iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Cyber insurance can help a small business pay for breach response, data recovery, business interruption, extortion, fraud and claims from customers or regulators. It does not guarantee payment for every cyber loss. The policy’s definitions, limits, sublimits, exclusions, territory, deductibles and security conditions determine what is actually covered.
What cyber insurance is designed to cover
Cyber policies usually have two broad sections. First-party coverage pays the insured business’s own costs after a covered cyber incident. Third-party coverage responds when another person or organization alleges that the business caused harm and seeks compensation, a defense or both.
This division is a starting point, not a promise that every policy includes every item below. Some protections are optional endorsements, have their own sublimits or apply only after a specific trigger. Read the declarations page, insuring agreements, definitions, exclusions and conditions together.
| Coverage section | Typical purpose | Questions to ask |
|---|---|---|
| First party | Pays eligible costs incurred by the insured business to investigate, respond to and recover from a covered event. | What events trigger coverage? Which costs have separate sublimits or waiting periods? |
| Third party | Addresses claims, litigation, settlements, damages, judgments and some inquiries brought by customers, regulators or other parties. | Is there a duty to defend? Are regulatory inquiries and consumer claims included? Is this insurance primary or excess? |
For U.S. small businesses, Federal Trade Commission guidance describes the same first-party/third-party framework and advises discussing the choice with an insurance professional. In the United Kingdom, National Cyber Security Centre and Association of British Insurers guidance stresses that market terms vary and that the contract controls.
#1 Best Overall
First-party costs a policy may pay
Legal advice and regulatory obligations
A policy may pay for counsel advising on breach notification, privacy duties, evidence preservation and communications with regulators. The covered expense can be the lawyer’s work rather than any fine or compensation eventually imposed. Confirm whether counsel must be selected from an insurer-approved panel and whether the insurer must consent before work begins.
Forensic investigation
Forensic specialists may determine how an attacker entered, which systems or records were affected and whether the intruder remains present. Policies commonly treat this investigation as an incident-response expense. Check the definition of a covered event, the approved-vendor process and whether investigation is available for suspected incidents or only confirmed breaches.
Notification and affected-person support
Eligible costs can include notifying customers or other affected people, setting up a call center and providing related support services. The policy may specify notification methods, a per-person sublimit, a maximum number of affected individuals or an approval requirement for the notification content.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Data recovery or replacement
Coverage may pay to restore or replace lost, corrupted or stolen data, including specialist recovery work. It does not make an unreliable backup strategy acceptable: restoration costs, the value of the underlying data and the cost of recreating business records can be treated differently. Ask whether cloud data, paper records, proprietary software and data held by a service provider are included.
Business interruption and extra expense
If a covered incident stops normal operations, the policy may reimburse lost income and necessary extra expenses during recovery. Important mechanics include the waiting period before payments start, the restoration period, how income is calculated and whether a supplier, cloud platform or other dependent system must suffer direct damage. A separate sublimit can be much lower than the headline policy limit.
Crisis management and public relations
Some policies fund crisis-management consultants, public-relations work and communications intended to protect customer trust. Approval rules can apply to statements, agencies and expenses. Coverage for reputational harm itself is not the same as payment for a consultant helping manage communications.
Cyber extortion
Extortion coverage may address ransom demands, negotiators, legal advice and related response expenses when a policy-defined cyber-extortion event occurs. Payment may require insurer consent, lawful handling of funds and compliance with sanctions or other applicable law. A policy can cover negotiation or restoration while excluding or limiting the ransom payment itself.
Fraud and funds-transfer losses
Some forms cover direct financial loss from cyber fraud, but the wording may require a particular mechanism, such as unauthorized access to a computer system, and may impose a separate sublimit. Social-engineering fraud and business email compromise often require a specific endorsement and controls such as call-back verification or dual approval.
Third-party liability coverage
Consumer claims and compensation
Third-party insurance may respond when customers allege that a breach exposed their personal information or caused another covered loss. Potential payments can include settlements, damages or judgments, subject to the policy’s definition of a claim and its consent requirements.
Defense and litigation expenses
Legal defense can be a major cost even when a claim is ultimately unsuccessful. Look for explicit duty to defend language, whether defense costs reduce the policy limit, and who selects counsel. Some policies reimburse defense expenses only after the business pays them; others allow the insurer to appoint and manage defense counsel.
Regulatory inquiries
Third-party coverage may include costs responding to a regulator’s inquiry, investigation or proceeding. The policy may distinguish an informal request for information from a formal investigation and may exclude penalties that the law does not permit an insurer to pay. Ask which jurisdictions and regulators are within scope.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesSettlements, damages and judgments
Eligible settlements, damages and judgments can be covered when they arise from a covered claim. Settlement consent, cooperation duties and allocation rules matter if a claim alleges both covered and uncovered conduct. Coverage can also be excess of another applicable policy, so identify which insurer must respond first.
