CYBER SECURITY
Does a small business need cyber insurance, and what do insurers ask for?
Many small businesses benefit from cyber insurance because a single incident can bring large recovery costs, lost trading time and obligations to customers. Insurers increasingly expect basic security to be in place first, such as multi-factor authentication, reliable backups and up-to-date systems, and they ask about these before offering cover.
What cyber insurance is for
Cyber insurance helps a business deal with the financial impact of a cyber incident, such as ransomware, a compromised email account or a data breach. Policies vary, but cover can include incident response and recovery costs, lost income while systems are down, the cost of notifying affected people, and some liability to third parties. A general business policy may not include these, so it is worth checking what you already have.
Does a small business need it?
Size alone does not decide it. A small business that relies on email, online banking, cloud systems or customer information can be badly affected by a single incident, and is often less able to absorb the cost and downtime than a larger one. Cyber insurance is worth considering if the business would struggle to pay for recovery, could not trade for days without its systems, or holds personal or financial information about customers. It works best alongside good security, not instead of it.
What insurers commonly ask about
Insurers usually ask a set of questions about how the business is protected before offering cover or setting a premium. Common areas include:
- Multi-factor authentication on email, remote access and administrator accounts
- Regular backups, kept separate from the main systems and tested to restore
- Timely security updates for computers, servers and software
- Endpoint protection on business devices, often endpoint detection and response (EDR)
- Email filtering and protection against phishing
- Security awareness training for staff
- Limits on who has administrator access
- A documented plan for responding to an incident
- A process for checking changes to bank account details before paying invoices
Answer the questions accurately
The answers given on an insurance application matter. If a business says a control is in place when it is not, that can create problems if a claim is made later. Before completing the questions, check how each control actually works in your environment, rather than how you believe it is set up.
Security first, then insurance
The controls insurers ask about are the same ones that reduce the chance of an incident in the first place. Putting them in place can make cover easier to obtain and, more importantly, makes a serious incident less likely. Insurance then covers the risk that remains.
When to get help
Your insurance broker or insurer can advise on policies and cover. InfinityIT can help with the technical side: reviewing which controls are in place today, closing gaps such as multi-factor authentication or backup testing, and giving you accurate information to answer an insurer’s security questions.
RELATED QUESTIONS
Frequently asked questions.
Will cyber insurance pay if we are hit by ransomware?
It depends on the policy wording, the cover chosen and whether the business met the conditions of the policy. Check the details with your broker or insurer rather than assuming a particular event is covered.
Can a business get cyber insurance without multi-factor authentication?
Many insurers now treat multi-factor authentication as a basic expectation, particularly for email and remote access. Without it, cover may be harder to obtain or come with conditions, so it is usually one of the first controls to put in place.
Does cyber insurance replace backups or security tools?
No. Insurance helps with the financial impact of an incident, but it cannot restore your data or stop an attack. Good backups and security controls are what get the business running again, and insurers expect them to be in place.
Is this advice about which policy to buy?
No. This is general guidance about the security side of cyber insurance. For advice on policies and cover, talk to a licensed insurance broker or insurer.