On this page
Cyber liability insurance helps a business respond after a data breach, a ransomware attack, or a payment fraud that starts in email. For a small firm, the response itself is often the hard part: finding specialists, notifying customers, and keeping the business running while systems are restored.
What a cyber policy pays for
Policies usually combine two kinds of cover. First party cover pays your own costs, such as forensic investigation, data restoration, notification letters, and income lost while systems are down. Third party cover responds when customers or regulators make a claim against you over the incident. The wording varies a lot between insurers, so check whether social engineering fraud, where staff are tricked into sending money, is included or sold as an extra.
What sets the price for a small business
Insurers look at your revenue, the kind of data you hold, and how much of it you keep. A firm storing payment details and health related records is priced as a bigger target than a firm holding names and email addresses. Your security controls matter as well. Multi factor authentication, tested backups, and staff training can improve the terms you are offered, and some insurers decline to quote without them.
The application is a security review
Expect detailed questions about passwords, backups, software updates, and who has access to what. Answer accurately. If a claim follows an incident and the insurer finds the application described controls you did not have, the claim can be disputed. That risk is a practical reason to fix basic gaps before you apply, not after.
Where cyber cover fits in your insurance
A business owners policy does not usually include meaningful cyber cover, and general liability policies are built around injury and property damage. The packaged option is explained in business owners policy cost and coverage, and liability basics are in general liability versus professional liability. Cyber cover is normally bought as its own policy or as an endorsement with modest limits.
Buying the right limit
Think about the cost of an incident rather than the premium. Notification, legal advice, and system restoration are billed by specialists at specialist rates, and downtime costs a trading business every day it lasts. Ask the insurer what response services come with the policy, since a good incident team, available on the day, is a large part of what you are paying for.
