Cyber insurance questions

Insurance that pays for a business's own costs after a cyber incident, such as forensics, notification, data restoration, extortion, and lost income, and for claims brought by others harmed by a breach or privacy failure.

Usually not. Most general liability policies exclude or sharply limit electronic data and privacy claims, which is why cyber coverage is written separately.

Any business that relies on email, stores customer information, or moves money electronically has exposure. Small businesses are frequent targets of phishing and payment fraud.

Small businesses with simple operations can often be quoted from a short application. Larger or higher-data risks need a fuller questionnaire.

Possibly. Many insurers require multi-factor authentication and backups. A broker can tell you which controls stand between you and a quote.

No. A quote is not a binder. Coverage begins only when a policy is bound and issued.

Coverage for your own costs after a cyber incident, such as forensic investigation, legal guidance on notification, notifying affected people, restoring data, and public relations.

Many policies provide a panel of breach coaches, forensic firms, and notification vendors, and some require panel vendors or prior consent to use others. Check the policy wording.

Many breach response sections include credit or identity monitoring for affected individuals when notification is required or advisable.

Defense and damages when others sue or bring claims because of a security failure or privacy event at your business, such as a breach of their personal information.

Network security and privacy liability typically covers claims by clients and others whose data was exposed or who were harmed by malware spread from your systems, subject to policy terms.

Many cyber policies include media liability for claims such as defamation or copyright infringement in your online content.

Many policies cover extortion payments where lawful and with the insurer's prior consent, along with negotiation and response costs. Some policies sublimit or coinsure ransomware losses.

Underwriters commonly ask about multi-factor authentication, endpoint detection and response, offline or immutable backups, and patching.

The FBI's IC3 received 3,156 ransomware complaints in 2024. Many incidents are never reported, so the true number is higher.

Often, under a social engineering or funds transfer fraud section, usually with a sublimit. Some policies require verification procedures as a condition of coverage.

The FBI's IC3 recorded 21,442 business email compromise complaints and about $2.77 billion in reported losses nationally in 2024.

Some crime policies cover social engineering fraud. Coordinate cyber and crime coverage so there are no gaps or unexpected exclusions.

Cyber business interruption usually starts after a waiting period measured in hours, such as 8 or 12, set in the policy declarations.

Dependent business interruption covers losses caused by an outage at a vendor you rely on, if the policy includes it. Limits are often lower.

Some policies cover unplanned system failure, not just security events. Others require a malicious act.

Policies cover regulatory defense and may cover fines and penalties where insurable under applicable law. Insurability varies by state and type of penalty.

Coverage for fines, assessments, and costs imposed under your merchant services agreement after a payment card data breach, typically sublimited.

State attorneys general enforce breach notification and consumer protection laws, and federal agencies may be involved depending on your industry.

Yes. All 50 states have breach notification laws, each with its own definitions and deadlines.

Generally the law of the state where each affected individual lives, so a single breach can trigger several states' rules.

Breach response coverage typically pays for legal guidance, notification letters, call centers, and credit monitoring.

Most insurers ask about multi-factor authentication on email, remote access, and privileged accounts, and many will not offer coverage without it.

Endpoint detection and response software monitors computers and servers for malicious behavior and can isolate infected devices.

Insurers prefer backups that are offline, immutable, or otherwise segregated so ransomware cannot encrypt them, and that are tested regularly.

Short forms for small businesses can take minutes; larger risks may require a detailed questionnaire and sometimes an external scan of your internet-facing systems.

Many insurers run non-intrusive external scans of your domain and public-facing systems as part of underwriting.

Yes. Applications ask about prior breaches, claims, and incidents, and accurate answers protect your coverage.

Cyber pricing depends on underwriting of each business's revenue, industry, data, and controls, so published averages would not reflect your quote.

Generally, a higher retention (deductible) lowers premium, but you pay more of each claim.

Strong controls can improve eligibility and terms, and weak controls can lead to exclusions, higher retentions, or declinations.

An incident lead, IT or your managed service provider, a senior decision maker, and outside contacts such as your insurer's hotline and a breach coach.

Reporting to the FBI through IC3 or a local field office is generally encouraged, especially for wire fraud, where quick reports can help recover funds.

At least once a year through a tabletop exercise, and after major system changes.