What cyber insurance may not cover
The following are common boundaries or examples identified in U.S. and UK guidance. They are not universal exclusions. An endorsement, a different policy form or local law may change the result.
Business email compromise
The UK NCSC warns that some policies may not cover money lost through business email compromise. A policy may cover an intrusion but not a payment an employee was tricked into authorizing, or it may cover that payment only under a social-engineering or funds-transfer endorsement. Ask specifically about fraudulent invoices, altered bank details, executive impersonation, verification procedures, notice deadlines and the applicable sublimit.
Territory and court jurisdiction
Policies can restrict where an incident occurs, where the affected person is located or where a claim is brought. ABI guidance notes that some UK-market policies may exclude North American territory or courts. A U.S. business serving customers abroad should not assume that its domestic policy follows it worldwide; confirm territory, governing law and permitted defense locations.
Claims by related entities
Definitions of “insured,” “claimant” and “third party” can exclude claims by parent companies, subsidiaries, employees, contractors or other related entities. A group with shared systems should verify which legal entities are insured and whether an internal transfer of data can produce a covered claim.
Bodily injury and physical property damage
Cyber wording often focuses on digital loss. ABI identifies bodily injury and physical property damage as possible UK-market exclusions or limitations. If a cyber event could affect machinery, safety systems or physical premises, coordinate cyber coverage with property, liability and specialist technology policies rather than assuming one policy covers all consequences.
Infrastructure and dependent-system outages
An outage at a telecommunications provider, cloud service, payment processor or other infrastructure provider may fall outside the basic business-interruption trigger. Some policies add dependent-business-interruption coverage; others require the insured’s own system to be directly affected. Check the trigger, waiting period, named providers, aggregation rules and sublimit.
Cyber warfare and state-linked attacks
War, cyber-warfare and state-action exclusions can be complex, especially when attribution is uncertain. ABI lists cyber warfare or state-linked attacks among possible UK policy boundaries. Ask how the wording treats an attack that resembles state activity but cannot be conclusively attributed, and whether an endorsement changes the exclusion.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Fines, sanctions and penalties
Do not treat “regulatory coverage” as a promise that every fine is insured. ABI notes that legally payable criminal, civil or regulatory fines and sanctions may be excluded in the UK. U.S. insurability also depends on the type of payment and applicable law. A policy may cover legal advice, investigation and defense while excluding the penalty itself.
Best Value
- Easy To Track Your Finances: HAUTOCO horizontal accounting ledger book keeps you on top of your expenses and income! Help you keep your money organized, spend well, and set and achieve financial goals
- Practical Design: The accounting book is PU leather hardcover, with double-wire spiral binding that allows it to lay flat 360°; 100gsm thick paper, comes with an elastic band, pen loop, bookmarks, and 2 large pockets for storing loose notes
- Plenty of Space: The expense tracking notebook measures 10.78 x 8'' and has 120 pages with 3000 lines of entries giving you enough space to record each of your transactions
- Manage Your Finances Effectively: Undated accounting books with number, date, description, account, payment or deposit amount, and total balance. You will be able to easily analyze your financial activities and quickly prepare accurate financial statements
- Ideal For Small Business or Personal Use: An accounting log journal can track your business or personal financial status. With a clear record of transactions, you can find unnecessary expenses or fraudulent charges
Prior incidents, known circumstances and misrepresented controls
Claims arising from an incident or circumstance known before the policy began may be excluded or assigned a retroactive-date restriction. Application answers also matter. The NCSC states: “If you’re claiming that security measures are in place when they’re not, the insurer may not be obliged to pay any claims.” Keep evidence of the controls represented at application and renewal, and notify the insurer when a material change occurs.
Limits, sublimits, deductibles and conditions
A $1 million aggregate limit does not mean $1 million is available for every category. A policy can apply an aggregate across all claims, a per-incident limit, separate sublimits for notification, fraud or interruption, and a deductible or retention that the business pays first.
| Policy feature | Why it matters | What to verify |
|---|---|---|
| Aggregate limit | Caps total payments during the policy period. | Whether defense costs erode the limit and how multiple incidents are combined. |
| Sublimit | Caps a specific cost below the overall limit. | Notification, business interruption, extortion, social engineering and dependent-system amounts. |
| Retention or deductible | Sets the amount the business funds before insurance responds. | Whether it applies separately to first-party and third-party losses. |
| Waiting period | Delays business-interruption payments after the trigger. | How hours are counted and whether the period applies per event. |
| Territory | Controls covered locations, people and courts. | Countries served, data subjects’ locations and claim venues. |
| Retroactive date or reporting deadline | Can restrict older incidents or late notices. | When an act must have occurred and how quickly circumstances must be reported. |
| Security conditions | Require specified safeguards to be maintained. | Multifactor authentication, backups, patching, access controls and incident reporting obligations. |
How to compare two policies
- Map your likely events. List ransomware, accidental disclosure, credential theft, fraudulent transfers, vendor outages and customer claims. Match each event to a defined insuring agreement rather than relying on the policy title.
