Cyber insurance is increasingly a contractual requirement rather than an optional protection. It is also one of the more commonly misunderstood policies a business holds, and the misunderstandings surface at the worst possible moment.

What is typically covered

  • Incident response costs: forensics, legal advice, and breach notification.
  • Business interruption from a covered incident, subject to a waiting period.
  • Data restoration and system recovery costs.
  • Liability arising from a breach of third-party data.
  • Extortion payments and negotiation support, subject to sanctions law.

What frequently is not

Funds transfer fraud and social engineering — the business email compromise scenario — are commonly excluded from base coverage and sold as separate extensions with lower limits. Given that this is the most likely large loss for most small businesses, check specifically whether you hold it. Also check exclusions for unpatched known vulnerabilities and for incidents originating with a vendor.

Conditions that are breached routinely

Most policies require notification within a defined window and require insurer approval before engaging responders or making payments. Organisations regularly call their usual IT provider first, incur costs, and discover afterwards that those costs are not reimbursable and that the response was not from an approved panel. Put the insurer's number in your incident response plan, above your IT provider's.

Your application is a set of warranties

Applications ask whether you have MFA everywhere, tested backups, and current patching. Those answers form part of the contract. If an incident reveals the position was different in practice, coverage can be reduced or declined. Answer accurately, and if something changes materially, tell your broker.

Questions worth asking your broker

  • Is funds transfer fraud covered, and at what sub-limit?
  • What is the notification window, and what happens if we miss it?
  • Must we use panel responders, and who are they?
  • What is the waiting period before business interruption cover begins?
  • Are incidents originating at a supplier covered?

Insurance is not a control

A policy transfers some financial consequence; it does not reduce the likelihood of an incident or restore customer confidence afterwards. The controls that reduce premiums — MFA, tested backups, current patching — are worth implementing on their own merits, and the insurance discount is a secondary benefit.