CYBER INSURANCE 101

Joseph Duysen 12/13/2019

With cybercrime becoming a major threat to businesses across the world, irrespective of their size, cyber insurance is fast becoming more of a necessity than a choice. However, the concept of cyber insurance is still fairly new and not many SMBs are aware of its benefits. This whitepaper discusses cyber insurance in depth, explaining what it is, why you need it and also tells you what to look for when signing up for cyber insurance. 

Cyber insurance is an insurance that covers your liability in the event of your business becoming a victim of cybercrime. For example, a data breach puts you at risk of lawsuits, makes you liable to your customers/other parties whose data has been compromised because of/via your organization. Cyber insurance covers the financial aspect of such liabilities, making it easier for you to deal with them.

Many organizations think of cyber insurance as an added cost. They believe they don’t need it for various reasons. Bigger organizations think their IT security measures are watertight and they won’t fall victim to cybercrime, and they also tend to believe that even if they are affected in a one-off case of cybercrime, they are solid enough to discharge their liabilities and come out of the incident with their brand value intact. SMBs, on the other hand, think cybercriminals are most likely to target the bigger players and they don’t need cyber insurance. But, in reality, it is the smaller businesses that are at a greater threat--primarily, because 

• They lack the resources to strengthen their IT infrastructure and their staff is less likely to be trained in identifying cyber threats, making them more vulnerable
• They are less likely to recover from the damage to their financial and brand health as a result of falling victim to cybercrime

Cyber insurance covers a range of elements, the most basic being the legal expenses incurred as a result of falling victim to cybercrime. This includes legal fees, expenses, and even any fines that you may have to pay or financial settlements that have to make with your customers or third parties who have been affected as a result of the incident. Apart from this, depending on the coverage you opt for, your cyber insurance may cover the following.

• Notification Costs: In the event of a data breach, the business is required to inform all affected parties of the breach. This involves reaching out to them individually and also through the press. Cyber insurance may cover the costs related to this process.
• Restoration Costs: After a cybercriminal attacks your IT infrastructure, you will have to spend money restoring it. There will be considerable expense in terms of recovering the lost data and repairing or replacing affected IT systems.
• Analysis Costs: In the event of a data breach, you will have to conduct a forensic analysis to identify the root cause of the breach and figure out how to prevent further occurrences. Cyber insurance may cover the costs of such an investigation. 
• Downtime Costs: When your business operations shut down, even temporarily, due to IT issues, you lose revenue. You could get a cyber insurance policy to cover such downtime costs.
• Extortion Money: In some cases of data theft like a ransomware attack, cybercriminals usually demand a certain amount of money as ransom or extortion to let you access it again. Considering how rampant ransomware attacks are these days, it may make sense to opt for a policy that covers this angle as well.

When looking for a Insurance company, here are a few things to consider before you sign up. First, perform an internal risk analysis. Research to understand what kind of cybercrimes are most rampant in your industry and ensure your insurance policy covers those for sure. Like we discussed before, the most basic of cyber insurance covers data breach and associated costs, but you definitely want more than just that.

Be clear about the scope of your policy before you sign the dotted line. Remember that cyber insurance functions on the same principles and policies as any other insurance, which means there will be deductibles, waiting periods and exclusions. Be sure to ask your insurance provider about them. You don’t want to find out you weren’t covered by insurance until after the attack, at the time of claim. Here are a few things to ask your insurance company in this regard.

• Does the policy cover you if a breach happens via your sub-contractor or vendor and makes you liable to your clients? If your cyber insurance doesn’t cover those, then make sure your vendors and sub-contractors have cyber insurance to cover you or sign some kind of an indemnity contract with them so you are covered in the event of such incidents.
• In case of an action by your employee causing the breach, such as clicking on a fraudulent link or sharing data accidentally to a dubious email ID, will you still be covered?
• Ask your insurance provider to clearly spell out any deductibles, exclusions and window periods that may exist
• Check with your insurance provider on what would be your liabilities as the insured. For example, there may be rules regarding anti-virus measures, data safety and security measures, IT training, timely data backups and IT audits, etc., that you may have to follow in order to be eligible to be covered under the insurance in the event of a breach.

Before you sign up, do your research thoroughly, get proposals from multiple insurance service providers and opt for a policy that covers your needs the most and the best. Sometimes, service providers may be willing to make additions or modifications to an existing policy to meet your exact requirements, which may work best for you.

Depending on the coverage and risk, annual cyber insurance costs range anywhere from $1000 a month to about a million dollars. But, what you need to ask yourself is, how much can it cost you if you ignored cyber insurance? The answer is, it could cost you your business, your customers and your brand reputation. With cybercrimes rising at alarming rates, cyber insurance is not a luxury that only the big players should invest in. It is the need of the hour for any business, irrespective of its industry or size.

Cyber insurance, however, is not a replacement for cybersecurity. Having cyber insurance doesn't mean you can be lax about cybersecurity. It is meant as a buffer, to help.your business survive when something slips through the cracks. An MSP can help you tighten your cybersecurity and prevent data breaches and other untoward incidents. Also, being well versed with the IT industry, your MSP can help you understand the IT risks that you need to get covered for. They can also help you pick out the right cyber insurance policies, in some cases, some of them even being insurance advisors or agents. The bottom line is, every organization--big or small, needs cyber insurance today.