nearly 6,000 complaint filings under the federal Fair Labor Standards Act.
These types of complaints are the most common employee actions against employers and they typically cover failure to pay workers for hours worked, overtime infractions or requiring them to work during their lunch period.
With the onset of remote work and mobile devices, the chances of an employee working off the clock have increased substantially.
For example, if a manager texts a non-exempt employee while they are home and during non-working hours and asks them to send a client an e-mail, they are essentially requiring the employee to work unpaid.
If your require or allow your staff to work off the clock, the employee must be compensated for all of that time. This means that even if you did not ask the employee to work, you may still be required to compensate them, as long as:
- You know or have reason to believe that the employee is continuing to work, and
- You are benefiting from the work being done.
This is true regardless of where the work is performed at in the office or at home, for example.
Nine steps to protect your business
To protect your business from being sued for wage and hour infractions:
- Calculate overtime correctly. In some cases, an employee is paid by salary or piecework, and may receive bonuses and commissions. All of these are factors that must be considered in correctly calculating overtime pay.
- Keep detailed records of everything related to wages and hours.
- Do not allow non-exempt employees to remotely access their work e-mail account.
- If you give an employee access to their work e-mail at home, ensure that they are paid for their time in reviewing and responding to e-mails when not at work.
- Educate managers about text messaging or e-mailing non-exempt employees when they are off the clock. Conversely, tell non-exempt staff avoid answering text messages or e-mails about work when they are off the clock.
- Do not allow employees to take lunch at their assigned work area. If a worker answers a phone call or writes an e-mail during a lunch break (even if they weren’t not ordered to do so), they may be entitled to payment for time worked.
- If an employee is asked to stay after their scheduled end time to finish up a project, they need to remain on the clock and paid for that time.
- If a supervisor knows that a worker is staying late to finish a project, that time is compensable, even if the supervisor never asked them to stay late.
- Have in place a written policy that bars unauthorized work or unauthorized overtime. Ensure that your employee handbooks and wage and hour policies and procedures are up-to-date and compliant.
Insurance
If an employee is successful in an FLSA claim, they may recover twice the amount of their unpaid wages, plus a mandatory award of attorney fees, which often far exceed the amount of any unpaid wages.
Many employers purchase employment practices liability insurance to help cover the costs of employee lawsuits, but policies typically exclude coverage for wage and hour claims.
However, there are some insurers that will provide a wage and hour defense-cost-only sublimit on the EPL policy.
There are some specialized insurance policies that are sold by offshore companies that will cover wage and hour infractions, the costs of litigation and awards. However, they are uncommon.
In light of the scarcity of coverage, it’s important that you have in place strong policies to deter employees from working unauthorized overtime.
How the L.A. Fires May Affect Your Commercial Property Insurance
The fires that have ravaged large swaths of homes and businesses in Los Angeles are likely to significantly alter the California commercial property insurance market. Policyholders may need to brace themselves for surging premiums, policy non-renewals and uncertainty.
These wildfires will result in record payouts by insurers. Moody’s RMS estimates insured property losses from the fires will be up to $30 billion, and uninsured property losses will be billions of dollars more.
So many insurers have in recent years already left the state or drastically curtailed the number of policies they write due to the wildfire threat, that the scale of these fires could push more of them to do the same.
Besides the hit to insurers, the L.A. fires are likely to have severe consequences for the state’s market of last resort for home insurance, the California FAIR Plan, which said it may see more than $3 billion worth of claims from the fires.
The FAIR Plan does not have the resources to cover damages above $2.3 billion at this stage. If its ultimate claims exceed that, all property insurers in the state will be surcharged — and likely will pass those fees on to policyholders.
Here’s a look at the current state of the market and how commercial property policies may be affected.
The state of the market
The homeowner’s and commercial property insurance market in California is in a state of crisis.
Dozens of insurers have pulled out of the state and the ones who have opted to stay have dropped policies in high-risk areas or they have gotten more selective about the properties they are willing to insure.
Mainstays like State Farm, Farmers and Allstate have stopped taking on new customers and have been shedding others they deem too risky. State Farm has dropped more than 100,000 policyholders in the last year alone.
Some common factors that can prompt a carrier to refuse coverage are the age of the roof (10 years for composite) or the age of the property (some insurers won’t insure a home older than 25 years).
Commercial property owners who have recently filed claims are often dropped as well by their insurers and find it hard to secure new coverage.
