Cyber Insurance for Small Business: Coverage, Gaps and Preparation

First-party coverage may help with eligible investigation, data restoration, business interruption, legal guidance, notification and crisis response costs following a covered cyber event.

Check whether the insurer requires you to use approved incident-response vendors, obtain consent before incurring expenses, or call a hotline immediately after discovery.

A third-party cyber provision may respond to certain claims from customers or others following a data breach or security event, including defense costs where the contract provides them.

A contract may treat privacy claims, network-security claims and contractual liability differently. Ask which legal expenses are inside the policy limit and which are outside it.

Ransomware-related coverage can vary widely by form, conditions and applicable law. Some policies cover specified response costs; others exclude or restrict certain losses or payments.

Consult qualified response professionals and legal advisers before deciding on any ransom demand. Paying does not guarantee that data or systems will be restored.

Insurers may review multi-factor authentication, patch management, access restrictions, backups, employee training and incident-response planning.

Be accurate in applications. A policy cannot compensate for a lack of basic controls, and materially incorrect answers may create problems during underwriting or claims.

Read definitions for computer fraud, social engineering, funds transfer losses, system outages, dependent business interruption and non-malicious failures.

Ask which coverage parts have separate deductibles, waiting periods or lower sublimits. A headline 'cyber limit' is not necessarily available for every type of loss.

Record how your business would identify an incident, preserve evidence, isolate affected systems when appropriate, contact advisers, assess notification obligations and restore critical services.

Use the FTC small-business security guidance and the NAIC's cyber-insurance research as starting points, then tailor your plan to your actual sector, jurisdiction and systems.