Cyber Insurance Coverage: What is Covered & What is Not

As technology-enhanced commerce continues to grow at a rapid pace, organizations with digital business models have a lot of digital assets to protect. From IT infrastructures to proprietary software to sensitive customer information, cyber insurance is necessary for enterprises looking to mitigate the risk of cyber attacks, data breaches, and network disruptions. While it can’t replace robust cybersecurity countermeasures, cyber insurance can help keep an organization afloat when a cyber event strikes. 

What Does Cyber Insurance Cover?

Cyber insurance covers an organization’s financial losses associated with a cyber event, such as a cyberattack, data breach, or unauthorized IT system access. An enterprise that suffers a direct cyber event is considered a “first party.” Most financial losses associated with a cyber event are first-party losses. Some first-party losses can include data theft, damage to digital assets, or theft of funds. Cyber insurance can also cover third-party losses—organizations that suffer damages from their partnership with the first party. For example, third-party data stolen from the first party’s network can qualify as a third-party loss. Cyber insurance can also protect an organization from legal action brought against them due to a cyber-attack. As enterprises manage the fallout from a cyber event, cyber insurance may also compensate for certain expenses. Most cyber insurance companies provide the following coverage:  

Security & Privacy Breach Costs

If a security breach occurs, a cyber insurance company will cover costs arising from the cyber attack. Common examples of cyber security breach costs include:

• Legal fees and defense costs associated with the security breach
• Expenses incurred from notifying customers of the breach
• Payments to legitimate claimants affected by the breach
• Third-party vendors: Public relations consultants, IT forensic accountants, and response and recovery professionals. 

Cyber Forensic Support

A standard feature in cyber insurance policies, cyber forensic support provides organizations with policy-approved cybersecurity professionals to assist with a post-mortem incident analysis. They can assess the IT network, locate the source of the breach, and make recommendations to shore up defense measures. 

Cyber Extortion

When cyber thieves employ ransomware attacks on an organization, they attempt to control the network or data until a ransom payment is received. Cyber insurance companies will typically cover the cost of the ransom amount as well as any other fees that occur in settling the matter, such as consultant fees for overseeing the negotiation. It’s important to consult with the cyber insurance company before entering into an agreement with a cyber thief. There may be stipulations in the policy. 

Digital Asset Damage

Many organizations rely heavily on automated systems to run their business. Whether they’ve been altered, corrupted, or misused, it can be expensive to replace digital assets. If a cyberattack damages digital assets such as a website or proprietary software, cyber insurance will cover it. 

Interruption of Business

When a cyberattack or IT failure occurs, there is some level of disruption to business operations. Whether it’s a day or several months, cyber insurance will cover the loss of income an enterprise sustains during that period. 

Liability Costs

Beyond cyberattacks and IT failures, cyber insurance can also provide protection from parties who bring claims against your organization, such as libel, slander, or infringement of intellectual property rights. This coverage is very important for enterprises that rely on websites and social media platforms to advertise their products and services. 

What Does Cyber Insurance Not Cover?

Cyber insurance policies are generally designed to protect organizations from cyber events out of their control. Cyber insurance companies may not cover losses if a cyber event is reasonably preventable.  Here are four common exclusions:

Negligence

When business personnel mishandle IT and digital assets, it can be considered an “unforced error” on the part of the organization. Neglecting to employ recommended security measures can lead to unnecessary data losses, which insurance policies will not cover. 

Inside Attacks

Cyber attacks inside the organization, such as criminal misconduct or fraud, can cause financial loss and business disruption; however, this activity will not be covered. 

Pre-existing Cyber Event

Much like other insurance policies, if a preexisting cyber event occurred before the cyber insurance policy began, it would not be covered. 

Criminal Proceedings

While cyber insurance covers claims against an organization, such as libel and infringement of intellectual property rights, cyber insurance will not cover claims an enterprise submits for criminal investigations or grand jury proceedings. 

Tips For Choosing the Best Cyber Insurance Coverage

Ensuring coverage fits your organization’s needs is important when choosing a cyber insurance policy. Here are three useful tips:

Evaluate Your Cyber Risk

Organizations must look at the digital areas that cyber attacks can threaten. For instance, does your network contain sensitive customer data, such as payment card information? What about sensitive proprietary software? With clarity on what exactly needs protecting, enterprises can seek the right coverage. 

Read the Policy in Its Entirety

Before signing a policy, clarify the language the insurance company uses. Terms like “extra expenses” or “business income loss” are important. Each policy may have its own interpretation of reimbursement limits. Also, what cyber events are covered? For instance, how does it address cyber extortion and ransomware? Understanding terms and limits lets you know if a policy is right for your enterprise. 

Make Sure the Coverage is Relevant

Will the cyber insurance coverage fit your organization’s needs?  One of the most important coverage options is business interruption coverage. Suppose your enterprise can’t conduct business because of an IT failure or a cyber attack. In that case, the policy will cover financial losses related to business interruption until systems are up and running again. 

As a leading provider of cybersecurity solutions, Cynergy Technology is poised to help your organization mitigate the risk of cyber threats. Our network security services can provide robust cybersecurity countermeasures to protect your IT infrastructure and sensitive data. In the event you do experience a cyber attack or data breach, our backup & disaster recovery services can help minimize business interruption and get you back to doing what you do best—running your business. Contact us today for a free consultation!