Cyber Liability Insurance discounts and questions
Pays the costs of a data breach, ransomware event or funds-transfer fraud: the forensic and notification work you must do, the income you lose while systems are down, and the claims from customers and regulators. Priced on your revenue, your data and the security controls you can prove.
Discounts carriers commonly offer
- Multi-factor authentication
- Enforced on email, remote access and administrator accounts. With many carriers this is a condition of being quoted at all, and it moves the rate more than anything else.
- Tested offline backups
- Backups kept separate from the network and restored on a schedule, which shortens a ransomware shutdown and lowers the business interruption rate.
- Endpoint detection and response
- Managed monitoring software on every computer and server, documented on the application.
- Staff phishing training
- A recurring training and simulation programme. Some carriers price it directly; others require it for the social engineering endorsement.
- Package with a business owners policy
- Cyber added as a section of a package policy usually costs less than a standalone policy at small limits, though the standalone form is broader.
Questions people ask
My general liability policy mentions data. Is that not enough?
Almost never. General liability forms now exclude damage arising from access to or disclosure of personal information, and the small amount of data coverage some package policies include is usually a sub-limit for notification costs only, with no business interruption, extortion or funds-transfer fraud. The analysis reads the endorsement and shows the gap next to a standalone quote.
What is the difference between first-party and third-party coverage?
First-party pays your own costs: the forensic firm, the notifications, the lost income, the ransom. Third-party pays claims other people bring against you because of the event, plus your defence. A small business with few customers and no contracts may need mostly first-party coverage; a firm that holds client data or connects to other companies' systems needs both. Quotes are often built with different limits for each, so compare them side by side rather than by the headline number.
We use cloud software for everything. Does the vendor's insurance cover us?
The vendor's policy covers the vendor. Their terms of service usually limit what they owe you to a refund of fees, and the notification duty for your customers' data stays with you because you collected it. What you want on your own policy is a dependent-business interruption extension so an outage at the vendor triggers your income coverage, and a contingent breach provision so a breach there triggers your notification coverage.
How much coverage should a small business carry?
Start from what a bad week would cost: the forensic and legal response, the notifications for every record you hold, and the income lost during the days it would take to rebuild from backups. Add any limit a contract requires. For example, a firm holding a few thousand customer records that could be down for a week might reasonably land on a limit of one million dollars, but the arithmetic is specific to the business and the analysis works it through.
What happens on the day we discover an incident?
Call the carrier's breach hotline before you call anyone else, including your own IT provider. The policy pays for the vendors the carrier approves, and using your own without consent can leave those bills outside the coverage. Preserve the systems as they are, do not pay a ransom on your own, and let the assigned attorney direct the forensic work. The policy also has a notice deadline, so late reporting is a coverage question in itself.