Cyber liability insurance

Cyber liability policies are usually built in two halves. The first party half covers what happens to you: business interruption while systems are down, the cost of restoring data, extortion and ransom payments, and the crisis management and notification expenses that follow a breach, which are legally required in most states and rarely cheap. The second half covers what other people do to you: legal defense when customers sue, regulatory fines and proceedings where insurable, and settlements.

The most misunderstood part is that a cyber policy is conditional. Carriers increasingly write in requirements that must be true at the time of loss, commonly multi factor authentication on email and remote access, regular employee training, current security software, and backups kept separate from the main environment. These are not suggestions in the marketing sense. If the application said they were in place and they were not, the claim is exposed.

The other thing worth internalizing is that you do not have to be a technology company to have this exposure. Any business with an email address, a bank account, and employees who process payments is already carrying the risk. The only question is whether it is insured.

Related terms

This page is education, not advice. Policy language varies by carrier, form, and state, so confirm how your own program is written with a licensed insurance professional.