Besides the wildfire risk, the cost of repairs and rebuilding has skyrocketed in the last few years, which has driven rates higher.
The bottom line: The market was already turbulent before the L.A. fires.
Commercial property rates
Commercial property rates have been increasing an average of 20% a year recently, but many property owners have seen their rates double or triple. Even those who are forced to go to the FAIR Plan for coverage face significantly higher premiums, particularly if they live in a wildfire-prone area.
Besides wildfires, a number of other factors have converged to drive insurance rates even for properties in areas not prone to wildfire, like urban, suburban and industrial areas. These include:
- Inflation and rising repair costs — Rebuilding costs have risen more than 30% since 2020.
- Reinsurance costs — Insurance companies purchase their own insurance called reinsurance to manage risk, especially in catastrophe-prone regions. Reinsurers have raised rates and increased the thresholds for when they’ll start paying claims due to the increased risk in California.
While you’ve already experienced rate hikes for your commercial property policy, the size of rate increases over the past few years has been tempered by laws that restrict the factors insurers can use when calculating future rates.
New rules that just took effect in January 2025 will allow insurers to factor in expected future costs of natural catastrophes and the cost of reinsurance when pricing their commercial property policies.
The Department of Insurance has also been expediting rate increase requests, which in the past sometimes have taken years to get approved.
Moody’s has predicted that property rates will rise again as a result of the fires.
Risk to the FAIR Plan
As insurers leave the Golden State or refuse to cover properties in areas like the Pacific Palisades, Big Bear, Truckee and other wildfire-prone areas, more property owners have been forced to get coverage with the FAIR Plan, which has put it in precarious shape. As of Sept. 2024 (prior fiscal year-end), the FAIR Plan’s total exposure was $458 billion, a 61.3% increase from Sept. 2023.
Those sums are astounding, considering that the FAIR Plan’s annual written premium is $1.26 billion. Also, the plan had just $200 million in reserves as of Sept. 30 last year, and $2.5 billion in reinsurance.
Current estimates are that the FAIR Plan will likely face more than $3 billion in claims from the fires, mostly from homeowners, but also the hundreds of businesses that were damaged or destroyed.
Under state law, if the L.A. wildfires exceed its reserves and reinsurance, the plan can charge all private insurers in the state based on their portion of the insurance market for the first $1 billion above what the FAIR Plan can pay — and they can collect half of that from their policyholders.
For any funds needed above $1 billion, the FAIR Plan can seek approval to assess all policyholders in the state.
Any of those surcharges would be on top of premiums policyholders pay. However, there is talk that the California Legislature may come to the rescue with some sort of bailout.
One other issue: Property owners with the FAIR Plan must contend with its policy limits. For commercial properties, the most the plan will insure on any given property is $20 million (for homeowner’s insurance, it’s $3 million).
What you can do
Don’t lose hope if you have business property in California. Consider the following:
California’s property rates are still lower than in many other states. The current changes may reflect a market correction rather than an outlier spike in costs.
There is still insurance capacity with surplus insurers. If you can’t get coverage with a carrier that’s licensed in the state, we can help you find coverage in the non-admitted insurer market. These insurers are reliable even though they’re not licensed in California, but that also gives them flexibility in how they write policies, which they can better tailor for your individual needs.
The market is cyclical and will change. The current challenges are likely to stabilize as insurers adjust to the new risk environment, raise rates, change policy wording and regulatory changes are implemented. Market corrections, along with efforts to mitigate risks, such as improved fire safety measures, may restore balance.
Top Eight Business Risks for 2025
One of the keys to running a successful business is having in place a robust risk management system to ensure your company can guard against a growing number of threats that can derail operations or cause significant losses.
While each industry and company have different risks they face, a recent survey collected responses from risk managers around the world to identify the top risks facing businesses.
The “Allianz Risk Barometer 2025” highlights the key threats for organizations in an increasingly interconnected and volatile environment.
Below are the top eight risks in 2025 and what you can do to protect against them.
1. Cyber incidents
Cyber risks like ransomware attacks, data breaches and IT outages remain the number one threat globally. With AI accelerating the sophistication of attacks, businesses have to double down on protection.
What you can do — Invest in robust cyber-security measures and training employees on how to detect threats and avoid clicking on links that contain malicious code. Regularly update systems, conduct penetration testing and educate staff on cyber hygiene.
