Small businesses are not too small to target. They are easier to target. A cyber policy pays for the response, the downtime, and the liability when the email, the laptop, or the payment system gets compromised.
Coverage is subject to eligibility and carrier underwriting.
Cyber policies combine two kinds of protection.
| First-party: your own losses | Third-party: claims against you |
|---|---|
| Forensic investigation to find out what happened | Lawsuits by customers or clients whose data was exposed |
| Breach notification, call centers, and credit monitoring | Regulatory investigations, and fines and penalties where insurable |
| Ransomware and extortion response | Payment card industry assessments after a card data breach |
| Restoring data and systems | Claims that your systems spread malware to someone else |
| Lost income while systems are down | Media liability for content on your website and social media |
A vendor’s email is compromised, or a spoofed address looks just like your client’s. A message arrives with new wire instructions, and someone in the office follows them. The money is gone within hours.
This is generally called social engineering or funds transfer fraud, and it is one of the most common losses small businesses report. Many cyber policies cover it only with a separate, much lower sublimit, or only by endorsement, and some exclude it entirely. Some crime policies also cover it. Ask specifically, and get the answer in writing.
Verify every change to payment instructions by calling a phone number you already have on file — never one provided in the email requesting the change. Many carriers now require this procedure as a condition of social engineering coverage.
Carriers increasingly require basic security controls before they will offer coverage or a competitive price.
On email, remote access, and administrator accounts. Often a hard requirement.
Regular, tested backups kept separate from your network, so ransomware cannot encrypt them too.
Modern anti-malware and monitoring on computers and servers.
Keeping operating systems and software up to date.
Phishing awareness for everyone who has an email account.
Knowing who to call first. Most policies provide a breach hotline and preferred vendors.
New Jersey and Pennsylvania both have data breach notification laws that can require a business to notify affected individuals — and in some cases state authorities — when certain personal information is compromised. The obligations depend on the type of data, the number of people affected, and where they live. A cyber policy typically pays for breach counsel to determine what is required and for the cost of notification.
Whether and how you must notify is a legal question, not an insurance question. The policy’s breach counsel, or your own attorney, makes that call.
Some include a small data breach endorsement, often with low limits and narrow terms. It is rarely a substitute for a standalone cyber policy.
Yes. Cloud providers secure their platforms, but compromised passwords, phishing, and fraudulent payment instructions happen on your side. Losing access to a cloud system can also interrupt your business.
Many policies cover extortion payments where lawful, along with negotiation and recovery costs, subject to the carrier’s consent and applicable law. Coverage terms for ransomware vary considerably by carrier.
Expect questions about your revenue, the kinds of data you hold, and your security controls. Answer carefully — inaccurate answers about controls such as multi-factor authentication can jeopardize coverage when you need it.
We will walk through the application questions with you, compare policy forms, and check the social engineering coverage most businesses assume they have.
Cadabra Asset Protection LLC is a licensed independent insurance agency serving New Jersey and Pennsylvania. Michael Lindner Jr., licensed insurance producer.
Cyber policy forms, sublimits, and exclusions vary widely by carrier. Coverage for ransom payments and fines is subject to applicable law. Information on this page about breach notification obligations is general and is not a substitute for advice from counsel.
Coverage descriptions on this page are general summaries provided for informational purposes only. Coverage, limits, endorsements, and exclusions vary by carrier and by state, and actual coverage is governed solely by the terms of the issued policy. This page is not an offer of insurance and is not a guarantee that coverage will be issued. All coverage is subject to eligibility and carrier underwriting approval.
Nothing on this page is legal advice, and no attorney-client relationship is created by its use or by contacting this agency for insurance services.
