Cyber liability insurance

First-party costs

These are your own costs of dealing with the incident, and they are usually the larger half for a small business.

• Forensic investigation to establish what happened and what was taken
• Notifying the people whose data was affected, which can be a substantial exercise in itself
• Credit monitoring and support for those affected
• Restoring data and systems
• Business interruption from the downtime, which standard interruption cover generally will not pay because there is no physical damage
• Extortion costs where a ransom demand is involved
• Public relations and crisis management

Third-party liability

These are claims made against you: by customers whose data was exposed, by partners whose systems or information were affected, and by regulators.

Defence costs are covered as they are on other liability policies, and here they are often the dominant expense because these claims are argued at length.

Regulatory fines and penalties are treated variably — sometimes covered where legally permitted, sometimes excluded entirely. It is a specific question worth asking rather than assuming either way.

The incident response service

The genuinely useful part of a cyber policy for a small business is often not the money but the response service attached to it: a number to call that produces forensic, legal and communications help immediately.

Most small businesses have no plan for the first twenty-four hours, and the first twenty-four hours determine the size of everything that follows.

That service usually has to be engaged through the insurer rather than arranged independently, so knowing how to trigger it before an incident is part of holding the cover.

What is usually required or excluded

Insurers increasingly ask about controls and treat the answers as conditions rather than as background — multi-factor authentication, backups, patching, staff training.

Answering those questions inaccurately is dangerous, because a claim can turn on whether the control described actually existed.

Common exclusions include failures the business knew about and did not address, and losses arising from unsupported systems. As with everything else on a commercial policy, cover follows what the insurer was told.

Who needs it

The test is not size. It is whether you hold data someone would want, or depend on systems you could not trade without — which now describes almost every business.

Businesses holding payment details, health information or large volumes of personal data are the obvious cases. So is any business whose operations stop entirely when its systems do.

Client contracts increasingly require it, particularly where you handle a client's own data, which is bringing it into businesses that would not otherwise have considered it.