2. Business interruption
Supply chain disruptions, often triggered by cyberattacks or natural disasters, have consistently ranked high. If one of your suppliers suddenly can’t provide you with goods your firm needs or a cyberattack affects your ability to function, you will lose money.
What you can do — Diversify suppliers, explore local sourcing and implement business continuity plans that include how to respond to each possible issue that could result in disruption to operations or sales.
3. Natural catastrophes
Events like hurricanes, wildfires, convective storms and flooding can cause significant losses, be that from damage to property and assets, injury to staff, employees being unable to work or business interruption.
What you can do — Put in place a disaster recovery plan that includes how members of your staff will communicate, possible alternative locations for operations, and how to protect your facilities. Evaluate disaster preparedness and explore insurance solutions.
4. Changes in laws, regulations
Regulatory shifts, especially around sustainability and emerging technologies like AI, are creating compliance challenges. Businesses will be faced with plenty of uncertainty under a new Trump presidency, considering his plans to pursue deregulation.
While a boon for business, it could lead to confusion, particularly for those who operate in blue states. As well, the new president’s promises of raising tariffs could lead to higher costs for many businesses that source products, parts and machinery from abroad.
What you can do — It’s important that you stay on top of regulatory and legal changes to avoid penalties or lawsuits. Engage legal advisors or compliance experts to navigate changing laws.
5. Climate change — The physical and operational impacts of climate change, such as extreme weather and resource scarcity, are intensifying and businesses need to harden their operations to cope.
According to the report: “Extreme temperatures can drive up energy demand, which is especially critical for industries reliant on cooling systems, potentially leading to operational cost increases. Water scarcity can threaten businesses reliant on water for operations, while biodiversity loss undermines ecosystem services which many industries depend on, for example, agriculture or maintaining crop yields.”
What you can do — Many of the same preparations businesses can make for dealing with natural catastrophes can also be used for climate change resilience.
6. Fire and explosion
Fires remain a leading cause of business interruption, especially with the rise of lithium-ion battery incidents. “The degree of disruption can be very high, as it can take longer to recover from than many other perils,” the report states.
What you can do — Ensure that you conduct regular fire safety audits and training to staff, particularly if you store flammable materials on-site. Regularly update your fire prevention protocols and provide emergency response training.
7. Macroeconomic developments
Economic uncertainties, including inflation and fluctuating monetary policies, pose challenges for budgeting and forecasting. This will be especially true under the Trump administration as he sets out to reverse Biden’s policies and pursues tariffs that could lead to trade wars.
What you can do — Keep abreast of market trends and adapt to macroeconomic changes with flexible planning. Staying agile and diversifying revenue streams can mitigate risks.
8. Market developments
Many experts believe it is unlikely that there will be a major stock market correction in 2025. Recovering earnings and Trump’s plans for deregulation and strong fundamentals should support continued growth.
What you can do — Strategic planning and market analysis are critical if your organization is reliant on stock market gains.
The takeaway
The above list of risks was gleaned from a survey of companies around the world, but many of the risks also apply to U.S. firms.
It’s important that businesses take a structured approach to managing their risks and creating plans for all eventualities that may affect them. That requires buy-in from management and a focus on protecting the company’s revenue stream, physical and digital assets, employees and supply chains.
Commercial Property Rate Hikes High, but Slowing
While commercial property insurance rates have been increasing for seven straight years, the pace of rate hikes has slowed a bit this year, according to a new report.
With many factors continuing to pressure rates, businesses should expect continued hikes for their commercial properties, with the biggest increases taking place in areas at higher risk of natural catastrophes, which vary depending on which part of the country they are located in.
The third quarter 2024 “Commercial Property/Casualty Market Index” by the Council of Insurance Agents & Brokers reported a 7.9% year-on-year increase in property insurance pricing, which is a significant drop from the 17.1% average rate increase noted in the same period of 2023.
While rates are still rising, analysts say that the pace of increases may finally be catching up with the higher claims costs and other factors affecting insurers.
If your business insurance policy renewal is coming up, here’s an explainer of what is driving rates this year and what you may be able to do about it.
Rate increase drivers
A convergence of factors has caused this extraordinary rate-hardening cycle in commercial property insurance:
Catastrophe losses — This includes hurricanes, floods, wildfires, tornadoes and winter storms. As climate change intensifies, the U.S. and the world at large have seen a surge in the cost and scope of natural catastrophes.
Adding to what insurers pay after these events, Americans have also been migrating for decades to areas that are now most at risk of disasters. With higher population density comes more claims.
