Does My Small Business Need Cyber Insurance?
Cyber attacks are not just a big-company problem. If you use email, store client data or take digital payments, here is what cyber insurance does and does not cover.
Key takeaways
- Any business using email, a website, client data or digital payments carries cyber risk.
- Cyber insurance covers investigation, data recovery, business interruption, extortion and legal costs.
- Standard business insurance generally does not respond to cyber incidents.
- Good cyber hygiene reduces premiums and, more importantly, reduces the chance of a claim.
Ask most small business owners about cyber risk and the answer is the same: we are too small to be a target. Unfortunately, the opposite is often true. Smaller businesses tend to have fewer security controls, and attackers use automated tools that do not care how big you are.
The four questions to ask
- Could your business keep trading if your systems were locked for a week?
- What would happen if client information you hold was leaked?
- Could you afford specialist IT, legal and PR help at short notice?
- How would your reputation recover?
If any of those answers make you uncomfortable, cyber insurance is worth a serious look.
What cyber insurance covers
A cyber liability policy typically helps with the costs of:
- Forensic investigation to find the cause and extent of a breach
- Data recovery and system restoration
- Business interruption losses while systems are down
- Cyber extortion and ransomware response
- Crisis management and reputation protection
- Legal fees, penalties where insurable, and third-party claims for data or privacy breaches
What it does not cover
Cyber policies exclude bodily injury and physical property damage, incidents known before the policy started, intentional or fraudulent acts, damage to hardware, the cost of upgrading systems, and outages caused by power or telecommunications providers.
Who is most exposed
Accountants and consultants holding client financial data, retailers and eCommerce stores taking payments, real estate agencies, hospitality businesses running online bookings, and any manufacturer or service provider that relies on connected systems. In practice, that is almost every business.
Reducing your risk and your premium
Insurers look favourably on businesses with multi-factor authentication, regular offline backups, patched software and staff training. These controls make cover easier to obtain and cheaper, and they cut the odds of ever needing it. Kasana Insurance Brokers can walk you through what insurers expect and arrange cover that suits your size and digital exposure.
Frequently asked questions
What is the difference between cyber insurance and IT security?
IT security reduces the chance of an incident. Cyber insurance covers the financial consequences when one happens anyway. Most insurers expect basic controls such as multi-factor authentication and backups to be in place.
Does cyber insurance cover a data breach notification?
Yes, most policies cover the cost of investigating a breach, notifying affected individuals where required under the Notifiable Data Breaches scheme, and managing the response.
Does my business pack cover cyber attacks?
Generally no. Business pack policies cover physical loss and damage. Losses from hacking, ransomware or data theft are usually excluded and need a dedicated cyber policy.
This article provides general information only and does not take into account your objectives, financial situation or needs. Consider the relevant Product Disclosure Statement and speak with a broker before acquiring any insurance product.
