Cyber Liability Insurance: Is Your Business Exposed?

Nearly every modern business has some form of cyber exposure.

A company does not need to be a technology company to depend on computers, email, cloud software, electronic payments, customer records, payroll systems, websites, or connected devices.

If those systems are disrupted or sensitive information is compromised, the financial consequences can extend far beyond replacing a computer.

Cyber insurance is designed to address certain costs and liabilities associated with cyber incidents, data breaches, ransomware, network failures, and related events, subject to the specific policy.

First-party coverage can address losses experienced directly by the insured business. Depending on the policy, this may include incident response, forensic investigation, data restoration, business interruption, cyber extortion, notification costs, and crisis management.

Third-party coverage can address certain claims brought by customers, employees, vendors, or other parties alleging harm from a privacy breach, network security failure, or other covered event.

Policies vary significantly. Coverage may also be available for social engineering, funds transfer fraud, computer fraud, media liability, regulatory proceedings, dependent business interruption, or technology errors and omissions.

Those terms should not be assumed to mean the same thing from one carrier to another. Sublimits, waiting periods, exclusions, security requirements, and definitions can materially affect coverage.

Insurance is only one part of cyber risk management.

Businesses should use multifactor authentication where appropriate, maintain secure backups, keep systems updated, train employees to recognize phishing attempts, limit user access, protect payment information, and have a written incident response plan.

Vendor risk matters too. A business can be affected when a payroll provider, cloud platform, payment processor, software vendor, or other third party experiences an incident.

The cyber insurance application should be completed accurately. Insurers increasingly evaluate security controls when deciding whether to offer coverage and on what terms.

Businesses should periodically review what information they hold, how critical their systems are, what a day or week of downtime would cost, and what outside resources would be needed after an attack.

Cyber risk changes quickly. Coverage and security practices should be reviewed regularly rather than treated as a one-time purchase.