If a Cyberattack Hit Tomorrow Which Policy Would Answer

Most general liability and commercial property policies are not designed for cyber losses. Learn what cyber coverage may address and which questions to ask.

A cyber incident can begin with one ordinary-looking email and quickly become an operations, financial, and customer-trust problem.

A small business owner may assume that a general liability policy or business owners policy will respond because the event harmed the business. That assumption deserves a closer look. The National Association of Insurance Commissioners explains that most commercial property and general liability policies do not cover cyber risks. Cyber insurance is normally written separately or added through specialized coverage, and policy terms vary widely.

The first question is not whether you use technology

Nearly every business uses technology. The more useful question is what would happen if the technology, money, or information your business depends on suddenly became unavailable or compromised.

Could you operate if your email, scheduling system, customer records, or payment platform stopped working?
Do you store names, addresses, payment information, health information, or employee records?
Could someone impersonate an owner, employee, vendor, or client and redirect a payment?
Would a shutdown create lost income while payroll, rent, and other fixed expenses continued?

Those questions identify the business problem before anyone discusses a policy. They also help separate several exposures that are often grouped together under the word cyber.

The cost can reach far beyond repairing a computer

After a breach or ransomware event, a business may need forensic specialists to determine what happened, legal guidance about notification duties, data restoration, customer communications, credit monitoring, public relations assistance, and help negotiating or responding to an extortion demand. A business may also lose revenue while systems are unavailable.

If customers, employees, or business partners claim that the company failed to protect information, the incident may create third-party liability and defense costs. If a criminal tricks an employee into transferring money, the relevant protection may involve cybercrime or crime coverage rather than the same part of the policy that addresses a privacy breach.

First-party and third-party coverage answer different problems

First-party cyber coverage generally focuses on losses suffered directly by the insured business. Depending on the policy, that may include incident-response services, data restoration, cyber extortion, system interruption, and certain fraud losses.

Third-party cyber liability generally focuses on allegations made by someone else. Examples may include a customer alleging that private information was exposed or a business partner claiming that a security failure caused it financial harm.

The labels are helpful, and the details matter more. Policies may define computer systems, data, waiting periods, vendors, voluntary payments, social engineering, and required security practices differently. A coverage limit that looks adequate in isolation may also contain smaller sublimits for particular types of losses.

Insurance and cybersecurity should support each other

Insurance is not a replacement for basic security. It is one part of a broader plan. The Cybersecurity and Infrastructure Security Agency and the National Institute of Standards and Technology provide small-business resources covering multifactor authentication, phishing resistance, backups, vendor risk, and incident-response planning.

An incident plan should identify who has authority to act, which technology provider to call, how to preserve evidence, how to continue essential operations, and when to notify the insurer. Some cyber policies provide access to an approved response team. Contacting the insurer promptly can help avoid taking steps that conflict with policy requirements or response arrangements.

Questions worth discussing before a breach

What information and systems are essential to daily operations?
Which cyber losses are covered on a first-party basis, and which third-party claims are covered?
Are ransomware, social engineering, funds-transfer fraud, and dependent-business interruption included or limited?
What security controls does the application or policy require us to maintain?
Who do we call first when we suspect an incident?

A useful cyber conversation does not begin with fear. It begins by identifying the systems, information, money, and relationships the business cannot afford to lose, then comparing those exposures with the protection actually in place.

Start a conversation

If you own or manage a business, start by mapping what would stop if your systems went down for a day, a week, or longer. We can then discuss which risks belong in a technology plan, which belong in an insurance plan, and where the two need to work together. Insurance should always start with a conversation.

Coverage note: Insurance coverage depends on the individual policy, endorsements, exclusions, underwriting, the facts of a loss, and applicable law. This article is educational and is not legal, tax, safety, or coverage advice.