Cyber insurance for professional services firms.

Cyber insurance can address certain costs your business incurs after a covered incident and certain claims brought by others. For a professional services firm, start with the information you handle, the systems you depend on and how money moves. The relevant events, limits and conditions depend on the proposed policy.

Your firm may hold client financial records, use shared cloud platforms and authorize payments. A stolen file, an unavailable client portal and a fraudulent payment instruction each raise a different insurance question. Use the activities below to prepare a review of the actual forms and endorsements.

Key takeaways

• The decision: Map the information you hold, systems you depend on and payments you authorize to the cyber coverage questions that matter for your firm.
• Keep in mind: Cloud outages, service-error allegations and fraudulent transfers can have different triggers and conditions. Cyber coverage should not be assumed to address every exposure.
• Next step: Gather your services, data, technology providers and security practices, along with questions about professional liability and payment fraud.

Connect daily work to coverage questions.

These examples identify questions to investigate. They establish no coverage or placement eligibility for a particular business.

Handling confidential client information

An accounting firm stores tax documents; a consultant holds a client's acquisition plans. Ask about incident investigation, privacy counsel, notification costs and liability for disclosure. Check whether the definition of protected information includes confidential business information as well as personal data.

The NAIC cyber insurance guide distinguishes first-party costs incurred by your business from third-party liability. Review both against the information you handle.

Depending on cloud software

A firm cannot access its document-management platform. Ask whether dependent business interruption addresses that provider and that cause of failure. A malicious attack and an accidental outage may receive different treatment. Identify provider restrictions, any waiting period before coverage applies and any smaller coverage limit, or sublimit.

Losing access to your own systems

Ransomware interrupts project work and damages files. Review incident response, data restoration, interruption and extra-expense provisions separately. Ask how the policy measures lost income, what records support it and whether completing work later changes the calculation.

Delivering advice or professional services

A client alleges that a missed deadline or incorrect recommendation caused financial harm. Review professional liability, also called errors and omissions, alongside cyber. An incident involving technology does not automatically turn every service-error allegation into a covered cyber claim.

Approving invoices or transfers

Someone impersonates a vendor and changes payment instructions. Ask about social engineering, funds-transfer fraud and computer fraud individually. Establish whose money is involved and who authorized the transfer. Cyber and Crime policies can have different triggers, exclusions and verification requirements.

Chubb's cyber products overview gives one insurer's examples of professional and technology exposures and separate fraud endorsements. The details depend on the policy wording.

Compare what a cloud outage means in each proposal.

Consider a hypothetical consulting firm that delivers work through a hosted document platform. Two fictional proposals include response and interruption coverage for the firm's own systems. One also includes dependent interruption caused by a provider security breach. The other includes provider security breaches and specified accidental system failures.

An accidental platform failure prevents access to project files. Check whether that provider and cause fall within each proposal's wording. Then compare the waiting period, sublimit, restoration period and proof of financial loss. An unavailable system alone does not establish a payable income loss.

Beazley's business-interruption guidance shows why it matters whether revenue is lost or merely delayed. Its provider requirements and loss definitions are specific to the wording it discusses; your proposals may differ.

Resolve these questions before choosing.

Request answers tied to the proposed forms and endorsements:

1. What is included? Identify entities, services, information and systems.
2. When must an event be reported? Check occurrence, discovery and reporting provisions, plus restrictions on earlier events.
3. Which limits are shared? Compare the total aggregate limit and smaller sublimits for individual coverages.
4. What reduces the available protection? Ask whether response or defense expenses reduce limits. Check your deductible or retention, the amount you must bear, and any waiting period.
5. Which conditions must be followed? Check approved lawyers or response vendors, consent before spending and required security controls.
6. What changes the scope? Review exclusions and endorsements affecting ransomware, widespread events, outages and payment fraud.

The Chubb Cyber ERM sample policy, PF-48169 (02/19), sections VI through IX, provides one insurer's specimen wording for limits, expenses and conditions. Use the forms in your own proposal to answer these questions.

Keep unanswered questions visible. A summary marked “included” cannot resolve an exclusion or condition in the contract. Our commercial insurance quote guide provides a broader comparison worksheet.

Bring an accurate picture of your firm.

Gather a description of your services, revenue, client information, key technology providers and payment procedures. Include current policies, contract requirements and prior incidents. Ask your IT provider to check security answers you cannot confirm yourself, rather than guessing.

Our business insurance quote checklist can help you organize the information. Use the designated secure process for sensitive material.

If you have a business owners policy, check any cyber extension against the separate cyber proposals you are considering. They may cover different events or have different limits. Keep questions about professional liability and payment fraud alongside the cyber questions, rather than assuming one policy addresses them all.

Before deciding, note which risks matter most to your firm's work and where the proposals leave questions open. Bring those questions and the relevant documents to a conversation with your broker.