Exclusions differ from one insurer to another, and checking them is part of our work before we recommend a policy to you.
An attacker encrypts the servers and production stops for several days while the systems are restored from backups. The policy covers forensics, restoration costs and lost profit for the outage beyond the agreed time deductible. If the backups were not sound, part of the loss can stay uncovered, which is why we check the state of your backups before placing cover.
Accounts receives an email with a changed bank account number, apparently from a regular supplier, and makes the payment. This type of fraud is not included in every cyber policy and needs a specific extension, often called funds transfer fraud or business email compromise cover. When we compare quotes we look closely at whether that cover exists and what the limit per event is.
Customer data leaks from a web shop, which triggers a duty to assess the incident and notify the Commissioner within seventy two hours, and to inform the individuals as well if the risk is high. The policy covers legal advice, notification and call centre costs, and the defence against compensation claims. Without a policy those costs land on the company immediately, before anyone has even established who was at fault.
The examples are illustrative and show how the cover works in practice.
Two groups of costs. The first are your own costs: forensics, restoring systems, lost profit from the outage, notifying affected individuals and legal advice. The second is liability towards others: compensation claims from customers and partners over the breach of their data, and the costs of any proceedings that follow.
Some policies include extortion cover, subject to prior consent from the insurer and a check that payment is not prohibited under sanctions rules. Paying a ransom is a last resort, since it does not guarantee the data comes back. In practice the more valuable part of the policy is the one that funds the incident response team and the restoration from backups.
If personal data has been breached, the controller must notify the Commissioner without delay, as a rule within seventy two hours of becoming aware of it, unless the breach is unlikely to create a risk to the rights of individuals. If the risk is high, the individuals themselves must be informed too. An internal record of breaches is also kept, and the policy covers the cost of legal advice and of carrying out those steps.
Size is not protection, because a large share of attacks is automated and simply finds whoever is least protected. For smaller companies the cost of downtime matters more than the value of the data, since a few days without billing or production feeds straight into the annual result. Limits and premiums scale with revenue, so a policy for a small company is nowhere near corporate level pricing.
Usually a security questionnaire covering basic controls: regular backups that are tested, multi factor authentication for remote access, patching and staff training. The answers form part of the contract, so an inaccurate answer can be grounds for reducing or declining a claim. We go through the questionnaire with you before it is submitted and approach insurers whose terms fit your actual situation.
Send us a short enquiry. We collect offers from every insurer that covers this risk and explain the differences before you sign anything.
