Editorial · April 6, 2018
Cyber Insurance: What It Covers for Small Firms
Cyber insurance is a special policy that helps a business pay for the costs of a data breach or a computer attack. Most small firms assume their regular business policy already covers this. The National Association of Insurance Commissioners (NAIC) says most standard commercial policies do not cover many cyber risks. This guide explains what a cyber policy may pay for, what it may leave out and what to ask before you sign.
What cyber insurance is
A general liability policy protects a business from injury and property damage. A cyber policy is a separate product built for digital risks. The NAIC notes that the market is fairly new. Insurers have little past data to judge cyber risk, so policies are often tailored and can cost more than other lines.
The National Institute of Standards and Technology (NIST) compares cyber insurance to other cover you may carry, such as flood or fire. It says a policy may help you respond to and recover from a security incident. Some insurers also offer security advice and help you find where you are weak.
What a policy may cover
The NAIC lists several types of cover that a cyber policy might include. Not every policy has all of them, so read each one closely.
Breach liability. This applies when private data is lost, or when someone gets into your systems because you failed to stop them. Breach response costs. These include telling affected customers, running a help line and paying for credit monitoring.
Data restoration. This pays to restore, update or replace business data stored electronically. Business interruption. This covers lost income and extra expense when a breach or attack stops normal work.
Media liability. This covers claims such as libel, slander or copyright infringement that come from your website, social media or print material. Cyber extortion. This covers costs tied to threats to damage your systems or data unless you pay.
Risks the policy is meant to address
The NAIC describes the harm a cyber event can cause. Thieves can steal Social Security numbers, card numbers and other personal data. A hacker can shut down a network and stop your sales. Malware can damage your records. A worker can also email private data to the wrong person by mistake.
The NAIC adds that a breach can hurt your reputation and that valuable digital assets, such as customer lists and trade secrets, can be stolen. Many of these losses are not paid by a standard policy. That gap is why a separate cyber policy exists.
Common gaps and exclusions to watch
Policies differ a great deal, and no list fits every contract. Still, the NAIC says current policies may not fully cover cyber risks, and it expects the products to change as buyers learn more. Treat the wording as the final word, not the sales brochure.
Look for limits on how much the policy pays for each type of cost. Check whether the policy pays for lost income, or only for direct expenses. Ask whether mistakes by your own staff are covered, and whether the policy covers data held by a vendor on your behalf. Ask what the insurer expects you to do, such as keep software updated. A policy can be harder to use if you did not meet its stated conditions.
Questions to ask before you buy
NIST advises the same care you would give any insurance. Know your own risks first. Then research the insurer, the services it offers, the events it covers and its reputation, and make sure it can meet its promises.
Be ready for the application. The NAIC says insurers will probably ask for your disaster response plan and look at how you protect your network, website and other assets. They will want to know who can reach your data and what antivirus, anti-malware and firewall tools you use, and how often you update them.
Use this short list with your agent. What exactly is covered, and what is excluded? What are the limits and the deductible? Does the policy pay for notifying customers and for credit monitoring? Does it pay for lost income during downtime? Who do we call first when something goes wrong?
Insurance is only one layer
A policy pays for some costs after a problem. It does not stop the problem. NIST puts cyber insurance in the Recover part of its small business guidance. Its earlier steps, such as knowing what data you hold, limiting who can reach it, patching software, using firewalls and making regular backups, come first.
Do those basics, then price a policy. A firm with a written plan and good habits has a better story to tell an insurer, and it faces fewer losses to claim.
Sources
- NAIC Center for Insurance Policy and Research, Cybersecurity: naic.org/cipr_topics/topic_cyber_risk.htm
- NIST Interagency Report 7621 Rev. 1, Small Business Information Security: The Fundamentals, November 2016: doi.org/10.6028/NIST.IR.7621r1