Businesses of all sizes need to protect themselves from cyberattacks. While data breaches are often associated with large corporations, they can also financially devastate small businesses. One breach can cost tens of thousands of dollars, known as ransomware settlements. The volume of risks makes actuarial calculations difficult.
Limits
A business’s insurance premiums for cyber liability may vary depending on the level of coverage purchased, the number of people with access to data and how many servers it owns. Some insurers may charge more for a policy if the business has a history of making cyber-related claims.
It’s also important for small businesses to know the limits available under a cyber policy. For example, a cyber liability policy might cover up to $1 million per occurrence in case of a loss or theft of customer information. However, the cost of a data breach is usually much more than that, and a small business needs enough protection.
Most policies will also include privacy liability coverage, designed to protect a business from a lawsuit related to handling sensitive data. The policies may also help pay for crisis services such as forensic investigations, customer notification and public relations.
Some insurers may also offer network extortion coverage, which can provide money in the event of an attempt to extort data or other valuable assets from a company.
However, some policies exclude these types of losses unless the insured meets minimum security standards set by the insurer or industry standards, which can be difficult for small business owners to meet.
Cybersecurity professionals like Fortinet recommend establishing security protocols to eliminate the need to pay ransomware settlements, which general liability insurance providers don’t account for in their policies.
Coverage
Cyber liability policies cover losses resulting from a data breach, such as the cost of notifying affected parties and providing credit monitoring services. They can also include the cost of legal fees and defending against regulatory proceedings.
Additionally, they can consist of the cost of restoring lost files and income. They can also cover the costs of hiring call centers to handle customer inquiries and IT forensic experts to examine the attack. In addition, some policies may offer ransomware settlement coverage.
First-party coverage is the most common type of cyber insurance covering damages from a data breach or cyberattack. It includes damage to digital assets, such as websites or photo files. And It can also cover repairing or replacing hardware and software damaged by a cyberattack.
It can also include the cost of providing business continuity services, such as renting temporary space or a data center. Second-party cyber insurance protects businesses from claims arising from third-party data breaches. For example, if a company you work with experiences a data breach and their sensitive information is stolen, you can be sued.
This coverage can pay for legal fees, public relations expenses, and even hiring a lawyer to defend your company from regulatory investigations or lawsuits. In addition, some third-party cyber liability policies can also cover the cost of restoring your lost data.
Exclusions
Like all insurance policies, cyber liability policies have exclusions and limitations that should be understood. Since large payouts to victims of cyber events are expensive for insurers, they try to limit losses by adding these limits and exclusions.
These include requiring high retentions or co-insurance, limiting coverage for systemic events by imposing a 72-hour indemnity period, eliminating coverage for extortion loss if controls are not upgraded or improved, and excluding coverage for reputational damage following a cyber event.
The most common exclusion in a cyber policy is the BI/PD (bodily injury/property damage) limitation. It is understandable, as separate commercial general liability policies generally cover physical injuries.
However, this limitation should be carefully analyzed to ensure that it does not prevent an insured from being reimbursed for replacing technology equipment rendered useless by a cyber attack or a data breach.
Another potential exclusion is the intellectual property (IP) exclusion. Protecting this data is vital because most organizations rely on their IP for financial success. This exclusion should be carefully analyzed, and the wording should be negotiated to ensure that it does not preclude reimbursement for lost profits due to a cyber incident that results in a loss of IP.
Other common exclusions include those related to employment practices and statutory violations. While it is understandable that the employment practice and statutory violations exclusions are important, these should be scrutinized to ensure that they do not exclude coverage for replacing technology equipment and the cost to improve security and data encryption protocols.
Payment options
For example, if your web design business suffers a data breach and loses its client’s data, you could face fines from state regulators. Cyber liability coverage can help pay those fines.
The cost of your policy will vary based on factors such as your business’s risk profile and claims history. You can get more details about these policies by working with an independent insurance agent.
Those looking for more comprehensive protection against the financial consequences of a cyberattack should consider first-party and third-party coverages. These policies can cover a company’s monetary losses and damages to the data of customers or partners, including legal fees and customer notification costs.
They can also include reimbursement coverage, which reimburses a company for its expenses after a cyber incident occurs. Many insurance companies offer different cyber policies that provide different levels of protection, and prices can fluctuate based on market conditions.
Some insurers may charge higher premiums if they have experienced significant losses, while others can lower them if they have low claim experience.
Ultimately, the type of cyber liability coverage your company needs depends on its industry and risk profile. Businesses that store customer data or other sensitive information should consider first-party cyber coverage.
In contrast, those primarily working with professionals who might be sued for negligence or oversight should consider third-party coverage. These policies are often bundled together as technology errors and omissions insurance (tech E&O), which is designed to protect professional services providers from lawsuits over their work.
