Cyber attacks are on the rise, with hackers becoming more sophisticated and businesses more dependent on technology. As a result, cybersecurity insurance has become essential for protecting organizations against the financial impact of data breaches, hacking incidents, and other cyber threats. But what exactly does a cyber insurance policy cover? This comprehensive guide examines the key coverages, exclusions, and factors to consider when purchasing cyber insurance.
First-Party Coverages: Direct Losses to Your Business
Cyber insurance policies typically provide first-party coverage for losses and expenses your business incurs directly due to a cyber incident. Here are some of the main first-party coverages:
Data Restoration and Data Recreation
If hackers corrupt, delete, or encrypt your data, cyber insurance can cover the costs of restoring, recollecting, and recreating the data. This includes expenses for specialized forensic expertise.
Business Interruption
If a cyber attack disrupts your online operations, business interruption coverage helps replace lost income and pays for extra expenses during the period of interruption. For example, it may cover the costs of renting temporary equipment.
Cyber Extortion
If criminals threaten to damage your systems or reveal sensitive data unless you pay a ransom, cyber extortion coverage can reimburse the ransom payment. Most policies also cover the costs of negotiating with the extortionists.
Reputation Harm
Negative publicity following a breach can damage your brand. Some cyber policies help pay for public relations efforts to restore your reputation after an attack.
Third-Party Coverages: Lawsuits and Claims Against You
In addition to first-party losses, cyber insurance also provides third-party liability coverage in case customers, partners, or other parties sue your business or make claims against you after a cyber incident. Here are some key third-party coverages:
Privacy Liability
If a data breach exposes confidential customer or employee information, privacy liability covers the costs associated with regulatory actions, fines, and settlements for privacy lawsuits.
Network Security Liability
If a cyber attack on your systems spreads malware to other businesses, network security liability covers their costs for investigating the incident and restoring their networks.
Media Liability
If your business faces copyright, trademark, defamation, or other media-related lawsuits stemming from online content, media liability coverage helps pay legal expenses and settlements.
Regulatory Fines and Penalties
Cyber policies may cover fines and penalties imposed by government agencies as well as payment card industry (PCI) fines after a breach.
Common Exclusions and Limitations
While cyber insurance is broad, policies do contain important exclusions. Here are some of the major cyber risk exposures typically excluded:
Pre-Existing Vulnerabilities
Most policies won’t cover breaches exploiting vulnerabilities you knew about but failed to address. Failing to install critical security patches may also invalidate coverage.
Insider Threats
Damages caused by employees, contractors, or partners who deliberately attack your systems are usually excluded. However, some policies cover insider incidents not stemming from fraud.
Human Errors
Mistakes by employees that inadvertently expose data or systems are not covered in most cases. Policies typically exclude breaches caused by accidental misconfigurations or sending emails to the wrong recipients.
War and Terrorism
Cyber attacks stemming from war or terrorism may be excluded since they are difficult risks for insurers to underwrite and model.
Key Factors In Choosing Coverage
As you evaluate cyber insurance policies, here are some key considerations:
Adequate Coverage Limits
Make sure your coverage limits for third-party claims as well as first-party expenses realistically reflect your cyber risk exposures based on factors like your revenues and data assets.
Deductibles and Retentions
The higher the deductible and retention amounts you choose, the lower the policy premiums. Evaluate the level of risk you can retain vs. transfer through insurance.
Coinsurance Percentages
With coinsurance, you share a percentage of losses above the deductible with the insurer. Understand how coinsurance works before selecting a percentage.
Incident Response Requirements
Failing to quickly report cyber incidents or cooperate with the investigation process can jeopardize your claim. Know the insurer's requirements.
Handling a Claim or Breach
If your business suffers a cyber incident, here is an overview of the response and claims process:
- Breach Containment: Follow the insurer's requirements for containing the incident, such as isolating compromised systems. Avoid actions that could be seen as destroying evidence.
- Forensic Investigation: Cyber insurance will cover the costs of a forensic analysis to determine the cause and scope of the breach.
- Legal and PR Support: Insurers can connect you with specialized cybersecurity law firms and PR teams to manage the crisis professionally.
- Notifications: If sensitive data was exposed, insurers can help you fulfill legal obligations for notifying affected individuals and entities.
- Credit Monitoring: Your insurer may provide identity monitoring services and credit freezes to help consumers deal with the fallout of a sensitive data breach.
With cyber threats on the rise, having robust cyber insurance tailored to your specific risks is critical. Now that you understand key cyber insurance coverages and factors, you can make informed decisions to transfer your risks and be prepared. Reach out for a consultation about putting together a cyber insurance program for your organization.
Frequently Asked Questions About Cybersecurity Insurance
What are the main advantages of getting cyber insurance?
Cyber insurance provides two critical benefits. First, it covers a wide range of first-party expenses and losses your business could directly incur after a cyber incident, including costs for restoring data, investigating the breach, and managing public relations. Second, it covers third-party liability exposures if customers, partners, or other entities sue you or make claims after an attack targeting your systems and data.
How much does cyber insurance cost?
Premiums vary based on factors like your industry, revenues, data assets, and security infrastructure. However, small and mid-size businesses can generally expect to budget between $1,000 to $10,000 annually for a cyber insurance policy with $1 million to $2 million in coverage limits. Costs increase for larger firms with higher risk profiles and coverage requirements.
What cybersecurity measures do insurers require?
Insurers want to see that you are following cybersecurity best practices appropriate for your business size and risk profile. Common requirements include firewalls, antivirus software, access controls, encryption, vulnerability testing, backup procedures, and employee security training. Working with an insurance broker can help you implement baseline controls needed for coverage.
Are losses from cyber terrorism and acts of war covered?
Most cyber insurance policies exclude cyber attacks stemming from terrorism and war. These are difficult risks for insurers to underwrite given the potential scale of nation-state attacks. Some policies may offer a terrorism buyback endorsement to add this coverage back in for an additional premium.
Does cyber insurance cover social engineering attacks and human errors?
Generally, cyber insurance excludes insider threats caused by employees intentionally stealing data or damaging systems. However, many policies do cover social engineering attacks like phishing that exploit human error. Requiring security awareness training can extend protections for unintentional insider incidents.
What are the most important factors when purchasing cyber insurance?
Work with your insurance broker or advisor to evaluate your specific cyber risks and exposures. Tailor your coverages and limits accordingly. Also carefully assess your deductibles, coinsurance percentage, and incident response requirements. Read policy language closely to avoid any unpleasant surprises when you need to file a claim.
For more cyber risk management tips and best practices, explore our in-depth blog post on everything you need to know about cyber insurance coverage. Reach out if you need guidance assembling the right cyber insurance program for your company.
0Comments