Insurers in the U.S. generally paid out increasingly large amounts for natural disasters in the last decade. In recent years the payouts have totalled:
- 2023: $81.6 billion
- 2022: $116 billion
- 2021: $108 billion
- 2020: $98 billion
Catch-up pricing — Insurers have been trying to catch up after years of underpricing their policies. They had done this by not keeping up with the cost of rebuilding, but also not requiring policyholders to increase their policies’ replacement costs to keep up with those higher costs.
Bright spot: It now looks like insurers have caught up with prior years’ underpricing as rate increases continue rising, but at a slower rate, depending on where you live.
Rising reinsurance rates — Insurers buy their own insurance by contracting with reinsurers, which share the risk. Due to rapidly rising catastrophe claims costs, these reinsurance firms have recorded substantial losses in the last few years due to natural catastrophe hits.
Facing financial pressure, reinsurers have:
- Raised their own rates substantially,
- Started requiring insurers to carry more of the risk,
- Tightened their terms, which also transfers more risk to the insurers, or
- Pulled out of markets altogether.
Bright spot: Reinsurance rates are leveling off for 2025 and the companies are starting to take on more risk once again, which could bring some relief to commercial property carriers.
Higher construction costs — The cost or construction and rebuilding has skyrocketed since 2019, due to higher material, energy and labor costs. However, that inflation has cooled as well.
Bright spot: According to CBRE, a real estate firm, in 2023 construction costs rose 4.9% year on year, compared to 14.1% between 2021 and 2022 and 11.1% between 2020 and 2021.
What you can do
Depending on where you live, insurance may be relatively easy to secure or it could be near impossible, forcing you to go to a state-run carrier of last resort.
Insurers have gotten picky about which properties they will insure, but as a property owner you can take steps to improve your insurability or reduce your rates, such as:
- Making sure you have a detailed property maintenance plan in place.
- Replacing or repairing the roof, electrical system and plumbing as necessary, particularly if it’s outdated or decades old.
- Having a disaster recovery and business continuity plan to ensure continued operations in case of an event.
- Installing sprinkler systems and leak-detection sensors that can alert you if there’s a water leak in the building.
- Thinking about increasing property deductibles.
- Giving us a call.
The Growing Risks of Vendor Technology to Your Business
While your organization may have its cyber-security protocols buttoned up using best practices, there is a growing risk to businesses from tech vendors that are used to run their operations.
According to the 2023 SecurityScorecard “Global Third-Party Cybersecurity Breaches” report, 98% of organizations have a relationship with a third party that has been breached and 29% of all breaches were attributed to an attack on a third party outside of the organization.
The findings reflect the growing risk to businesses as they use more third party apps, software and cloud services, some of which have access to troves of important company data.
Also, the costs of a cyberattack on a company’s vendor are often 40% higher than the cost to remediate an internal cyber-security breach.
The findings shine the spotlight on the growing risks from interconnectivity in digital supply chains and vendor relationships that affect virtually all businesses, in particular those that:
- Rely on tech vendors that keep day-to-day operations running.
- Entrust confidential information on clients and employees to a third party vendor.
- Use outside vendors for specific goods and services.
Another survey by the cyber-security firm OneTrust found that:
- 71% of organizations use more outside technology vendors than they did three years ago.
- 73% of businesses have experienced significant disruption caused by a third party, whether it be a data breach or ethical violation.
- 73% say outside vendors have more access to company data than they did three years ago.
- 80% have expanded their third party due diligence questionnaires in recent years.
Examples of third party relationships that may pose risks
- File transfer software
- Client management software
- Business management platforms
- Cloud services
- Hosting provider and external platforms
- Security software
- Outsourced software development
- Facilities management software.
Third party breach examples
The crash. An online store uses a cloud provider to run its business and an outage causes its website to crash, preventing orders from being fulfilled.
Effect: Contingent business interruption (coverage for third party events), in addition to other expenses and costs.
The backdoor attack. A vulnerability in software that connects to a company’s servers turns out to be a backdoor for attackers who install malicious code on the firm’s network.
Effect: The vendor attack could lead to business interruption and additional expenses.
The payroll vendor breach. The payroll company an employer uses suffers a breach, potentially exposing confidential information of clients and/or vendors.
Effect: This could constitute a privacy incident, potentially requiring notification to affected individuals and companies.
What you can do
As attacks on third party vendors continue to increase, it’s important you understand your firm’s third party risks, and how to measure and manage those risks.
