What cyber liability insurance covers

When an event is discovered, the carrier's breach hotline puts a forensic firm, a privacy attorney and a notification vendor to work. The policy pays for finding out what happened, determining which records were exposed, notifying the people affected as each state's breach law requires, offering them credit monitoring, and handling the public relations if the event becomes known. Some forms pay these costs inside the main limit and others carve them out with their own sub-limit, which is the first thing to compare between two quotes.

If a ransomware event or a denial-of-service attack takes your systems down, cyber business interruption pays the income you lose and the extra expense of operating another way, after a waiting period measured in hours rather than days. Data restoration pays to rebuild or recover files and software from backups or from scratch. Cyber extortion pays a negotiator and, where the carrier agrees and the law allows, the ransom itself.

The waiting period and the period of restoration set how much of a shutdown the policy pays for, and a dependent-business extension is needed if the outage is at your cloud vendor rather than your own office.

This half pays claims brought against you because your systems failed: customers whose data was exposed, a partner whose network was infected through yours, or a client who lost money because your email was used to send them a fake invoice. It includes defence costs and settlements. Regulatory coverage pays to respond to an investigation by a state attorney general or a federal agency and, where insurable, the fines. Payment card coverage pays the assessments a card brand levies through your processor after card data is compromised, which a merchant agreement makes you responsible for.

The most common small-business loss is not a hack at all: an employee receives a convincing email from the owner, a vendor or a title company and wires money to a criminal's account. Because the employee sent the money voluntarily, a standard crime policy and many cyber policies exclude it unless a social engineering endorsement is added. The endorsement usually carries a lower sub-limit and may require a call-back procedure to verify payment changes before a claim is paid. Ask for it specifically; it is the coverage most often missing at claim time.

Clients with vendor-security programmes, larger general contractors, franchisors, landlords with shared building systems and some lenders now write cyber insurance into their contracts. What they receive is a certificate of insurance: a one-page summary issued by the agency listing the carrier, the policy period, the limits and whether the requester is an additional insured. The certificate proves the policy exists on the date it was issued and does not change it, so a contract that asks for a limit or endorsement you do not have means the policy changes first and the certificate follows.