Small businesses use technology every day to communicate with customers, process payments, store information, and manage their operations. If an email account, computer system, or cloud-based service is compromised, the business may face expenses related to investigating the incident, restoring data, notifying affected individuals, and responding to claims.
Cyber liability insurance is a type of business insurance that may help with certain losses and expenses resulting from a covered cyber incident. Whether it is appropriate for a particular business depends on its operations, the information it handles, its dependence on technology, and the coverage available through its insurer.
What Is Cyber Liability Insurance?
Cyber liability insurance is designed to address certain risks involving computer systems, electronic information, and technology-dependent operations.
Depending on the policy and circumstances, cyber insurance may respond to covered events involving:
- Data breaches
- Unauthorized access to computer systems
- Ransomware and other malicious software
- Compromised email accounts
- Loss or corruption of electronic data
- Certain technology-related business interruptions
- Claims involving confidential or personal information
Coverage varies considerably among carriers and policies. Limits, deductibles, waiting periods, exclusions, security requirements, and endorsements can all affect whether a particular incident is covered.
First-Party and Third-Party Cyber Coverage
Cyber policies commonly include first-party coverage, third-party coverage, or a combination of the two.
First-Party Coverage
First-party coverage may help with certain losses and expenses the insured business experiences directly after a covered cyber incident.
Depending on the policy, this could include:
- Forensic investigation expenses
- Data restoration costs
- Customer or employee notification expenses
- Credit-monitoring services for affected individuals
- Certain legal and public-relations services
- Covered business interruption losses
- Certain cyber-extortion expenses
Third-Party Coverage
Third-party coverage may help respond when another person or organization alleges that the insured business caused harm through a covered cyber incident.
For example, a customer might claim that a business failed to protect confidential information. Depending on the policy, third-party coverage may help with certain legal expenses, settlements, regulatory proceedings, or other covered costs.
Cyber policies may treat ransomware, fraudulent transfers, social-engineering scams, and incidents involving outside vendors differently. Some protection may require a separate endorsement or compliance with specific security requirements. A business owner should review the actual policy rather than assuming every event involving a computer or email account is covered.
Does a Small Business Need Cyber Insurance?
A business does not have to be large or operate entirely online to have cyber exposure.
Cyber liability insurance may be worth discussing if your business:
- Stores customer or employee information
- Accepts online or electronic payments
- Uses email to communicate with customers or vendors
- Relies on cloud-based software
- Stores confidential client information
- Offers online scheduling or customer accounts
- Depends on technology to maintain daily operations
- Uses outside vendors to process or store information
- Has contracts requiring cyber coverage
Consider a small professional-services firm that stores confidential client information electronically. If an employee’s email account is compromised, an unauthorized person could gain access to private information or send fraudulent messages from that account.
The business might then face expenses related to investigating the incident, restoring access, notifying affected individuals, obtaining legal guidance, and responding to claims. Whether cyber insurance would help with those expenses depends on the coverage, exclusions, policy requirements, and circumstances of the incident.
Is Cyber Coverage Included in General Business Insurance?
Not necessarily.
A business may carry general liability, commercial property, or other business insurance without having meaningful protection for cyber incidents. Most traditional commercial policies were not designed to address the full range of risks created by data breaches, compromised systems, and technology-dependent operations.
A Business Owner’s Policy, or BOP, also does not automatically cover every cyber-related loss. Cyber coverage may instead be offered through:
- A separate cyber insurance policy
- An endorsement added to another business policy
- A limited cyber coverage option included by a carrier
- A combination of different policies and endorsements
The extent of the coverage can vary substantially. A limited endorsement may not provide the same protection, services, or limits as a dedicated cyber policy.
Our guide on what a Business Owner’s Policy covers explains the protections commonly included in a BOP and where additional coverage may be needed.
If you are reviewing your commercial insurance options, cyber liability coverage may be worth discussing as part of that review.
How Much Cyber Insurance Does a Small Business Need?
There is no single coverage amount that works for every small business.
When evaluating possible limits and deductibles, consider:
- The type and amount of information the business stores
- The sensitivity of customer or employee information
- How dependent the business is on technology
- Whether the business processes electronic payments
- How long the business could operate without its systems
- Potential data-restoration and notification expenses
- Contractual requirements from clients or vendors
- The number of individuals who could be affected by a breach
- The business’s existing insurance policies
- Available limits, deductibles, and coverage options
An insurer may also evaluate the business’s cybersecurity practices when determining eligibility, pricing, limits, or policy requirements.
Questions to Ask About Cyber Insurance
When comparing cyber coverage, consider asking:
- Does the policy include first-party coverage, third-party coverage, or both?
- Are incidents involving vendors and cloud-service providers addressed?
- How does the policy treat ransomware and cyber extortion?
- Is social-engineering or funds-transfer fraud included?
- What qualifies as a covered business interruption?
- Does business interruption coverage extend to outages involving outside technology providers?
- What cybersecurity practices must the business maintain?
- Is multi-factor authentication required?
- Is prior approval required before hiring legal counsel, forensic specialists, or notification vendors?
- Does the insurer provide access to an incident-response hotline?
- Are regulatory proceedings, fines, or penalties addressed when legally insurable?
- What limits, deductibles, waiting periods, and exclusions apply?
The answers can help a business owner compare more than the premium and understand how a policy may respond during an actual incident.
Cyber Insurance Does Not Replace Cybersecurity
Insurance should be one part of a broader risk-management strategy rather than a substitute for sound cybersecurity practices.
The U.S. Small Business Administration recommends assessing business vulnerabilities, training employees, securing email and information systems, and creating a cybersecurity plan. Other important safeguards may include:
- Using multi-factor authentication
- Keeping software and operating systems updated
- Training employees to recognize suspicious emails
- Limiting access to sensitive information
- Maintaining dependable and secure backups
- Creating an incident-response plan
- Reviewing the security practices of outside vendors
Businesses whose operations change throughout the year may also benefit from reviewing these seasonal business risks and insurance coverage tips.
Cybersecurity practices may reduce the likelihood or severity of certain incidents. They may also affect the coverage or terms an insurer is willing to offer.
Review Cyber Risks as Your Business Changes
A business’s cyber exposure can change as it grows.
Consider reviewing your coverage when your business:
- Begins accepting online payments
- Adds employees or contractors
- Adopts new software
- Starts storing additional customer information
- Offers online appointments or customer portals
- Changes payment processors or technology vendors
- Expands remote work
- Signs a contract with new insurance requirements
- Experiences a cyber incident or attempted attack
A policy that fit the business several years ago may not reflect its current technology, information, or contractual responsibilities.
Protecting Your Business From Digital Risks
Cyber liability insurance may help with certain expenses and claims arising from a covered cyber incident, but the details of the policy matter. First-party coverage, third-party coverage, ransomware protection, business interruption, vendor incidents, and social-engineering fraud may all be handled differently.
For Colorado small-business owners, the appropriate coverage depends on how the business operates, the information it stores, the technology it uses, and the safeguards already in place.
Warrior Insurance and Services Group works with multiple insurance carriers, giving business owners options when reviewing their coverage. If you are evaluating your business insurance options, ask how cyber liability insurance may fit alongside the policies you already carry.