Besides strengthening internal cyber-risk protocols, you should consider doing an analysis of your third party risks. While this will vary depending on the business and its industry, here are some ways you can get a better handle on your company’s vulnerabilities:
- Determine which vendors are critical to your operations. For the most critical, you can also determine which suppliers or providers your vendor uses.
- Define and quantify your risk with each third party tech vendor you use, to help you identify the damage to your organization should they suffer an attack that compromises their systems, and subsequently, yours.
- Create an incident response plan that maps out what steps your organization can take in case a vital vendor goes down. Test the plan against different types of scenarios and determine how you would respond. You should allow not only your IT people, but also the rank and file that use these systems to test the plan’s effectiveness.
- Verify that your critical vendors carry cyber-insurance coverage that would address losses your firm may endure if they suffer an event.
Insurance
To ensure that you are not left footing the bill for these types of incidents, review your cyber-insurance policies to see if they cover attacks or incidents on third parties that your firm uses. Call us for a review.
Expensive Litigation Is Driving Insurance Costs
Soaring court judgments and jury awards are pushing up the cost of commercial liability and umbrella insurance policies, particularly for businesses that have been sued before.
There are a number of factors at play, including massive “nuclear” jury awards for tens of millions of dollars, private equity-backed lawsuits and a phenomenon known as “social inflation” — when the costs of jury awards increase faster than the cost of living.
A 2024 A.M. Best report found that social inflation and large verdicts verdicts mostly affect commercial auto, professional liability, product liability and directors and officers liability insurance.
Policyholders are also facing more restrictive general liability coverage as insurers continue to reduce their exposure.
What’s happening
A 2024 study by reinsurance company Swiss Re found that social inflation had increased liability claims by 57% over the previous decade. The increase in 2023 alone was 7%. Another study showed that over a five-year period, the top 50 insurers in the U.S. had allocated half a billion dollars for litigation expenses.
The Insurance Information Institute in early 2024 pointed to legal-system abuse as a leading reason for auto insurance companies losing money to the tune of $1.10 for every $1 in premium.
“As dangerous roads and driving conditions as well as economic costs have been on the rise for several years,” the institute wrote, “the challenges presented by overzealous billboard attorneys are exacerbating the situation.”
Adding fuel to the fire is the increase in “nuclear verdicts” — when a jury awards damages of more than $10 million.
Fears of verdicts this large have encouraged businesses and their insurers to settle claims rather than fight them, leading to higher costs.
Lawsuits have also become investment vehicles. Private equity firms are funding lawsuits against businesses in return for a share of any awarded damages or settlements.
Recent ‘nuclear’ jury awards
- In 2021, a Florida jury awarded a landmark $1 billion verdict to next of kin of a motorist who was killed after a driver for Kahkashan Transportation Inc. was on his cell phone when he flipped his semi truck, plowing into the man’s vehicle.
- A Philadelphia jury in May 2024 ordered Exxon Mobil to pay $725 million to a service station mechanic who developed cancer after being exposed to benzene in gasoline.
- In June 2024, a California jury ordered entertainment mogul Alki David to pay $900 million to a former worker who had accused him of sexual battery.
What you can do
You business can reduce your chances of getting sued by:
- Focusing on risk management,
- Ensuring you hire good drivers and provide training that focuses on reducing risks of distracted driving,
- Preventing workplace discrimination and harassment,
- Maintaining clear and detailed documentation,
- Implementing sound business practices,
- Training employees on legal compliance, and
- Having clear contracts.
You can work with your insurance companies both on loss prevention and managing claims for losses that do occur. Finally, work with us to ensure that you have liability policy limits that are realistic in today’s world.
A New Cyber Security Threat Businesses Cannot Ignore
An allegedly Chinese state-sponsored hacker campaign dubbed “Salt Typhoon” has infiltrated major cell phone providers, including AT&T and Verizon, potentially exposing your company’s communications to threat actors.
The attack has been described as the most significant telecommunications hack in U.S. history. While the breach is alarming for individuals, the implications for businesses are profound and demand immediate attention.
What is Salt Typhoon?
Salt Typhoon is a sophisticated cyber-espionage operation allegedly orchestrated by the Chinese government. The campaign has targeted vulnerabilities in telecom providers’ infrastructure to access text messages, monitor communications and extract sensitive metadata.
The ongoing breach has affected at least eight major U.S. telecom companies and poses a severe threat to national security and corporate privacy.
