Handbook / Business insurance

Cyber insurance for small businesses: what it covers and how to buy

A small business can be disrupted by a single compromised email account, a ransomware infection or a lost laptop full of client files. CISA notes that small businesses often do not have the resources to defend against devastating cyber threats like ransomware. Cyber insurance does not prevent incidents, but it can pay for recovery and claims when one happens. This guide explains what to look for. Policies vary a great deal, so always read the actual wording.

Who should consider it

Cyber cover is worth a look if you:

• store client or customer personal information
• take payments online or keep financial details
• rely on email, cloud storage or software to deliver your work
• handle client systems or logins, such as web developers or virtual assistants
• have contracts that require cyber cover
• would lose significant income if your systems were down for days

What policies commonly cover

First-party cover, for your own losses, may include:

• incident response, such as forensic investigation
• data recovery and system restoration
• business interruption, meaning lost income while systems are down
• notification costs if personal data is exposed
• extortion or ransomware response, where permitted
• funds transfer or social engineering fraud, often with a lower sublimit

Third-party cover, for claims against you, may include:

• claims from clients or customers whose data was exposed
• regulatory investigations and fines, where insurable
• costs of defending lawsuits

Not every policy includes every item. Check what is covered and the limit for each.

Exclusions to watch for

• incidents before the policy start date
• failure to maintain security measures you declared
• bodily injury and property damage, usually covered elsewhere
• war and certain state-sponsored attacks
• upgrades to systems beyond restoring them
• losses from unencrypted devices, in some policies

What insurers ask

Applications often ask about:

• multifactor authentication on email, remote access and admin accounts
• backups, how often and whether they are tested and kept separately
• software updates and supported systems
• employee training on phishing
• how you handle payment and personal data

These questions mirror basic security advice. CISA urges small businesses to adopt multifactor authentication and to perform and test backups, noting that many ransomware victims had no backups or had incomplete or damaged ones. Answer applications accurately: misstatements can affect claims.

Choosing limits

Think about realistic costs:

• how long you could operate without your systems
• how many records you hold and what notification would involve
• contractual requirements from clients
• the value of funds you transfer

Check sublimits for items such as social engineering fraud, which may be much lower than the headline limit.

Where to buy

Options include standalone cyber policies, endorsements added to a business owner's policy, or bundles with professional liability insurance for tech and professional services. An independent agent can compare options.

Reduce risk first

Insurance works best alongside good habits:

• multifactor authentication everywhere
• a password manager
• automatic updates
• regular, tested backups; see data backup
• encryption on laptops and phones
• care with links, attachments and payment change requests

The SBA's cybersecurity guidance points to free resources, including scanning services offered through CISA.

If an incident happens

1. Contact your insurer's incident line before hiring vendors, if the policy requires it.
2. Contain the problem, such as disconnecting affected devices.
3. Preserve evidence.
4. Notify affected clients and authorities as required.
5. Keep records of costs and actions.

Write these steps, with your insurer's contact details, into a one-page incident plan.

Questions to ask before buying

• Which first-party and third-party costs are covered?
• What are the limits and sublimits for each?
• Is social engineering or funds transfer fraud covered?
• Does the policy include an incident response service or hotline?
• Which security measures must I maintain?
• Does it cover incidents involving client systems I access?
• What is the deductible or retention?

Get the answers in writing and compare at least two quotes.

Review it each year

Your risks change as your business grows. When you renew, check whether you now hold more data, use new systems or take on clients with stricter requirements, and update cover accordingly.

Consider cyber insurance if you hold data or depend on online systems; compare first- and third-party cover, limits, sublimits and exclusions; answer security questions honestly; and put multifactor authentication and tested backups in place first.