Cyber insurance for small businesses

Cyber insurance can include first-party and third-party coverage. A proposal may include either or both, so check which insuring agreements it actually contains. The FTC's guidance for small business draws the same line.

Key takeaways

• The decision: Read a cyber policy in two halves: first-party costs the business absorbs after an incident, and third-party liability to others. Both deserve a separate review against the business's risks.
• Keep in mind: Headline limits are often not the operative number. Extortion, social-engineering and funds-transfer coverage frequently carry sublimits well below the policy limit, and business interruption carries a waiting period.
• Next step: Document the security controls you actually have before opening an application, and ask every proposal the same questions about sublimits, waiting periods and vendor-outage triggers.

First-party and third-party coverage

First-party coverage addresses the insured business's own costs after an incident. Depending on the policy, covered costs can include:

• Forensic investigation to establish what happened and what was reached.
• Legal advice on notification duties, which vary by state and by the kind of data involved.
• Notifying affected individuals, and credit monitoring where it is provided for.
• Restoring data and rebuilding systems.
• Business interruption, income lost while systems are down.
• Extortion payments and the costs of responding to a demand, where the policy provides for them.

Third-party coverage addresses liability to others: claims from clients or individuals whose data was exposed, and regulatory proceedings and penalties where those are covered and insurable.

A business that handles little third-party data may still face substantial first-party costs from an outage. A business holding sensitive client records faces both.

Which half matters more depends on the business and the incident. A small professional firm with no payment data can still lose weeks of billable work to a ransomware event, and that is almost entirely first-party cost.

What a cyber policy generally does not reach

• Failures of your own professional work or product. A defect in software you built that costs a client money is a professional liability question. Our comparison of professional liability and E&O sets out that category.
• Physical damage to property and bodily injury, which generally belong to property and general liability coverage.
• The cost of upgrading security to the standard you should have had. Policies generally pay to restore, not to improve.
• Loss from a known, unreported circumstance that predates the policy.

The sublimits that catch buyers out

This is where a policy's headline limit misleads. Ask for each of these explicitly:

The vendor-outage question deserves particular attention for a business that runs on third-party systems, especially when an outage at a vendor could halt operations. An incident that never touches your network can still stop your operations.

What drives what you are offered

Underwriters generally weigh revenue and industry, the kind and volume of sensitive data held, dependence on third-party systems, prior incidents and claims, and the security controls in place.

Controls are the part a business can actually change before applying. NIST's small business guidance and CIS's readiness guidance both cover this ground. The controls applications most commonly ask about:

• Multi-factor authentication, particularly on email, remote access and administrative accounts.
• Backups, whether they exist, whether they are kept offline or otherwise isolated, and whether restoring from them has been tested.
• Endpoint protection and how quickly software is patched.
• Email filtering, and a verification procedure for payment instructions and changes to banking details.
• Access control, including how quickly departing employees lose access.
• Staff training, and whether an incident response plan exists.

Security controls can affect eligibility and proposed terms. Ask the underwriter which changes would affect your quote; adding a control does not guarantee a lower premium or an offer.

Answer the application accurately

Applications ask about controls as statements of fact, and the answers can become part of the basis on which coverage is issued. An answer that overstates what you have is a problem that surfaces at a claim, which is the worst moment to discover it.

If a control is partial, MFA on email but not on remote access, backups that have never been test-restored, say so in those terms. An accurate partial answer gives the insurer a clearer basis for evaluating the risk. It does not guarantee an offer or coverage.

Our quote checklist lists what to gather first, including the data, systems and security section.

What the first days after an incident look like

Understanding the sequence explains why the response panel is part of what you are buying.

Most policies require prompt notification, and many require it before you engage your own forensic or legal help. Engaging a consultant first and seeking reimbursement later is a common and avoidable way to run into a coverage argument. The practical first step after an incident is usually the insurer's hotline, not a vendor you already know.

The insurer may direct you to approved breach counsel and forensic providers. Ask how appointments and consent work. Legal privilege depends on the circumstances and applicable law; appointing counsel does not guarantee it. Forensics establish what was accessed and when, which is what determines your notification duties. Those duties are set by state law and by the kind of data involved, and the deadlines can be short.

Two things are worth preparing in advance, because they are hard to assemble under pressure:

• An out-of-band way to reach your own people. If email and chat are compromised or offline, a response coordinated over them is a response the attacker can read. A phone list held outside those systems is unglamorous and genuinely useful.
• Knowing who can authorise spending and sign off on notification. Decisions move quickly, and an absent decision-maker is a real delay.

Choosing a limit

There is no universal limit that fits every business. What a limit should reflect is the plausible total of the costs above: forensics and legal advice, notification across however many records you hold, credit monitoring where provided, lost income across however long a rebuild would realistically take, and any third-party liability.

Record count is one input to the limit decision. Notification and monitoring scale with it, and a business holding tens of thousands of records can exhaust a modest limit on those two items before liability is considered.

Retention works the other way. A higher retention may lower premium and means you absorb more of a covered incident yourself, reasonable where the business could fund that comfortably, and a problem where it could not.

Comparing proposals

Ask every proposal the same questions, in this order: what triggers coverage, what each sublimit is, what the waiting period and retention are, whether vendor outages are included, and who controls the response, most cyber policies direct you to a panel of forensic and legal providers, and that panel is part of what you are buying.

Then compare premium. Our worksheet for how commercial insurance quotes work covers the mechanics of a like-for-like comparison, and firms in professional services may also want our guide to cyber insurance for professional services firms.