Potential dangers to businesses
- Exposure of sensitive informationText messages often contain business-critical details, such as contracts, client discussions, or even login credentials. If these communications are intercepted, companies risk financial loss, reputational damage and legal consequences.
- Corporate espionage
Competitors or foreign entities gaining access to a company’s internal strategies could result in lost market advantages or intellectual property theft.
- Regulatory and legal repercussions
Many industries are subject to strict data protection laws. A breach exposing customer or employee information could lead to fines and legal actions under regulations such as GDPR or CCPA.
- Erosion of trust
Business partners and clients may lose confidence in a company’s ability to safeguard information, leading to strained relationships and loss of business opportunities.
Government warning
In response to the Salt Typhoon campaign, the U.S. government issued strong recommendations for using end-to-end encrypted communication platforms.
Unlike standard text messaging or phone calls, end-to-end encryption ensures that only the sender and recipient can read the messages, preventing interception even if a network is compromised.
Apps like WhatsApp and Signal, and corporate platforms such as Microsoft eams and Zoom with encryption features have been singled out as secure alternatives. In contrast, traditional SMS and non-encrypted messaging services remain vulnerable.
For businesses, adopting these recommendations is a necessity. The FBI and the Cybersecurity and Infrastructure Security Agency have emphasized that sensitive communications must migrate to encrypted platforms to mitigate risks from ongoing cyber threats.
Protecting your firm
Protecting your business from the fallout of attacks like Salt Typhoon requires a multi-layered approach. Here are some critical steps:
- Use encrypted messaging: In light of the official recommendations above, shift all internal and external communications to end-to-end encrypted platforms such as Signal or WhatsApp, or enterprise solutions with encryption features.
- Eliminate SMS-based authentication: Avoid using text-based, one-time passwords for authentication; instead, deploy hardware security keys or app-based authenticators.
- Update systems regularly: Ensure all devices and software are updated to patch known vulnerabilities.
- Train employees: Conduct regular cyber-security training to educate employees about phishing, secure communications and device management.
- Limit data access: Implement least-privilege access controls to restrict sensitive data to only those who need it.
- Conduct security audits: Regularly audit your infrastructure for vulnerabilities. Engage third party experts to perform penetration tests and simulate attacks to identify and address weak points.
Finally, you should have in place a robust cyber-insurance policy, which can help mitigate the financial impact of a breach. A comprehensive policy should cover:
- Forensic investigations
- System remediation and restoration
- Legal and regulatory compliance
- Business interruption losses.
Top 10 laws for 2025
With 2025 now upon us, so is a slew of new laws and regulations that will affect California businesses.
Every year, laws passed by the state Legislature and signed into law by the governor take effect, and 2024 was a busy legislative session in Sacramento. The end result is another round of new legislation that California employers need to stay on top of.
This item is the first of two parts, highlighting the top 10 laws and regulations affecting California businesses in 2025.
1. ‘Captive audience’ meetings barred
Starting Jan. 1, California employers are prohibited from requiring employees to attend “captive audience” meetings where the employer shares its opinions on political or religious matters.
This includes topics such as unionization, legislation, elections or religious affiliations. Under the new law, SB 399, employees who choose not to attend must still be paid for their regular work time during these meetings.
Employers are also barred from retaliating, discriminating or taking any adverse action against employees who opt out.
The law applies broadly to most employers, but does include some exceptions, including religious organizations, political organizations and educational institutions providing relevant coursework. The law also allows for required communications or training mandated under laws related to workplace safety, civil rights or job performance.
Employers who violate SB 399 could face significant consequences, including a civil penalty of $500 per employee, per violation. Workers who believe their rights were violated can file a complaint with the Labor Commissioner, seek injunctive relief (a court order to stop the violation), and potentially claim additional damages through civil lawsuits.
2. ‘Egregious‘ offenders
Cal/OSHA is working on new rules that would crack down and step up enforcement and penalties against California employers that commit “egregious” and “enterprise-wide” workplace safety violations.
The forthcoming rules, expected to take effect this year, would impose substantial penalties on companies that have “shown a disregard towards California workplace safety regulations and the well-being of their employees.”
A business cited for an egregious violation could be fined up to $158,000 “per instance,” meaning it can be applied for each employee exposed to the violation and across multiple locations.
Violations that could be considered “egregious” include, but are not limited to, the following:
- The employer, intentionally, through conscious, voluntary action or inaction, made no reasonable effort to eliminate the known violation.
