MANION, Circuit Judge.

While employed at an accounting firm, Jeanne Hentz had a compact disc belonging to the firm stolen from her personal vehicle which was parked at her house. The compact disc contained confidential information belonging to some of her employer's clients. Those clients sued Hentz in Illinois state court for credit monitoring and insurance expenses incurred to mitigate potential misuse of the stolen information. She tendered the defense of the state action to her homeowner's insurance company, Nationwide Insurance Co. Seeking a declaration that it had no duty under Hentz's insurance policy to defend or indemnify her, Nationwide filed suit in federal court against Hentz and the clients seeking to hold her liable for the security expenses. The district court granted summary judgment in favor of Nationwide. The clients appeal. We affirm.

I. Factual Background

Hentz is an accountant employed by Kevin W. Bragee, CPA, LLC (the "Firm"). The Central Laborers' Pension Fund, Central Laborers' Welfare Fund, and Central Laborers' Annuity Fund (collectively, the "Funds") hired the Firm to perform accounting and auditing services. To perform those services, the Firm possessed a compact disc containing confidential and protected information, including the names, birth dates, and Social Security numbers of approximately 30,000 individual participants and beneficiaries of the Funds. The Firm agreed in writing to ensure that its employees and agents would safeguard the information on the compact disc. Thus, Hentz, who came into possession of the compact disc, had a duty to safeguard the confidential information on the disc as a condition of her employment.

At the end of a day at work, Hentz placed the compact disc in a laptop, put the laptop in her personal vehicle, and parked in the open at her residence. Unfortunately, the laptop containing the compact disc was stolen from Hentz's vehicle. In order to mitigate potential misuse of the confidential information, the Funds incurred nearly $200,000 in credit monitoring and insurance expenses. Seeking to recoup the cost of these security efforts, the Funds brought a state action in Illinois against Hentz alleging that she negligently breached duties she owed to the Funds.1 Hentz tendered the defense of the state action to Nationwide, which had written her homeowner's insurance policy (the "Policy").

Believing that the Policy did not cover the theft of the compact disc, Nationwide brought a federal diversity action against Hentz and the Funds seeking a declaration that it had no duty to defend or indemnify Hentz. Nationwide argued that Hentz's claim was not covered because the Policy does not cover "`[p]roperty damage' to property rented to, occupied or used by or in the care of the `insured'." Nationwide also relied upon language in the Policy stating that it does not cover "`property damage' arising out of or in connection with a `business' conducted from an `insured location' or engaged in by an `insured', whether or not the `business' is owned or operated by an `insured' or employs an `insured'." The Policy provides that this latter exclusion "applies but is not limited to an act or omission, regardless of its nature or circumstances, involving a service or duty rendered, promised, owed, or implied to be provided because of the nature of the `business'."

Nationwide and the Funds filed cross-motions for summary judgment. The district court concluded that the Policy's "in care of" exclusion applied and, consequently, that Nationwide had no duty to defend Hentz against the Funds' state action or to indemnify her for any resulting liability. Thus, the district court granted Nationwide's motion for summary judgment and denied the Funds' motion. The Funds appeal.

II. Discussion

The Funds contend that the district court erred in finding that the Policy's "in care of" exclusion applied. The Funds argue further that the Policy's "business" exclusion — which the district court did not address — does not apply either. The parties agree that the substantive law of Illinois governs this diversity action. "Under Illinois law, the interpretation of an insurance policy is a question of law that is properly decided by way of summary judgment." BASF AG v. Great Am. Assur. Co., 522 F.3d 813, 818-19 (7th Cir.2008) (citing Crum & Forster Managers Corp. v. Resolution Trust Corp., 156 Ill.2d 384, 189 Ill.Dec. 756, 620 N.E.2d 1073, 1077 (1993)). Thus, we review the district court's decision de novo. BASF, 522 F.3d at 819. In determining whether Nationwide has a duty to defend Hentz, we may only consider the allegations in the state complaint in concert with the provisions of the Policy. Id.; U.S. Fid. & Guar. Co. v. Wilkin Insulation Co., 144 Ill.2d 64, 161 Ill.Dec. 280, 578 N.E.2d 926, 930 (1991). We will find a duty to defend "[i]f the underlying complaint[] allege[s] facts within or potentially within policy coverage...." Wilkin, 161 Ill.Dec. 280, 578 N.E.2d at 930. If the relevant policy language is clear and unambiguous, it must be given its plain and ordinary meaning. Id. But all "doubts and ambiguities must be resolved in favor of the insured." Id.

Under Illinois law, an "in care of" exclusion like the one in the Policy applies only if two elements are met: the property lost or stolen was (1) within the exclusive possessory control of the insured at the time of loss; and (2) a necessary element of the work performed by the insured. See Stewart Warner Corp. v. Burns Int'l Sec. Servs., Inc., 527 F.2d 1025, 1029 (7th Cir.1975); Bolanowski v. McKinney, 220 Ill.App.3d 910, 163 Ill.Dec. 394, 581 N.E.2d 345, 348 (1991) (collecting cases).2

