Cyber Insurance for Small Businesses
Cyber insurance can help pay for incident response, recovery and some losses. What policies typically cover, common exclusions, and the security basics insurers usually expect.
Cyber insurance is now offered to businesses of every size. It can help pay for experts, recovery and some losses after an incident. Policies vary widely, so it pays to understand what you are buying.
What policies commonly cover
- Incident response: forensic experts, legal advice and breach notification.
- Data restoration and system recovery.
- Business interruption losses.
- Liability claims from customers or regulators, where insurable.
- Sometimes, social engineering or payment fraud, often with separate limits.
Common exclusions and conditions
- Losses where required security controls were not in place.
- Payment fraud not covered unless specifically included.
- Incidents that started before the policy.
- Specific conditions on ransomware payments.
What insurers usually expect
- Two-step verification on email and remote access. See enforcing two-step verification.
- Regular, tested backups. See testing backups.
- Timely updates. See device updates.
- Payment verification procedures. See payment verification.
- Staff training and an incident plan. See incident response plan.
Answer questionnaires accurately. Incorrect answers about controls can create problems at claim time.
For more, see our complete guide to small business cybersecurity.
Frequently asked questions
Does cyber insurance cover payment fraud?
Some policies cover social engineering or funds transfer fraud, often with limits and conditions. Check the wording carefully.
Will insurers ask about our security?
Usually. Common questions cover two-step verification, backups, updates and staff training.
Is cyber insurance a substitute for security?
No. It helps with recovery costs; it does not prevent incidents, and poor security can affect cover.
Sources
- Small organisations guide to cyber security, UK National Cyber Security Centre
- Cybersecurity for Small Business, US Federal Trade Commission
- Stop Ransomware, US Cybersecurity and Infrastructure Security Agency
