Cyber Insurance

Cyber insurance can combine financial protection with access to specialist professionals who help a business investigate, contain and recover from an insured digital incident.

The exact protection varies between policies, but cover can include forensic investigation, system restoration, data breach management, legal assistance, cyber business interruption and liability arising from certain privacy or network security incidents.

Some policies also provide access to cyber security specialists, lawyers, public relations advisers and incident response teams. Reviewing these services alongside the financial limits is important because rapid professional assistance can be valuable when an organisation is dealing with an active cyber event.

No. Smaller organisations can be highly dependent on technology despite having fewer employees, smaller IT departments and lower turnover. A business may rely entirely on email, cloud software, digital accounting systems or an online booking platform to operate normally.

Cyber criminals can also target smaller organisations because they may have fewer technical resources available to detect and prevent attacks. Automated attacks do not necessarily distinguish between a multinational business and a small local company.

The potential consequences should therefore be considered in relation to the business itself. Several days without access to orders, customer records, emails or essential applications could create a serious problem even for a relatively small operation.

A suspected data breach can require several different specialists to become involved quickly. Before determining the full consequences, the business may need to establish what information was affected, how the breach occurred and whether unauthorised access is continuing.

Cyber insurance may provide access to forensic investigators and legal advisers who can assist with the response. Eligible expenses relating to customer communications, notification, specialist support and the management of affected individuals may also be included.

Liability protection can be particularly relevant if another person or organisation alleges that the insured business failed to protect confidential information appropriately. The precise circumstances covered will depend upon the insurer and policy wording.

A ransomware attack can restrict access to files, servers or individual computers and may cause significant disruption while the incident is investigated. Businesses can also face uncertainty about the extent of the compromise and whether information has been copied by the attacker.

Cyber insurance may provide specialist incident response assistance to help investigate, contain and recover from an insured attack. Depending on the cover arranged, this may include forensic work, data restoration and certain business interruption losses.

Ransomware cover is often subject to policy conditions and security requirements. Businesses should therefore provide accurate information about backups, access controls, software updates and other security arrangements when applying for insurance.

Cyber business interruption cover can provide protection when an insured cyber event disrupts essential technology and causes the business to lose income.

For example, an ecommerce company may be unable to accept orders, a professional firm might lose access to case files or a manufacturer could experience disruption because network-connected production systems cannot operate normally.

Policies generally define how interruption losses are calculated and may contain an initial waiting period before cover applies. The indemnity period and maximum financial limit should reflect how long the organisation could realistically need to recover from a serious event.

Cyber insurance primarily addresses risks arising from computer systems, data, network security and digital incidents. Crime insurance is generally concerned with financial losses caused by dishonest or fraudulent activity.

The distinction becomes particularly important with phishing and social engineering. A criminal may compromise an email account or impersonate a director and convince an employee to make what appears to be a legitimate payment.

Although technology was used to facilitate the fraud, the resulting transfer of money may not automatically fall within standard cyber cover. Businesses concerned about this exposure should check whether cybercrime, social engineering or separate crime protection is included.

Insurers increasingly consider the controls a business has in place before offering cyber cover. Questions can vary according to the organisation’s size, industry, turnover, data exposure and the limits requested.

You may be asked about multi-factor authentication, password management, employee access, data backups, software patching, antivirus or endpoint protection and the security of remote connections.

An insurer may also want to understand how sensitive information is stored, whether employees receive cyber awareness training and what procedures exist for responding to a security incident. Accurate answers are important because the terms offered can depend upon the controls declared during the application process.

Businesses increasingly depend upon external technology providers for email, data storage, payment processing, accounting, customer management and many other day-to-day functions.

Some cyber policies provide protection where an insured interruption affecting a specified third-party technology provider causes financial loss to the policyholder. This is often referred to as dependent or contingent business interruption.

The scope can vary significantly. Businesses that depend heavily on cloud platforms, outsourced IT providers or specialist software should discuss those dependencies when arranging cover rather than assuming every external service will automatically be protected.

The first priority is usually to follow your organisation’s incident response procedures and take appropriate steps to prevent further damage. Avoid deleting evidence or making significant changes to affected systems unless advised to do so by an appropriate specialist.

If cyber insurance is in place, the insurer’s incident response service should normally be contacted as quickly as possible. Policies can include specific reporting requirements, and using approved professionals may be necessary for certain costs to be covered.

Keep records of what happened, when the incident was discovered and the actions taken. Where personal information, financial information or other sensitive data may have been affected, appropriate professional advice can help the business determine its next steps.

A cyber insurance application usually begins with general information about the organisation, including turnover, business activities, employee numbers and the type of customers or clients served.

Further questions may examine the volume and sensitivity of information handled, payment card exposure, computer systems, cloud services, previous cyber incidents and the security controls used to protect accounts and devices.

Insurers can request more detailed information for businesses with larger technology exposures or higher cover requirements. Providing an accurate picture of your systems and procedures allows suitable terms to be considered and reduces the risk of misunderstandings about the cover being arranged.