The state complaint alleged that Hentz, pursuant to her employment at the Firm, came into possession of the compact disc and had a duty to safeguard the confidential information that it contained. Hentz's possession of the compact disc and duty to safeguard the confidential information amount to the "exercise [of] some type of possessory control over the" compact disc. See Bolanowski, 163 Ill.Dec. 394, 581 N.E.2d at 349;3 see also Liberty Mut. Ins. Co. v. Zurich Ins. Co., 402 Ill.App.3d 37, 341 Ill.Dec. 363, 930 N.E.2d 573, 578 (2010) ("The passive duty of guarding the property gave [the insured] care, custody or control of the property, even without any direct contact with the stored goods."). That possessory control became exclusive, at least, when Hentz placed the compact disc in her personal vehicle that she parked at her residence. See Ins. Co. of N. Am. v. Adkisson, 121 Ill.App.3d 224, 76 Ill.Dec. 673, 459 N.E.2d 310, 312 (1984) (finding exclusive possessory control over property when insured "closed the trailer door"); Liberty Mut. Ins. Co., 341 Ill.Dec. 363, 930 N.E.2d at 576-78 (holding hotel's duty to safeguard guests' property located in a wall safe within the guests' hotel room establishes the exclusive-possessory-control element).4 Thus, the compact disc was stolen while it was within Hentz's exclusive possessory control. See Essex Ins. Co. v. Wright, 371 Ill.App.3d 437, 308 Ill.Dec. 991, 862 N.E.2d 1194, 1197 (2007) ("`[I]f the insured has possessory control at the time the property is damaged, the exclusion clause will apply.'" (quoting Country Mut. Ins. Co. v. Waldman Mercantile Co., 103 Ill.App.3d 39, 58 Ill.Dec. 574, 430 N.E.2d 606, 609 (1981))).

In their reply brief, the Funds additionally argue that the allegations in the state complaint failed to establish whether the compact disc was a necessary element of Hentz's work. "[I]t is well established that arguments raised for the first time in a reply brief are waived." Broaddus v. Shields, 665 F.3d 846, 860 (7th Cir.2011). In their opening brief, the Funds merely cite the two-element test as the controlling legal standard. But nowhere in their opening brief do they argue that the state complaint does not establish that the compact disc was a necessary element of Hentz's work. Nor do they claim that the district court's ultimate disposition was erroneous because the second element was not satisfied. The pertinent section of the Funds' opening brief analyzes only the first element, that is, whether Hentz had exclusive possessory control over the compact disc when it was stolen. Consequently, the Funds waived their argument concerning the second element.5

In any event, the Funds' argument fails on the merits because the allegations in the state complaint establish that the compact disc was a necessary part of Hentz's work. The state complaint avers that Hentz, as an accountant at the Firm, possessed the compact disc and had a duty to safeguard the confidential information contained on it. The Model Code of Conduct of the National Association of State Boards of Accountancy says that maintaining "confidentiality is vital to the proper performance of [an accountant's] professional activities." Nat'l Ass'n of State Bds. of Accountancy, Uniform Accountancy Act Model Rules, Art. 10, Principle VI (6th ed. July 29, 2011) ("A licensee has an obligation to maintain and respect the confidentiality of information obtained in the performance of all professional activities."); see also Ill. Admin. Code tit. 68, § 1430.3010; Am. Inst. of Certified Pub. Accountants, Code of Professional Conduct and Bylaws 1799, Rule 301 (June 1, 2011). Because the handling and care of confidential information is vital to Hentz's work as an accountant, the compact disc containing such information is a necessary, rather than incidental, element of her ordinary employment activities. See Stewart Warner Corp., 527 F.2d at 1030.6

In addition to the application of the Policy's "in care of" exclusion, the Policy's "business" exclusion also precludes coverage in this case. As noted above, the "business" exclusion does not cover "`property damage' arising out of or in connection with a `business' ... engaged in by an `insured', whether or not the `business' is owned or operated by an `insured' or employs an `insured'."7 The exclusion "applies but is not limited to an act or omission, regardless of its nature or circumstances, involving a service or duty rendered, promised, owed, or implied to be provided because of the nature of the `business'." The Funds do not dispute that the Firm is a "business" which employs Hentz, and that, according to the state complaint, Hentz had a duty to safeguard the confidential information on the compact disc because she was an accountant employed by the Firm. Hentz's failure to safeguard the compact disc was an omission amounting to a breach of that duty. Therefore, the Policy's "business" exclusion applies. See Allstate Ins. Co. v. Mathis, 302 Ill.App.3d 1027, 236 Ill.Dec. 19, 706 N.E.2d 893, 894 (1999) (holding that a "business" exclusion applied where the insured failed to fulfill a duty directly correlated to providing daycare services).

Based on our resolution of these issues, we conclude that Nationwide has no duty to defend Hentz against the Funds' state action. Accordingly, we decline to address the other arguments advanced by the parties relating to that question.

Finally, Nationwide's duty to indemnify is only triggered if Hentz is determined to be liable for damages in the underlying action. Bituminous Cas. Corp. v. Fulkerson, 212 Ill.App.3d 556, 156 Ill.Dec. 669, 571 N.E.2d 256, 260 (1991). Because Nationwide owes no duty to defend her against the Funds' state action, Nationwide owes no duty to indemnify her for liability stemming from that suit. Crum, 189 Ill.Dec. 756, 620 N.E.2d at 1081 ("Clearly, where there is no duty to defend, there will be no duty to indemnify....").

III. Conclusion

Because we hold that the "in care of" exclusion and, alternatively, the "business" exclusion from Hentz's insurance policy apply, Nationwide has no duty to defend Hentz against the Funds' state action. Consequently, Nationwide has no duty to indemnify Hentz should that state action go against her. Therefore, the district court's judgment is AFFIRMED.