- Separate response from liability. Confirm which policy section pays for forensics, counsel, notification, restoration, interruption and crisis communications, then examine the liability section for defense, regulatory inquiries, settlements and judgments.
- Test the triggers. Ask whether coverage requires a security failure, a privacy breach, direct system damage, a claim, a written demand or a confirmed intrusion. Check waiting periods and restoration-period limits.
- Examine fraud and extortion wording. Request the exact definitions of social engineering, business email compromise, funds-transfer fraud and cyber extortion. Note approval, verification, consent and notice requirements.
- Read exclusions with your operations in mind. Review war or state action, infrastructure outages, prior incidents, unpatched systems, misrepresented controls, physical damage, related entities and territory restrictions.
- Calculate usable capacity. Compare the aggregate limit, each sublimit, retention, defense-cost treatment and any coinsurance or waiting period against a realistic outage and notification scenario.
- Confirm insurer services. Ask about a 24-hour hotline, approved forensic firms, breach counsel, notification vendors, restoration specialists, crisis communications and the process for obtaining consent.
- Check other insurance. Determine whether cyber coverage is primary or excess and how it coordinates with crime, property, general liability, technology errors-and-omissions and directors-and-officers policies.
What to do when an incident happens
- Activate your incident plan. Preserve evidence, isolate affected systems when safe and use a separate communication channel if accounts may be compromised.
- Notify the insurer promptly. Use the claims number or broker instructions in the policy. Late notice can affect coverage, and some policies require consent before hiring vendors or paying expenses.
- Use approved responders. Coordinate forensic investigators, breach counsel, restoration providers and communications specialists through the insurer unless the wording permits your own providers.
- Record costs and decisions. Keep invoices, time records, ransom demands, transfer instructions, logs, notifications and the reason for each mitigation expense.
- Meet legal and policy deadlines. Counsel can help with notification duties, while the policy may impose separate deadlines for reporting a claim, circumstance or fraudulent transfer.
Does cyber insurance cover ransomware?
It can, but “ransomware” is not a universal coverage promise. A policy might cover forensic investigation, legal advice, data restoration, business interruption, crisis response and cyber-extortion expenses, each subject to its own trigger and sublimit. Ransom payments may require prior insurer consent and must comply with sanctions and other law. A policy can also exclude a payment while covering recovery costs. Ask the insurer to show the exact ransomware, extortion, interruption and restoration wording before buying or renewing.
Does cyber insurance cover business email compromise?
Sometimes, under a specific fraud or social-engineering endorsement; sometimes only for certain transfer methods; and sometimes not at all. Confirm whether an employee’s authorized payment after receiving a spoofed message qualifies, what verification controls are required, how quickly the bank and insurer must be notified, and the separate limit. Do not infer coverage from a general promise to cover “cybercrime.”
Insurance is one part of resilience
Coverage does not prevent an intrusion or restore operations by itself. Maintain tested, offline or otherwise protected backups; multifactor authentication; least-privilege access; patching; vendor-risk procedures; logging; staff training; and a written incident-response plan. A backup device or cybersecurity tool can support recovery, but owning one does not create insurance coverage or satisfy a policy condition unless the contract says so.
Before signing, give a licensed insurance agent or cyber-insurance broker an accurate description of your systems, data, vendors, locations and controls. Ask for the current wording and endorsements, not only a certificate or marketing summary. Review the policy at renewal when you add cloud services, change payment processes, acquire another entity or materially alter security controls.
Jurisdiction matters
FTC guidance is directed to U.S. small businesses and recommends deciding, with an insurance agent, whether first-party coverage, third-party coverage or both fit the company’s needs. NCSC guidance dated 6 August 2020 and ABI guidance describe UK-market questions and exclusions; those examples should not be transplanted into a U.S. policy without checking its wording and applicable law. Premiums, limits, exclusions, the insurability of fines and required controls depend on the business and jurisdiction.
Recommended Free Tools
The FTC puts the buying decision plainly: “If you’re thinking about cyber insurance, discuss with your insurance agent what policy would best fit your company’s needs, including whether you should go with first-party coverage, third-party coverage, or both.”
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
