Cyber Insurance for Small Business: What It Covers, What It Does Not and What Insurers Ask For

What cyber insurance is for

Cyber insurance is designed to reduce the financial shock of a digital incident. A ransomware attack, a data breach or a fraudulent payment can create costs very quickly: forensic investigators, legal advice, notification letters, lost sales while systems are down and, in some cases, claims from customers. Few small businesses have that cash available at short notice.

Insurance does not stop attacks. It is a way to transfer part of the financial risk after you have taken reasonable steps to prevent them. Think of it as one layer in a plan that also includes controls, backups and a response plan.

Typical coverage areas

Policies vary a great deal in wording, limits and sub-limits, so read yours rather than relying on a summary. Common components include the following.

• Incident response: forensic investigation, crisis support, legal advice and sometimes public relations
• Data restoration: the cost of recovering or recreating data and systems
• Business interruption: income lost while systems are unavailable, often after a waiting period
• Cyber extortion: negotiation support and, in some policies, ransom-related costs where lawful
• Privacy liability: costs related to claims or regulatory proceedings after a breach
• Funds transfer or social engineering fraud: sometimes offered as an extra with limits

Exclusions and traps

Exclusions are where surprises appear. Common ones include prior known incidents, failures to maintain agreed security controls, war or state-sponsored attack clauses, betterment costs (improving systems beyond their previous state), losses from unencrypted devices or from fraud in which a person was tricked into authorising a payment unless extra cover was bought.

Check sub-limits too. A policy might state a large overall figure but cap social engineering fraud or ransom costs at a much lower amount. Ask the broker to walk you through examples of claims that would and would not be covered, in writing.

What insurers ask for

Applications now ask detailed security questions because insurers have paid heavily for preventable incidents. Expect questions about the controls below. You should answer accurately, since a claim may be disputed if the answers were wrong.

• Multi-factor authentication on email, remote access and administrator accounts
• Regular, tested backups kept separate from the main network
• Endpoint protection on all computers and servers
• Patching practices and whether any end-of-life software is in use
• Staff security awareness training and phishing procedures
• An incident response plan and who is responsible
• Controls for payment changes, such as call-back verification

Choosing a policy

Use a reputable broker who works with several insurers, and give them accurate information about your size, revenue, data types and security. Compare coverage, limits, retention (the excess you pay), waiting periods for business interruption and the insurer's incident response panel.

Ask how to report an incident and how quickly, since many policies require prompt notice and use of approved responders. Store the claim hotline where you can reach it even if your systems are down.

Questions to put to a broker

A good broker will welcome detailed questions. Bring a list and keep the answers in writing.

• What is the retention, and does it differ by type of claim?
• How long is the waiting period before business interruption cover starts?
• Are ransom payments covered, and are there legal or sanctions restrictions?
• Is social engineering or invoice fraud covered, and with what limit?
• Do I have to use the insurer's panel of response providers?
• What security conditions must I maintain for the policy to remain valid?
• How and when must an incident be reported?

Use the application as a roadmap

The questionnaire is a free checklist of what the industry considers essential. If you cannot answer yes to MFA, backups or endpoint protection, those are your priorities, regardless of whether you buy a policy. Improving your controls can also lower your premiums or widen your options at renewal. Review your policy annually and whenever your business changes materially, such as adding online sales, new data types or new suppliers.