- The employer has a history of one or more serious, repeat or willful violations, or more than 20 general or regulatory violations per 100 employees.
- The employer intentionally disregarded its health and safety responsibilities, such as by failing to maintain an effective Injury and Illness Program or ignoring safety and health hazards.
3. Expanded paid sick leave
Two bills have expanded the use of paid sick leave.
The more far-reaching measure, AB 2499, expands current state law that allows employees who are victims of crime or abuse to take time off for court appearances, treatment and various other reasons.
The new measure also expands the use of paid sick leave to cover certain “safe time” absences for issues like:
- Domestic violence,
- Sexual assault,
- Stalking, or
- An act, conduct or pattern of conduct that includes:
- An individual causes bodily injury or death to another.
- An individual exhibits, draws, brandishes or uses a firearm or other dangerous weapon, with respect to another.
- An individual uses or makes a reasonably perceived or actual threat of use of force against another to cause physical injury or death.
AB 2499 also permits workers to take time off to help family members who are victims of a crime.
The law protects workers from the threat of discrimination or retaliation for requesting or taking the time off. Under the new law, employees can use vacation, personal leave, paid sick leave, or compensatory time off that is available to them for safe-time absences. It applies to workplaces with 25 or more staff.
The second measure, SB 1105, allows agricultural workers to use accrued paid sick leave to avoid smoke, heat or flooding conditions created by a local or state emergency, like a heatwave, wildfire or flooding.
The measure states that this is a clarification that existing law allows workers to take sick days for preventive care.
4. Freelance Worker Protection Act
Starting this year, California’s Freelance Worker Protection Act imposes new requirements on businesses hiring freelance workers for professional services worth $250 or more.
The law requires employers to provide freelancers with a written contract outlining key details, including the services provided, payment amounts and deadlines for compensation. If no payment date is specified in the contract, freelancers must be paid no later than 30 days after completing their work.
Businesses cannot require freelancers to accept less pay than agreed upon or provide additional services after work has begun as a condition for timely payment.
Importantly, the law also prohibits retaliation against freelancers who assert their rights, such as raising complaints about violations or seeking enforcement of the law.
Noncompliance can lead to significant penalties. If a written contract is not provided, employers may face a $1,000 penalty.
Late payments can result in damages up to twice the amount owed, while other violations may require businesses to pay damages equal to the value of the contract or the work performed — whichever is greater. Freelancers can also file lawsuits to recover unpaid amounts and seek attorney’s fees.
5. Indoor heat illness
These new requirements actually took effect at the end of last summer, so 2025 is the first full year they’ve been in effect.
Cal/OSHA’s indoor heat illness prevention rules require employers to protect workers in indoor workplaces when temperatures reach 82 degrees Fahrenheit or higher. These regulations apply to most indoor settings, but will mainly affect restaurants, warehouses and manufacturing facilities.
At 82 degrees, employers must ensure workers have cool, potable water nearby and access to a cool-down area where temperatures remain below 82 degrees. Workers should be encouraged to take rest breaks to prevent heat-related illness, and monitored for symptoms during these breaks. If clothing restricts heat removal or radiant heat sources are present, these measures apply immediately.
At 87 degrees, employers must take additional steps, when feasible, such as cooling work areas, providing personal heat-protective equipment and implementing work-rest schedules.
Affected employers should evaluate options like installing air conditioning to maintain safe temperatures. While this is feasible for smaller spaces, larger facilities like warehouses may require alternative compliance strategies.
6. PAGA reform
In July 2024, Gov. Newsom signed into law two measures aimed at curbing rampant abuse of the Private Attorney General Act, which has become a costly thorn in the side of businesses in California.
PAGA allows workers who allege they have suffered labor violations, like unpaid overtime or being denied mandatory meal and rest breaks, to file suit against their employers rather than take the more typical route of filing a claim with the state Department of Labor Standards Enforcement.
The new laws aim to reward employers with reduced penalties if they address in good faith issues raised by an employee.
For example, the reforms cap the assessment at 15% of the available penalty for employers that take immediate and proactive steps to bring themselves into compliance with California Labor Code. Employers that take “reasonable” steps to address issues within 60 days of receiving a PAGA notice would face a maximum penalty of 30% of the available penalty under the law.
The new PAGA also requires a worker to personally experience violations alleged in a claim if they want to bring action. It also increases workers’ share of awards to 35%, from 25%. The rest of the funds go to the Labor & Workforce Development Agency.
