Answers › Technical support and security
Should a small business have cyber insurance?
It can be worth a conversation with a licensed insurance agent. The FTC calls cyber insurance one option that can help protect a business against losses from a cyber attack, and suggests discussing with your agent which policy fits your company. Coverage, exclusions and limits differ by policy, so someone licensed should read the wording. Insurers often ask about basics such as multi-factor sign-in and backups. This is a plain summary, not legal advice.
What the FTC says it is
On its small-business cybersecurity page, the FTC says cyber insurance is one option that "can help protect your business against losses resulting from a cyber attack." It suggests discussing with your insurance agent which policy would fit your company's needs, and it describes two kinds of coverage, first-party and third-party.
This is a plain summary, not legal advice. It is not insurance advice either: only the policy itself, read by a licensed agent, settles what is covered.
First-party and third-party coverage
| First-party | Third-party | |
|---|---|---|
| What it protects, per the FTC | Your data, including employee and customer information | Generally, you, from liability if a third party brings claims against you |
| Costs the FTC's lists include | Legal counsel on notification and regulatory obligations; recovery and replacement of lost or stolen data; lost income from business interruption; cyber extortion and fraud; forensic services to investigate the breach | Payments to consumers affected by the breach; claims and settlement expenses for disputes or lawsuits; costs of litigation and of responding to regulatory inquiries |
What the FTC says to check in a policy
- Its list of coverage to make sure of includes data breaches such as theft of personal information, attacks on your data held by vendors and other third parties, and breaches of your network.
- It also lists attacks that occur anywhere in the world, not only in the United States.
- It asks you to consider whether the provider will defend you in a lawsuit or regulatory investigation, and says to look for "duty to defend" wording.
- It also asks whether the provider will cover amounts above your other insurance, and whether it offers a breach hotline available every day of the year.
What insurers often ask, and what to do first
This part is general advice, not from the FTC page. Insurers often ask on an application about basic protections, such as multi-factor sign-in, backups and training staff to spot phishing. Answer accurately, because a wrong answer can cause trouble when you make a claim. The related answers on multi-factor authentication, backing up business data and spotting a phishing email cover those basics.
Insurance does not replace those steps, and it does not replace a plan. The related answers on small business cybersecurity basics, what to do after a data breach and preparing for ransomware cover where to start and what to do if something happens.
Sources
Related answers
- What are the basic cybersecurity steps for a small business?
- What should a small business do after a data breach?
- What is ransomware, and how should a small business prepare for it?
- What is multi-factor authentication, and should every business account use it?
- How should a small business back up its data?
- How do you spot a phishing email or text, and what should staff do with it?
Ongoing technical support
The site goes down, email stops arriving, a domain is about to lapse, nobody knows the password. Many owners do not have a technical person. We are that person, for everything we build and the things you already have.