A small company does not need to be a technology company to have cyber exposure. A retailer may store customer information, a professional firm may hold confidential files, a manufacturer may depend on connected production systems, and almost every business relies on email, cloud software and online banking.
The NAIC notes that most commercial property and general liability policies do not cover cyber risks and that cyber policies are highly customized. That makes cyber insurance different from buying a standardized commodity: two policies with similar premiums can respond very differently to the same incident.
First-party and third-party cyber coverage
Most cyber programs can be understood through two broad buckets. First-party coverage addresses costs incurred directly by the insured business. Third-party coverage addresses liability to customers, partners or others who allege harm.
| Exposure | Examples of coverage that may be available |
|---|---|
| Incident response | Forensics, legal guidance, notification, call-center and credit-monitoring costs |
| Cyber extortion | Negotiation, specialist response and certain extortion-related costs, subject to law and policy terms |
| Business interruption | Lost income and extra expense after a covered network interruption |
| Data restoration | Costs to restore or recreate certain electronic data |
| Privacy / network liability | Defense and damages arising from covered privacy or security failures |
| Regulatory response | Certain investigation or defense costs where insurable by law |
Why exclusions deserve as much attention as the coverage list
A cyber policy can contain conditions and exclusions related to prior incidents, known vulnerabilities, contractual liability, infrastructure failure, war or cyber operations, fraudulent transfer, dependent providers, unencrypted devices or failure to maintain security controls. Wording varies materially by insurer.
Do not rely on a one-page marketing summary. Ask for examples of how the policy would respond to the scenarios that could actually shut down your company.
Ransomware is not the only cyber scenario
Business email compromise, stolen credentials, accidental disclosure, a vendor outage and a lost laptop can all create costs. A policy focused only on the headline risk of ransomware may leave important operational exposures poorly understood.
How security controls affect underwriting
Cyber underwriters increasingly ask detailed questions about multifactor authentication, backups, endpoint protection, patching, privileged access, employee training, remote access and incident response. These are not merely application questions; inaccurate answers can create coverage disputes. Treat the application as part of the insurance contract and involve the person who actually manages the systems.
A small-business cyber insurance buying checklist
- Map your data. Know what personal, financial, health or confidential information the company stores.
- Identify critical vendors. List cloud, payment, managed-service and software providers whose outage could stop operations.
- Estimate downtime. How much revenue and extra expense would one day, one week or one month offline create?
- Compare sublimits. Social engineering, cybercrime, dependent business interruption and extortion may have separate limits.
- Understand the panel. Some policies require or encourage use of approved law firms, forensic firms and breach-response vendors.
- Coordinate policies. Review crime, professional liability, directors and officers, property and other policies for overlaps or gaps.
How much cyber insurance should a small business buy?
There is no universal limit. A useful starting point is to model plausible losses: response costs per affected record, lost gross profit during downtime, restoration expense, potential contractual obligations and liability. The result is more defensible than choosing a round number simply because it is commonly sold.
Frequently asked questions
Does general liability insurance cover a data breach?
Traditional commercial policies often do not provide the broad cyber protection a modern business needs. The NAIC specifically notes that most commercial property and general liability policies do not cover cyber risks.
Does cyber insurance replace cybersecurity?
No. Insurance transfers part of the financial risk; it does not prevent an attack or replace security controls, backups and incident-response planning.
Are all cyber policies basically the same?
No. Cyber insurance is highly customized, and definitions, exclusions, sublimits and security conditions can differ materially.
Sources & further reading
This guide is general information. Cyber wording and insurability of particular costs vary by jurisdiction and policy.