However, legal pundits predict the changes won’t reduce the amount of PAGA lawsuits being filed in the state.
7. Family leave change
A new law, AB 2123, bars employers from requiring that workers who plan to take time off under the state’s Paid Family Leave Program first take up two weeks of accrued vacation time before benefits kick in.
8. Driver’s license queries
Starting in 2025, employers are barred from listing in help-wanted ads and job applications that having a driver license is a prerequisite for a job, unless the employer:
- Reasonably expects that driving will be part of the job, and
- Reasonably believes that allowing the employee to use alternative forms of transportation (including ride-sharing, taxi or bicycle) would take more time or require the business to incur higher costs.
9. Poster updates
Employers have to update two mandatory work posters this year.
The standard poster that informs employees about their rights under workers’ compensation laws, needs to be updated. The new poster must include language stating that employees may consult with an attorney for advice about workers’ comp law and that they may have to pay attorneys’ fees if they hire a lawyer as part of their claim.
Also, businesses are required to post an updated paid leave law notice to reflect the changes ushered in by AB 2499, the paid leave law for crime and abuse victims discussed above.
10. Minimum wage
California’s minimum wage increased to $16.50 an hour on Jan. 1. This rate is for all areas of the state, except for those jurisdictions that have implemented their own minimum wage to reflect the higher cost of living in their area.
To Avoid Sexual Harassers, Start with Hiring Process
With sexual harassment and other bullying behaviors receiving more attention, and with lawsuits increasing, employers have been busy updating or creating anti-harassment policies and training their employees.
Besides the fallout from having sexual harassment occur in your workplace, employers may be targeted in “negligent hiring” charges if victims of on-the-job harassment file suit. That’s why much of the conversation among human resources specialists and risk managers is avoiding hiring harassers, or potential harassers, in the first place.
But how do you identify a harasser during the hiring process, and how far can you go to make sure that you don’t employ one? Dr. John Sullivan, an HR pundit from Silicon Valley, recommends the following methods for screening out potential offenders, and that these checks should only be done for finalist candidates.
Develop a set of indicators — Dr. Sullivan recommends that you develop a set of indicators — or traits — of previous problem employees in the workplace, particularly their attitudes about certain subjects and workplace culture. Besides your own indicators, you can conduct your own research and learn from other companies and what they have found are signs that point to potential harassers.
Toxic-employee indicators
- Professionals who are notably overconfident about their technical proficiencies are 43% more likely to engage in toxic behavior.
- Self-proclaimed “rule followers” are 33% more likely to be problem employees.
Armed with this kind of data, you can formulate questions that will help you ascertain if a candidate is overconfident about their technical proficiency or claims they are a rule follower.
Source: Cornerstone OnDemand
Employee referrals — You should allow employees to refer candidates they have worked with in the past for open positions. Based on prior experience working with someone, your current employees will know what kind of person the prospect is in the workplace.
Conduct peer interviews — You may want to consider having finalist candidates be interviewed by their future colleagues, particularly the ones who will work closely with them.
Those future colleagues probably have the most vested in identifying harassers, since they are likely the ones to be most affected if they turn out to be toxic.
You can help your employees by asking them to look for the aforementioned indicators that you have developed.
Create social interactions — Companies like Zappos and Southwest Airlines try to put top candidates in social situations that they can observe. Zappos, for example, sets up social events like coffee sessions and after-work activities. Instead of hiring managers watching them, they have other employees observe the candidates in more buttoned-down situations when their guards are down.
Situational questions — For the most part during interviews you will have to finesse the process of trying to extract information.
Dr. Sullivan recommends questions like: “In a situation where you yourself were actually witnessing sexual harassment, what would you do?”
Then you could look for things they didn’t mention, like “reporting the incident.”
Situational questions can reveal a lot about a person’s moral fiber.
Use behavioral and personality tests — Off-the-shelf behavioral and psychological tests aren’t specifically designed to weed out harassers, but they can be indicators of how job candidates treat others. These tests assess people on:
- Civility
- Integrity
- Emotional intelligence
- Values
- Moral character
- Ethics
- Conscientiousness, and more
Some of these factors can indicate a problem employee.
The final step — after hiring
Dr. Sullivan recommends that you continue to assess new employees in the months after they are hired and still on probation. You can better evaluate them during their probation, when it’s easier to let someone go.
You can gauge them to see if they meet your behavior or value standards.